Function at 0x419216
Capabilities:
Create pipe
Encode data using xor
Read file on windows
Read pipe
Terminate process

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [0x49c83c], eax
push ebx
mov dword [esp + 0xc], 0xa56
push ebp
mov dword [esp + 0xc], 0xbb6
mov ebp, 0x49c720
mov dword [esp + 0x14], 0xf60
push esi
push edi
xor edi, edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x10], 0x1212
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0xfa2
mov eax, dword [esp + 0x14]
xor eax, 0x3d3
cmp dword [esp + 0x24], eax
je 0x41944b
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x18]
xor esi, 0x865
mov ecx, dword [esp + 0x1c]
sub edx, 0xa0
mov eax, dword [esp + 0x3c]
xor ecx, 0x1f1c
xor eax, 0x109d
push eax
push ebp
push ecx
push edx
push esi
call fcn.0041989c
mov dword [esp + 0x50], eax
mov ebx, 0x4dd
xor dword [esp + 0x50], 0x1410
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x34]
add esi, ebx
mov ecx, dword [esp + 0x30]
add edx, 0x566
mov eax, dword [esp + 0x34]
sub ecx, 0x3c5
push ebp
add eax, ebx
push eax
push ecx
push edx
push esi
call fcn.0041a0a1
mov ecx, dword [0x49c838]
add esp, 0x28
mov dword [esp + 0x10], eax
mov eax, dword [0x49c82c]
add eax, 0xffee3f42
xor ecx, eax
mov eax, dword [0x49c7b4]
mov dword [0x49c838], ecx
mov ecx, dword [0x493c3c]
mov edx, dword [edi + eax]
add edi, 4
mov eax, dword [0x49c724]
sub dword [ecx + 4], eax
mov ebx, dword [0x49c780]
mov ecx, dword [0x49c7a4]
mov eax, dword [0x49c7c8]
imul ebx, edx
mov edx, ebx
shr edx, 0x10
mov byte [eax + ecx], dl
mov edx, ebx
inc dword [0x49c7a4]
mov ecx, dword [0x493c3c]
mov eax, dword [0x49c74c]
shr edx, 8
sub eax, dword [ecx + 0x58]
xor eax, 0xfff5c31e
sub dword [0x49c7d0], eax
mov eax, dword [0x49c82c]
add eax, 0xffee3f43
imul eax, dword [ecx + 0x3c]
mov dword [ecx + 0x3c], eax
mov ecx, dword [0x49c7a4]
mov eax, dword [0x49c7c8]
mov byte [eax + ecx], dl
mov esi, dword [0x49c7a4]
mov edx, dword [0x493c3c]
inc esi
mov eax, dword [0x49c7d0]
mov ecx, dword [0x49c79c]
mov dword [0x49c7a4], esi
add ecx, 0xfffcf127
sub eax, dword [edx + 0x118]
add eax, 0xaced8c
xor dword [0x49c824], eax
mov eax, dword [0x49c808]
add eax, ecx
mov ecx, dword [0x49c790]
mov dword [0x49c79c], eax
add ecx, 0xffe77b78
mov eax, dword [0x49c748]
sub eax, dword [0x49c82c]
imul ecx, dword [0x49c804]
add eax, 0x11c0be
imul eax, dword [0x49c75c]
mov dword [0x49c804], ecx
mov dword [0x49c75c], eax
mov eax, 0xacede0
sub eax, dword [edx + 0x118]
add ecx, eax
mov eax, dword [0x49c7c8]
mov dword [0x49c804], ecx
mov byte [eax + esi], bl
mov eax, 0x1509f5
mov ecx, dword [0x493c3c]
inc dword [0x49c7a4]
sub eax, dword [ecx + 0xa0]
add dword [ecx + 0x64], eax
mov ecx, dword [0x49c73c]
xor ecx, dword [0x49c804]
imul ecx, dword [0x49c838]
mov dword [0x49c838], ecx
cmp edi, 0x77e0
jl 0x4192e9
xor dword [esp + 0x24], 0x106f
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x18]
sub edi, 0x1e2
mov edx, dword [esp + 0x14]
xor esi, 0x1a2a
mov ecx, dword [esp + 0x1c]
xor edx, 0x3d3
mov eax, dword [esp + 0x24]
add ecx, 0x42
push ebp
push eax
push ecx
push edx
push esi
push edi
call fcn.0041a28e
mov dword [esp + 0x34], eax
mov ebp, 0xc83
mov ebx, dword [esp + 0x54]
mov edi, dword [esp + 0x28]
xor ebx, 0xa8c
mov esi, dword [esp + 0x30]
sub edi, ebp
mov edx, dword [esp + 0x2c]
add esi, 0xdfe
mov ecx, dword [esp + 0x30]
xor edx, 0x1f35
mov eax, dword [esp + 0x28]
add ecx, 0x882
sub eax, ebp
mov ebp, 0x49c720
push eax
push ecx
push edx
push ebp
push esi
push edi
push ebx
call fcn.004176a7
mov dword [esp + 0x48], eax
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x54]
xor ebx, 0xcba
mov esi, dword [esp + 0x44]
add edi, 0x897
mov edx, dword [esp + 0x70]
sub esi, 0x7ca
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
sub ecx, 0x407
add eax, 0x99e
push eax
push ebp
push ecx
push edx
push esi
push edi
push ebx
call fcn.0040171f
mov dword [esp + 0x64], eax
add esp, 0x50
mov eax, dword [esp + 0x10]
xor eax, 0xd31
cmp dword [esp + 0x3c], eax
je 0x4196b4
mov eax, dword [esp + 0x3c]
add eax, 0xfffff011
cmp dword [esp + 0x1c], eax
jle 0x419572
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub esi, 0x8d7
mov ecx, dword [esp + 0x24]
xor edx, 0x19d9
mov eax, dword [esp + 0x3c]
push ebp
sub eax, 0xdfe
push eax
push ecx
push edx
push esi
call fcn.00401d58
add esp, 0x14
mov dword [esp + 0x10], eax
jmp 0x4196b4
mov ecx, dword [esp + 0x18]
jmp 0x4196a0
mov ebx, dword [esp + 0x14]
mov eax, dword [0x493c3c]
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [0x49c828]
mov eax, dword [eax + 4]
and esi, 0xf60
add edx, dword [0x49c81c]
xor eax, 0xb9b
sub ebx, dword [0x49c7e4]
or edi, eax
mov eax, dword [0x49c778]
add eax, dword [0x49c79c]
push ebp
push eax
push edx
push esi
push edi
push ebx
call fcn.00408669
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov ecx, dword [0x49c738]
imul ebx, dword [0x49c7e4]
sub ecx, eax
mov ebp, dword [0x49c804]
add ecx, 0x865
mov dword [esp + 0x44], ecx
mov eax, 0xb9b
sub eax, dword [0x49c778]
and ebp, 0x854
mov ecx, dword [esp + 0x28]
add edi, eax
mov eax, dword [esp + 0x2c]
or ebp, 0x1301
mov edx, dword [0x493c3c]
xor ecx, eax
mov eax, dword [esp + 0x28]
mov esi, dword [edx + 0x28]
sub eax, dword [edx + 0xe4]
add esi, ecx
push eax
push esi
push edi
push ebx
push ebp
push dword [esp + 0x58]
mov ebp, 0x49c720
push ebp
call fcn.0040493e
mov dword [esp + 0x54], eax
add esp, 0x34
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, dword [0x493c3c]
mov ecx, dword [esp + 0x3c]
imul edi, dword [0x49c80c]
xor esi, dword [eax + 0x118]
mov eax, dword [0x493c3c]
mov edx, dword [eax + 0x40]
mov eax, dword [0x49c7a8]
or edx, dword [0x49c798]
add eax, 0xb9b
add edx, dword [0x49c778]
or ecx, eax
mov eax, dword [0x49c82c]
and eax, 0x147f
push eax
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x28]
add ecx, 2
mov eax, dword [esp + 0x3c]
add eax, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
cmp ecx, eax
jg 0x41957b
push dword [0x49c820]
call dword [sym.imp.KERNEL32.dll_ExitProcess]