Function at 0x42b600
Capabilities:
Connect pipe
Read file on windows
Terminate process
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57dfe8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5e108c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x34], ebx
push 0x32
push dword [ebx + 0x140dc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ba7d
lea ecx, [ebx + 0x140c8]
mov dword [ebp - 0x3c], ecx
nop
push 0xffffffffffffffff
push 0
push ecx
push 5
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
cmp ebx, 4
ja 0x42ba7d
mov edi, dword [ebp - 0x34]
imul esi, ebx, 0x4028
add esi, edi
cmp dword [esi + 0x4024], 0
je 0x42b6f0
push 0
lea eax, [ebp - 0x14]
push eax
push esi
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [esi + 0x4020]
sub ecx, 0
je 0x42b6de
sub ecx, 1
je 0x42b6c1
sub ecx, 1
jne 0x42ba7d
test eax, eax
je 0x42b6b4
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x401c]
je 0x42b6e6
push ebx
mov ecx, edi
call fcn.0042bd10
jmp 0x42b9ae
test eax, eax
je 0x42b6b4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x42b6b4
mov dword [esi + 0x2018], eax
mov dword [esi + 0x4020], 2
jmp 0x42b6f0
test eax, eax
je 0x42ba7d
mov dword [esi + 0x4020], 1
mov eax, dword [esi + 0x4020]
sub eax, 1
je 0x42b900
sub eax, 1
jne 0x42ba7d
sub esp, 0x18
lea edi, [esi + 0x18]
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], eax
mov word [edx], ax
cmp word [edi], ax
jne 0x42b726
xor ecx, ecx
jmp 0x42b740
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42b730
sub ecx, dword [ebp - 0x38]
sar ecx, 1
push ecx
push edi
mov ecx, edx
call fcn.0040bc40
call fcn.0042c0c0
xor ecx, ecx
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x2c]
test al, al
je 0x42b778
push 9
push 0x5c1624
jmp 0x42b77f
push 8
push str.inperiod
call fcn.0040bc40
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
lea edi, [esi + 0x201c]
push eax
push 0x1000
push edi
call fcn.0050fac1
mov ecx, dword [ebp - 0x34]
add esp, 0x10
imul eax, ebx, 0x100a
xor edx, edx
push edi
add eax, dword [ebp - 0x1c]
mov word [ecx + eax*4 + 0x201c], dx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
lea ecx, [ebp - 0x14]
push ecx
lea eax, [eax*2 + 2]
push eax
push edi
push dword [esi + 0x14]
mov dword [esi + 0x401c], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x42b847
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [esi + 0x401c]
jne 0x42b847
cmp byte [ebp - 0x2d], 0
mov dword [esi + 0x4024], 0
mov dword [esi + 0x4020], 1
jne 0x42b9cf
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebp - 0x34]
push ebx
call fcn.0042bd10
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x42b9ae
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.0040ca40
jmp 0x42b9ae
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test edi, edi
jne 0x42b889
cmp eax, 0x3e5
jne 0x42b889
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x4024], 1
cmp eax, 8
jb 0x42b9ae
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.0040ca40
jmp 0x42b9ae
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
push dword [esi + 0x14]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x42b8c6
call ebx
cmp eax, 0x217
je 0x42b8b9
cmp eax, 0x3e5
jne 0x42b8c6
mov edi, 1
jmp 0x42b8c8
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x42b8c8
xor edi, edi
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test edi, edi
mov dword [esi + 0x4024], edi
sete al
mov dword [esi + 0x4020], eax
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x42b9ae
inc eax
lea ecx, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
call fcn.0040ca40
jmp 0x42b9ae
push esi
lea edi, [esi + 0x2018]
push edi
push 0x2000
lea eax, [esi + 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test ebx, ebx
je 0x42b93b
cmp dword [edi], 0
je 0x42b93b
mov dword [esi + 0x4024], 0
mov dword [esi + 0x4020], 2
jmp 0x42b9ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
jne 0x42b958
cmp eax, 0x3e5
jne 0x42b958
mov dword [esi + 0x4024], 1
jmp 0x42b9ae
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push esi
push dword [esi + 0x14]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x42b999
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x42b98c
cmp eax, 0x3e5
jne 0x42b999
mov edi, 1
jmp 0x42b99b
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x42b99b
xor edi, edi
xor eax, eax
mov dword [esi + 0x4024], edi
test edi, edi
sete al
mov dword [esi + 0x4020], eax
mov eax, dword [ebp - 0x34]
push 0x32
push dword [eax + 0x140dc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42ba7d
mov ecx, dword [ebp - 0x3c]
jmp 0x42b650
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ba40
mov ebx, dword [ebp - 0x34]
mov ecx, ebx
call fcn.0042baa0
cmp dword [ebx + 0x14110], 0
je 0x42ba55
push str..killprocess_mailslot
lea ecx, [ebp - 0x2c]
call fcn.0040bb40
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
push eax
mov eax, dword [ebx + 0x14110]
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040bb00
push str..closeByNext
lea ecx, [ebp - 0x54]
call fcn.0040bb40
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 2
push eax
mov eax, dword [ebx + 0x14110]
call eax
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0040bb00
mov eax, dword [ebx + 0x14114]
test eax, eax
je 0x42ba69
push 0x1388
call eax
add esp, 4
mov eax, dword [ebx + 0x14118]
test eax, eax
je 0x42ba75
call eax
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f4655
mov esp, ebp
pop ebp
ret