Function at 0x4b0fd0
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov eax, 0x40080002
mov esi, 8
mov bl, 1
mov dword [esp + 0x28], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x40], 0
sub eax, edx
mov dword [esp + 0x84], eax
jmp 0x4b1026
mov eax, ecx
mov dword [esp + 0x40], ecx
push edx
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
xor ebx, ebx
call sub.kernel32.dll_GetCurrentProcessId
mov dword [esp + 0x90], eax
jmp 0x4b104a
mov eax, dword [esp + 0x50]
xchg dword [0x5c9134], eax
mov eax, dword [0x5c9134]
test eax, eax
jne 0x4b1090
xorps xmm0, xmm0
movaps xmmword [esp + 0x50], xmm0
push 2
push 0x10
lea eax, [esp + 0x58]
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jns 0x4b1040
lea ecx, [esp + 0x98]
call fcn.004b1fc0
mov eax, dword [esp + 0x98]
xchg dword [0x5c9134], eax
jmp 0x4b104a
mov eax, 1
lea edi, [esp + 0x30]
lock xadd dword [0x5c9134], eax
mov dword [esp + 0x50], 0x56c038
mov dword [esp + 0x54], 2
mov dword [esp + 0x60], 0
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 2
mov dword [esp + 0x94], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x34], fcn.004444a0
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], fcn.004444a0
lea ecx, [esp + 0x44]
lea edx, [esp + 0x50]
call fcn.0041bb50
cmp dword [esp + 0x1c], 0
movsd xmm0, qword [esp + 0x44]
mov eax, dword [esp + 0x4c]
sete cl
movsd qword [esp + 0x50], xmm0
mov dword [esp + 0x58], eax
or bl, cl
test bl, 1
jne 0x4b1133
push dword [esp + 0x18]
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
movsd xmm0, qword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x8c], esi
movsd qword [esp + 0x18], xmm0
test eax, eax
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x18]
lea ecx, [ebx + eax]
mov dword [esp + 0x2c], ecx
je 0x4b1170
movzx ecx, byte [ebx]
test cl, cl
js 0x4b1190
inc ebx
jmp 0x4b11f0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x10], 0
xor ebx, ebx
xor edi, edi
jmp 0x4b121e
movzx edx, byte [ebx + 1]
mov eax, ecx
and eax, 0x1f
and edx, 0x3f
cmp cl, 0xdf
jbe 0x4b11cf
mov edi, ecx
movzx ecx, byte [ebx + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
mov edx, edi
cmp dl, 0xf0
jb 0x4b11db
movzx edx, byte [ebx + 3]
shl ecx, 6
and eax, 7
add ebx, 4
shl eax, 0x12
and edx, 0x3f
or edx, ecx
mov ecx, edx
jmp 0x4b11e1
shl eax, 6
add ebx, 2
or eax, edx
mov ecx, eax
jmp 0x4b11f0
add ebx, 3
shl eax, 0xc
or ecx, eax
cmp ecx, 0xffff
ja 0x4b14ef
nop
mov dword [esp], ecx
mov eax, 1
mov dword [esp + 4], 0
mov edi, dword [esp + 0x2c]
mov ecx, 0xffffffff
sub edi, ebx
add edi, 3
cmovb edi, ecx
shr edi, 2
add edi, eax
mov ax, 1
mov dword [esp + 0x10], eax
cmp edi, 4
mov eax, 3
cmovb edi, eax
cmp edi, 0x3ffffffe
ja 0x4b167c
lea ecx, [edi + edi + 2]
test ecx, ecx
js 0x4b167c
movzx eax, byte [0x5c91e8]
mov edx, 2
mov esi, ecx
call fcn.0041aa20
test eax, eax
je 0x4b166e
mov edx, eax
mov eax, dword [esp + 0x40]
inc edi
mov esi, 1
mov ecx, edx
inc eax
mov dword [esp + 0x88], eax
mov eax, dword [esp]
mov word [edx], ax
mov eax, dword [esp + 4]
jmp 0x4b1299
xor ebx, ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov esi, dword [esp + 8]
mov word [ecx + esi*2], ax
mov eax, dword [esp]
inc esi
test ebx, ebx
je 0x4b1300
test ax, ax
je 0x4b12e0
mov dword [esp], 0
cmp esi, edi
jne 0x4b1480
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov ecx, 0xffffffff
mov dword [esp + 8], esi
sub eax, ebx
add eax, 3
cmovb eax, ecx
shr eax, 2
cmp word [esp], 1
sbb eax, 0xffffffff
cmp word [esp + 0x10], 1
sbb eax, 0xffffffff
jmp 0x4b1333
cmp ebx, dword [esp + 0x2c]
je 0x4b1300
movzx eax, byte [ebx]
test al, al
js 0x4b13ca
inc ebx
jmp 0x4b12a2
cmp word [esp + 0x10], 1
jne 0x4b1490
mov ebx, esi
mov esi, eax
xor eax, eax
cmp ebx, edi
mov dword [esp + 8], ebx
jne 0x4b1280
mov dword [esp + 0x10], 0
mov dword [esp], esi
xor ebx, ebx
mov dword [esp + 4], 0
inc eax
mov esi, edx
mov dword [esp + 0xc], edi
add eax, dword [esp + 8]
jb 0x4b165c
lea ecx, [edi + edi]
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 2
mov dword [esp + 0x14], ebx
cmp ecx, eax
mov dword [esp + 0x58], ecx
cmova eax, ecx
cmp eax, 5
mov edi, eax
mov eax, 4
cmovb edi, eax
xor edx, edx
cmp edi, 0x40000000
lea eax, [edi + edi]
setb dl
add edx, edx
lea ecx, [esp + 0x30]
lea ebx, [esp + 0x50]
push ebx
push eax
call fcn.00485950
add esp, 8
cmp dword [esp + 0x30], 0
mov ecx, dword [esp + 0x34]
je 0x4b13bb
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 4]
cmp ecx, 0x80000001
jne 0x4b1658
mov edi, dword [esp + 0xc]
mov edx, esi
mov ecx, esi
jmp 0x4b128d
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov edx, ecx
jmp 0x4b128d
mov dword [esp + 0xc], edi
movzx edi, byte [ebx + 1]
mov dword [esp + 8], esi
mov esi, eax
mov dword [esp + 4], eax
and esi, 0x1f
and edi, 0x3f
cmp al, 0xdf
jbe 0x4b1416
mov dword [esp + 0x14], edx
movzx edx, byte [ebx + 2]
shl edi, 6
and edx, 0x3f
or edx, edi
cmp byte [esp + 4], 0xf0
jb 0x4b1426
movzx eax, byte [ebx + 3]
and esi, 7
shl edx, 6
add ebx, 4
shl esi, 0x12
and eax, 0x3f
or eax, edx
or eax, esi
jmp 0x4b1430
shl esi, 6
add ebx, 2
or esi, edi
mov edi, dword [esp + 0xc]
mov eax, esi
jmp 0x4b143f
shl esi, 0xc
add ebx, 3
or edx, esi
mov eax, edx
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
cmp eax, 0xffff
ja 0x4b1448
mov esi, dword [esp + 8]
jmp 0x4b12a2
mov esi, eax
add eax, 0xff0000
and esi, 0x3ff
shr eax, 0xa
or esi, 0xdc00
mov dword [esp], esi
mov esi, dword [esp + 8]
or eax, 0xd800
cmp esi, edi
je 0x4b12b1
nop word cs:[eax + eax]
nop dword [eax]
jmp 0x4b1291
push 0
push 0
push 0x10000
push 0x10000
push 1
mov esi, dword [esp + 0xa0]
push esi
push dword [esp + 0x9c]
mov edi, edx
push edx
call sub.kernel32.dll_CreateNamedPipeW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4b156e
call sub.kernel32.dll_GetLastError
mov ecx, dword [esp + 0x88]
mov edx, edi
cmp ecx, 0xa
jge 0x4b151b
cmp eax, 5
je 0x4b1010
test esi, esi
je 0x4b151b
xor esi, esi
cmp eax, 0x57
je 0x4b1016
jmp 0x4b151b
mov eax, ecx
add ecx, 0xff0000
and eax, 0x3ff
shr ecx, 0xa
or eax, 0xdc00
mov dword [esp + 4], eax
mov eax, 2
or ecx, 0xd800
mov dword [esp], ecx
jmp 0x4b1200
mov ecx, dword [esp + 0x28]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 1
push edx
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov esi, 0xffffffff
cmp dword [esp + 0x1c], 0
je 0x4b155a
push dword [esp + 0x18]
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
cmp ebx, 0xffffffff
je 0x4b1619
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x4b1619
push edi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x50], 0
mov dword [esp + 0x6c], 0
mov word [esp + 0x70], 0
xorps xmm0, xmm0
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 1
mov byte [esp + 0x6d], al
xor al, 1
mov byte [esp + 0x6c], al
lea eax, [esp + 0x30]
movups xmmword [esp + 0x58], xmm0
mov dword [esp + 0x68], eax
mov edx, esi
lea eax, [esp + 0x50]
lea ecx, [esp + 0x44]
push eax
push dword [esp + 0x24]
call fcn.004a2f60
add esp, 8
movzx eax, byte [esp + 0x44]
cmp al, 4
jne 0x4b1621
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x1c], 0
mov eax, dword [esp + 0x48]
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov dword [ecx], 0
je 0x4b1619
push esi
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, byte [esp + 0x47]
mov edx, dword [esp + 0x28]
movzx edi, word [esp + 0x45]
mov esi, dword [esp + 0x48]
mov byte [edx + 7], cl
mov word [edx + 5], di
mov byte [edx + 4], al
mov dword [edx + 8], esi
mov esi, ebx
mov dword [edx], 1
cmp dword [esp + 0x1c], 0
jne 0x4b1549
jmp 0x4b155a
test ecx, ecx
jne 0x4b1663
call fcn.0041b180
jmp 0x4b1681
mov edx, dword [esp + 0x38]
call fcn.0041b1c0
jmp 0x4b1681
mov ecx, 2
mov edx, esi
call fcn.0041b1c0
jmp 0x4b1681
call fcn.0041b180
ud2