Function at 0x405a20
Capabilities:
Connect pipe
Create pipe
Create process on windows
Read file on windows
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407766
mov eax, dword fs:[0]
push eax
sub esp, 0xc94
mov eax, dword [0x40c014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x800
lea eax, [ebp - 0xa18]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x218]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xa1a], ax
test ax, ax
jne 0x405ac4
lea edi, [ebp - 0xa18]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x405ae5
mov ecx, 0xc
lea eax, [ebp - 0xc7c]
mov esi, str.kugou.exe___perload_dll
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0
push eax
movsw word es:[edi], word [esi]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xc80], 0x44
xor eax, eax
mov dword [ebp - 0xc90], 0
mov dword [ebp - 0xc8c], eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xc84], eax
lea eax, [ebp - 0xc90]
push eax
lea eax, [ebp - 0xc80]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xa18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x405b7e
call edi
push eax
push str.Create_Perload_Process_Error:__d
push ebx
call fcn.00402040
add esp, 0xc
cmp dword [ebx + 0x24c], 0
jne 0x405b93
mov ecx, ebx
call fcn.004059b0
jmp 0x405de4
xor eax, eax
lea ecx, [ebp - 0xc90]
mov dword [ebp - 0xc90], eax
mov dword [ebp - 0xc8c], eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xc84], eax
call fcn.00404710
cmp dword [ebp - 0xc84], 0
mov dword [ebp - 4], 0
jne 0x405bdb
push str.SecurityAttributes_Create_Fail
push ebx
call fcn.00402040
add esp, 8
jmp 0x405de4
mov dword [ebp - 0xc94], 0
jmp 0x405bf0
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0xca0]
push eax
push 0
push 0xa00
push 0xa00
push 1
push 0
push 3
push str..pipeKuGouServicePipe
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405dc7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x405d99
push 0xa00
lea eax, [ebp - 0xc18]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc1c]
push 0
push eax
push 0xa00
lea eax, [ebp - 0xc18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405d8f
push dword [ebp - 0xc14]
push dword [ebp - 0xc18]
push str.ReadFile:_Type_d__Version_d
push ebx
call fcn.00402040
mov eax, dword [ebp - 0xc18]
add esp, 0x10
cmp eax, 0x64
jne 0x405cc2
mov dword [ebp - 0xc94], 1
jmp 0x405daa
cmp eax, 0xc8
jne 0x405daa
cmp dword [ebp - 0xc14], 2
mov dword [ebp - 0xc20], 0
je 0x405cfe
push 0
lea eax, [ebp - 0xc1c]
push eax
push 4
lea eax, [ebp - 0xc20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x405daa
push dword [ebp - 0xc10]
xor eax, eax
mov dword [ebp - 0xc28], 7
mov word [ebp - 0xc3c], ax
lea ecx, [ebp - 0xc3c]
lea eax, [ebp - 0xc0c]
mov dword [ebp - 0xc2c], 0
push eax
call fcn.00406190
push dword [ebp - 0x40b]
cmp dword [ebp - 0xc28], 8
lea eax, [ebp - 0xc3c]
push dword [ebp - 0x40c]
cmovae eax, dword [ebp - 0xc3c]
mov ecx, ebx
push eax
mov byte [ebp - 4], 1
call fcn.00404ab0
push 0
mov dword [ebp - 0xc24], eax
lea eax, [ebp - 0xc1c]
push eax
push 4
lea eax, [ebp - 0xc24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 0
call fcn.004047f0
jmp 0x405daa
call edi
push eax
push str.ReadFile_Error:__d
jmp 0x405da1
call edi
push eax
push str.ConnectNamedPipe_Error:__d
push ebx
call fcn.00402040
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc94], 0
je 0x405bf0
jmp 0x405dd8
call edi
push eax
push str.CreateNamedPipe_Error:__d
push ebx
call fcn.00402040
add esp, 0xc
push dword [ebp - 0xc84]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004068e1
mov esp, ebp
pop ebp
ret