Function at 0x406e90
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4760
call fcn.00411cc0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x475c], eax
cmp dword [ebp - 0x475c], 1
je 0x406ee8
cmp dword [ebp - 0x475c], 2
je 0x407140
cmp dword [ebp - 0x475c], 3
je 0x40716a
cmp dword [ebp - 0x475c], 4
je 0x4075b2
cmp dword [ebp - 0x475c], 5
je 0x407171
jmp 0x407755
and dword [ebp - 0x201c], 0
push 6
push 1
push 2
call dword [0x41cd48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x406f0a
cmp dword [ebp - 4], 0xffffffff
jne 0x406f11
xor eax, eax
jmp 0x40775b
push 0x10
push 0
lea eax, [ebp - 0x2018]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x2018], 2
push 0x87
call dword [0x41cce8]
mov word [ebp - 0x2016], ax
push dword [ebp + 8]
call fcn.00406e11
pop ecx
mov dword [ebp - 0x2014], eax
push 0x10
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 4]
call dword [0x41cc98]
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0xffffffff
je 0x407118
push 0
push 0x48
push 0x416de4
push dword [ebp - 4]
call dword [0x41cd18]
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0xffffffff
jne 0x406fa8
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
push 0
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 4]
call dword [0x41ccf8]
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0xffffffff
jne 0x406fe2
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
movsx eax, byte [ebp - 0x2002]
cmp eax, 0xc
jne 0x407102
push 0
push 0x18
push 0x416e30
push dword [ebp - 4]
call dword [0x41cd18]
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0xffffffff
jne 0x407027
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
push 0
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 4]
call dword [0x41ccf8]
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x2008], 0xffffffff
jne 0x407061
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
movsx eax, byte [ebp - 0x2002]
cmp eax, 2
jne 0x4070ec
push 0x10
push 0x416e4c
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push eax
call fcn.00406e51
add esp, 0x10
movzx eax, al
test eax, eax
je 0x4070b4
cmp dword [ebp - 0x2008], 0x12c
jge 0x4070a8
mov dword [ebp - 0x201c], 1
jmp 0x4070b2
mov dword [ebp - 0x201c], 2
jmp 0x4070ea
push 0x10
push 0x416e60
push dword [ebp - 0x2008]
lea eax, [ebp - 0x2004]
push eax
call fcn.00406e51
add esp, 0x10
movzx eax, al
test eax, eax
je 0x4070e3
mov dword [ebp - 0x201c], 3
jmp 0x4070ea
and dword [ebp - 0x201c], 0
jmp 0x407100
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
jmp 0x407116
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
jmp 0x40712c
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
push dword [ebp - 4]
call dword [0x41cd60]
mov eax, dword [ebp - 0x201c]
jmp 0x40775b
push 3
push 0x1388
push dword [ebp + 8]
call dword [0x41cd14]
push eax
call fcn.004017d8
add esp, 0xc
test eax, eax
je 0x407165
push 3
pop eax
jmp 0x40775b
jmp 0x407759
xor eax, eax
jmp 0x40775b
and dword [ebp - 0x4640], 0
and dword [ebp - 0x2028], 0
push 6
push 1
push 2
call dword [0x41cd48]
mov dword [ebp - 0x2020], eax
cmp dword [ebp - 0x2020], 0xffffffff
je 0x4071a3
cmp dword [ebp - 0x2020], 0xffffffff
jne 0x4071aa
xor eax, eax
jmp 0x40775b
push 0x10
push 0
lea eax, [ebp - 0x423c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x423c], 2
push 0x8b
call dword [0x41cce8]
mov word [ebp - 0x423a], ax
push dword [ebp + 8]
call fcn.00406e11
pop ecx
mov dword [ebp - 0x4238], eax
push 0x10
lea eax, [ebp - 0x423c]
push eax
push dword [ebp - 0x2020]
call dword [0x41cc98]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
je 0x40747c
push 0
push 0x48
push 0x416e74
push dword [ebp - 0x2020]
call dword [0x41cd18]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x40724a
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push 0
push 0x2000
lea eax, [ebp - 0x4028]
push eax
push dword [ebp - 0x2020]
call dword [0x41ccf8]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x40728a
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push 0
push 0x33
push 0x416ec0
push dword [ebp - 0x2020]
call dword [0x41cd18]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x4072c5
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push 0
push 0x2000
lea eax, [ebp - 0x4028]
push eax
push dword [ebp - 0x2020]
call dword [0x41ccf8]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x407305
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push 0
push 0x4c
push 0x416ef4
push dword [ebp - 0x2020]
call dword [0x41cd18]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x407340
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push 0
push 0x2000
lea eax, [ebp - 0x4028]
push eax
push dword [ebp - 0x2020]
call dword [0x41ccf8]
mov dword [ebp - 0x402c], eax
cmp dword [ebp - 0x402c], 0xffffffff
jne 0x407380
push dword [ebp - 0x2020]
call dword [0x41cd60]
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
mov eax, dword [ebp - 0x402c]
mov dword [ebp - 0x2024], eax
and dword [ebp - 0x4644], 0
mov eax, dword [ebp - 0x2024]
dec eax
mov dword [ebp - 0x2024], eax
mov eax, dword [ebp - 0x2024]
dec eax
mov dword [ebp - 0x2024], eax
cmp dword [ebp - 0x2024], 0
jle 0x407470
cmp dword [ebp - 0x4644], 4
jge 0x407470
mov eax, dword [ebp - 0x2024]
movsx eax, byte [ebp + eax - 0x4028]
test eax, eax
jne 0x40746b
mov eax, dword [ebp - 0x4644]
mov dword [ebp - 0x4760], eax
cmp dword [ebp - 0x4760], 0
je 0x407406
cmp dword [ebp - 0x4760], 1
je 0x407424
cmp dword [ebp - 0x4760], 2
je 0x407442
jmp 0x40745e
mov eax, dword [ebp - 0x2024]
lea eax, [ebp + eax - 0x4027]
push eax
lea eax, [ebp - 0x422c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x40745e
mov eax, dword [ebp - 0x2024]
lea eax, [ebp + eax - 0x4027]
push eax
lea eax, [ebp - 0x463c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x40745e
mov eax, dword [ebp - 0x2024]
lea eax, [ebp + eax - 0x4027]
push eax
lea eax, [ebp - 0x443c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp - 0x4644]
inc eax
mov dword [ebp - 0x4644], eax
jmp 0x4073a0
mov dword [ebp - 0x2028], 1
jmp 0x407487
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
push dword [ebp - 0x2020]
call dword [0x41cd60]
cmp dword [ebp - 0x2028], 0
je 0x4075a7
lea eax, [ebp - 0x463c]
push eax
push str.Windows_Server_2003_.
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x4074fd
lea eax, [ebp - 0x443c]
push eax
push str.Service_Pack_1
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x4074d6
push 5
pop eax
jmp 0x40775b
lea eax, [ebp - 0x443c]
push eax
push str.Service_Pack_2
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x4074f5
push 6
pop eax
jmp 0x40775b
push 4
pop eax
jmp 0x40775b
lea eax, [ebp - 0x463c]
push eax
push str.NT_LAN_Manager_.
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x40751c
push 1
pop eax
jmp 0x40775b
lea eax, [ebp - 0x463c]
push eax
push 0x416f98
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x407552
lea eax, [ebp - 0x443c]
push eax
push str.Windows_5.0
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x407552
push 2
pop eax
jmp 0x40775b
lea eax, [ebp - 0x463c]
push eax
push str.Windows_2000_LAN_Manager
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x407588
lea eax, [ebp - 0x443c]
push eax
push str.Windows_5.1
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x407588
push 3
pop eax
jmp 0x40775b
lea eax, [ebp - 0x463c]
push eax
push str.Samba_
call fcn.00410a08
pop ecx
pop ecx
test eax, eax
je 0x4075a7
push 7
pop eax
jmp 0x40775b
mov eax, dword [ebp - 0x4640]
jmp 0x40775b
and dword [ebp - 0x4750], 0
push dword [ebp + 8]
push str._s_
push 0x104
lea eax, [ebp - 0x4748]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
push 0x104
push str.pipeepmapper
lea eax, [ebp - 0x4748]
push eax
call dword [sym.imp.MSVCRT.dll_strncat]
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x4748]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x474c], eax
cmp dword [ebp - 0x474c], 0xffffffff
je 0x40774d
push 0x186a0
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x4758], eax
push 0x186a0
push 0
push dword [ebp - 0x4758]
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
lea eax, [ebp - 0x4754]
push eax
push 0x2710
push dword [ebp - 0x4758]
push 0x48
push 0x416de4
push dword [ebp - 0x474c]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [ebp - 0x4758]
movsx eax, byte [eax + 2]
cmp eax, 0xc
jne 0x407734
push 0
lea eax, [ebp - 0x4754]
push eax
push 0x2710
push dword [ebp - 0x4758]
push 0x18
push 0x416e30
push dword [ebp - 0x474c]
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov eax, dword [ebp - 0x4758]
movsx eax, byte [eax + 2]
cmp eax, 2
jne 0x407734
push 0x10
push 0x416e4c
push dword [ebp - 0x4754]
push dword [ebp - 0x4758]
call fcn.00406e51
add esp, 0x10
movzx eax, al
test eax, eax
je 0x4076ff
cmp dword [ebp - 0x4754], 0x12c
jae 0x4076f3
mov dword [ebp - 0x4750], 1
jmp 0x4076fd
mov dword [ebp - 0x4750], 2
jmp 0x407734
push 0x10
push 0x416e60
push dword [ebp - 0x4754]
push dword [ebp - 0x4758]
call fcn.00406e51
add esp, 0x10
movzx eax, al
test eax, eax
je 0x40772d
mov dword [ebp - 0x4750], 3
jmp 0x407734
and dword [ebp - 0x4750], 0
push dword [ebp - 0x4758]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp - 0x474c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4750]
jmp 0x40775b
xor eax, eax
jmp 0x40775b
xor eax, eax
leave
ret