Function at 0x405748
Capabilities:
Create pipe
Encode data using xor
Resolve function by parsing pe exports
Write file on windows
Write pipe

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x30]
add eax, 0xffffff57
push ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x2c]
push esi
push edi
lea edi, [ebp + 0x1e]
lea edx, [eax - 0x9a2]
lea esi, [eax - 0x10]
mov dword [esp + 0x34], edx
mov eax, ebp
mov dword [esp + 0xc], esi
xor eax, 0xae2
mov dword [esp + 0x3c], eax
add eax, 0xfffffc46
cmp edi, eax
je 0x405ee8
mov eax, edi
xor eax, 0xac0
push ebx
cmp esi, eax
jl 0x405ada
mov edx, dword [esp + 0x44]
xor ebx, ebx
push 4
pop ecx
xor edi, edi
mov dword [edx + 8], 0x14
inc edi
mov dword [0x572664], ecx
mov dword [edx + 0x1c], 0x12
mov eax, dword [0x566634]
mov dword [eax + 0x20], ebx
mov dword [edx + 0x34], edi
mov dword [edx + 0x44], 3
mov dword [edx + 0x48], edi
mov eax, dword [0x566634]
mov dword [eax + 0x5c], ebx
mov dword [0x5726c0], ecx
mov dword [0x5726c8], edi
mov dword [edx + 0x78], ebx
mov dword [edx + 0x7c], edi
mov eax, dword [0x566634]
mov dword [eax + 0x90], edi
mov dword [edx + 0x98], 0x3c
mov dword [edx + 0xa0], ebx
mov eax, dword [0x566634]
mov dword [eax + 0xac], 0x48
mov dword [edx + 0xc4], ebx
mov dword [edx + 0xd8], edi
mov eax, dword [0x566634]
mov dword [eax + 0xdc], 0x37
mov eax, dword [0x566634]
mov dword [eax + 0xe0], ebx
mov dword [edx + 0xe8], ebx
mov dword [0x57274c], edi
mov dword [edx + 0xfc], ebx
mov dword [edx + 0x108], 0x18
mov eax, dword [0x566634]
mov dword [0x572764], ebx
mov dword [eax + 0x110], 0x30
mov eax, dword [0x566634]
mov dword [eax + 0x114], 0x1d
mov dword [edx + 0x118], edi
mov dword [edx + 0x120], ebx
mov dword [edx + 0x124], edi
mov eax, dword [0x566634]
mov eax, dword [eax + 0x90]
add eax, 0x6121
add dword [edx + 0x68], eax
mov eax, dword [0x566634]
mov eax, dword [eax + 0x70]
cmp eax, dword [edx + 0x90]
jne 0x4058ca
mov eax, dword [edx + 0x114]
xor eax, dword [edx + 0xf4]
add eax, 0x146d6a
add dword [edx + 0xe8], eax
mov eax, dword [edx + 8]
lea edi, [esi - 0xdbf]
add eax, 0x18c92b
xor edi, 0xef7
or dword [edx + 0x7c], eax
mov eax, dword [0x566634]
mov ecx, dword [eax + 0xd8]
mov eax, dword [0x572664]
add eax, 0xfb701
add eax, ecx
mov dword [0x572664], eax
mov eax, dword [edx + 0x34]
add eax, 0x13ffc9
add eax, dword [edx + 0x78]
mov dword [0x57269c], eax
mov eax, dword [edx + 0x98]
add eax, 0x1388a3
mov dword [edx + 0x124], eax
cmp dword [edx + 0xd8], 0x19d8
je 0x405941
mov ecx, dword [0x566634]
mov eax, 0xffe6f1b3
sub eax, dword [0x572764]
add dword [ecx + 0x98], eax
mov eax, dword [edx + 0xf4]
mov ecx, 0x3c239
add eax, 0x4c
mov dword [0x572748], eax
mov eax, dword [0x566634]
sub ecx, dword [eax + 0x34]
sub ecx, dword [0x57277c]
mov eax, dword [edx + 0x120]
add dword [edx + 0x68], ecx
add eax, 0x10fd33
add dword [edx + 0xf4], 0xffe6b3e7
mov dword [edx + 0x5c], eax
mov eax, dword [0x566634]
mov ecx, dword [edx + 0xc]
cmp ecx, dword [eax + 0x120]
je 0x405999
add dword [edx + 0xf0], 0xab
jmp 0x4059a8
mov eax, dword [edx + 0x70]
sub eax, dword [edx + 0x108]
add dword [edx + 0x110], eax
mov eax, dword [edx + 0x108]
cmp eax, dword [edx + 0x48]
jb 0x4059c3
mov eax, dword [edx + 0xe8]
sub eax, 0xb84c7
mov dword [0x572760], eax
mov eax, dword [edx + 0x44]
cmp eax, dword [0x57271c]
je 0x4059de
mov eax, dword [0x572734]
xor eax, 0x160c54
add dword [edx + 0x118], eax
mov eax, dword [0x566634]
cmp dword [eax + 0xe0], 0x15ac9
jae 0x405a00
mov eax, dword [edx + 0x118]
xor eax, 0x1d2176
mov dword [edx + 0xe8], eax
mov eax, dword [edx + 0xc4]
add eax, 0x825
add dword [edx + 0xf0], eax
mov ecx, dword [0x566634]
mov eax, dword [ecx + 0xa0]
cmp eax, dword [edx + 0x20]
jne 0x405a3c
mov eax, dword [ecx + 0x7c]
add eax, dword [edx + 0x110]
xor eax, 0x18c59d
sub dword [edx + 0xf0], eax
mov ecx, dword [0x566634]
mov eax, 0x3d7
sub eax, dword [edx + 0x48]
add dword [0x572748], eax
mov eax, dword [edx + 0x114]
cmp eax, dword [0x572664]
jae 0x405a71
mov eax, dword [edx + 0x90]
add eax, dword [edx + 0x98]
xor eax, 0xcffc789a
mov dword [edx], eax
mov ecx, dword [0x566634]
mov eax, dword [ecx + 0x90]
lea esi, [edi - 0x996]
cmp eax, dword [0x572778]
jbe 0x405a94
mov dword [edx + 4], 0x3b17b172
mov ecx, dword [0x566634]
jmp 0x405a9d
mov eax, dword [ecx + 8]
sub dword [0x572660], eax
mov eax, dword [edx + 0x68]
xor esi, 0x15
cmp eax, dword [edx + 0x120]
je 0x405ac5
mov eax, dword [ecx + 0x98]
sub eax, dword [edx + 0x10c]
add eax, 0x1919c7
mov dword [edx + 0x50], eax
mov ecx, dword [0x566634]
mov eax, dword [ecx + 0x110]
add eax, 0x40884338
mov dword [0x5726ac], eax
jmp 0x405ee7
mov ebx, dword [esp + 0x44]
mov ecx, dword [ebx + 0x68]
lea eax, [ecx + ebp]
cmp ecx, eax
jbe 0x405ebf
mov eax, dword [ebx + 0x120]
imul eax, dword [ebx + 0x10c]
mov dword [esp + 0x14], ebp
cmp ebp, eax
jae 0x405da0
mov eax, dword [esp + 0x48]
mov ecx, eax
xor ecx, 0x222b
mov dword [esp + 0x28], 0x1eac
mov dword [esp + 0x30], ecx
jmp 0x405b23
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], ebp
cmp ebp, ecx
jne 0x405d85
mov ecx, eax
or ecx, 0x105c
mov dword [esp + 0x1c], ecx
mov ecx, eax
or ecx, 0x1198
add eax, 0xffffddd5
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [0x566634]
push 0x327c
push 0x3a9a
push 0x2dfd
mov eax, dword [ecx + 0xfc]
sub eax, edx
sub eax, dword [esp + 0x54]
add edi, eax
mov eax, dword [ecx + 0x68]
and eax, esi
or dword [ebx + 0x48], eax
mov eax, dword [esp + 0x4c]
imul eax, ebp
push 0x147f
push 0x1c16
push 0xd6
push 0x242c
add edx, eax
mov dword [esp + 0x54], edx
call fcn.00411cd4
mov ecx, dword [esp + 0x54]
add esp, 0x1c
mov edx, dword [esp + 0x48]
mov dword [0x5731f8], eax
mov eax, dword [0x572764]
add eax, ecx
or ecx, 0x20f1
or eax, ebp
push eax
mov eax, dword [esp + 0x44]
sub eax, esi
imul eax, eax, 0x17b0
push eax
mov eax, edx
and eax, dword [ebx + 0x34]
xor eax, 0x1110
push eax
mov eax, dword [0x572778]
push edx
push ecx
push dword [esp + 0x30]
and eax, ebp
push dword [esp + 0x38]
sub eax, dword [ebx + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebx + 0xc4]
or eax, 0x1110
push eax
push dword [esp + 0x28]
mov eax, edi
or eax, esi
mov esi, dword [esp + 0x48]
and eax, dword [0x5726d4]
push eax
mov eax, dword [ebx + 0x110]
add eax, dword [ebx + 0x118]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x566634]
mov eax, dword [esp + 0x48]
sub eax, dword [ebx + 0x118]
or eax, esi
sub dword [ecx + 0x9c], eax
mov eax, edi
and eax, dword [ebx + 0x10c]
imul eax, esi
add dword [0x5726b8], eax
mov eax, dword [0x572714]
or eax, dword [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [ebx + 0xa0]
mov ecx, dword [0x566634]
imul eax, edi
or eax, dword [esp + 0x28]
or dword [ecx + 0x40], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x566634]
mov eax, dword [ecx + 0x110]
and eax, ebp
mov edx, dword [esp + 0x38]
xor eax, 0x144e
mov dword [esp + 0x2c], eax
xor eax, dword [esp + 0x48]
xor eax, 0x1cd3
imul eax, dword [ecx + 0xf4]
mov dword [ecx + 0xf4], eax
mov eax, dword [ebx + 0x104]
sub eax, dword [esp + 0x10]
and eax, dword [ebx + 0x98]
mov edi, dword [ebx + 0xa8]
mov ecx, dword [ebx + 8]
mov esi, dword [ebx + 0x1c]
xor ecx, 0x1198
sub edx, dword [ebx + 0x9c]
and edx, dword [esp + 0x38]
xor esi, dword [esp + 0x10]
push eax
push ebx
lea eax, [ebp + 0x17b0]
imul edi, ebp
push eax
push ecx
push edx
xor esi, 0x1198
and edi, dword [esp + 0x3c]
push esi
push edi
call fcn.004052c2
mov edx, dword [0x5726bc]
mov ecx, eax
mov eax, dword [0x566634]
mov esi, dword [0x5726c0]
mov edi, dword [ebx + 0xe0]
add esi, 0x1cd3
xor edi, dword [esp + 0x64]
sub edx, dword [eax + 0xf8]
mov eax, dword [ebx + 0x98]
sub edx, ecx
xor eax, dword [ebx + 0x34]
mov dword [esp + 0x2c], ecx
mov ecx, dword [0x572734]
sub ecx, dword [esp + 0x5c]
push eax
push ecx
push edx
push esi
push ebx
push edi
call fcn.004128ba
mov ecx, dword [ebx + 0xbc]
add esp, 0x34
mov edi, dword [esp + 0x2c]
mov ebp, eax
imul ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
add eax, 3
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
cmp eax, ecx
je 0x405b50
mov eax, dword [ebx + 0x120]
imul eax, dword [ebx + 0x10c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jb 0x405b1f
mov eax, edi
or eax, dword [esp + 0x48]
and eax, 0x20f1
cmp ebp, eax
jle 0x405eab
mov eax, dword [esp + 0x40]
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, ebp
or eax, 0x11d6
push eax
mov eax, dword [esp + 0x44]
sub eax, edi
push eax
mov eax, dword [ebx + 0x10c]
imul eax, ebp
sub eax, 0x146c
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [ebx + 0xe0]
sub eax, dword [ebx + 0x9c]
add eax, dword [ebx + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x40]
add eax, 0xffffdf0f
push eax
mov eax, dword [0x566634]
mov eax, dword [eax + 0x2c]
or eax, dword [esp + 0x4c]
add eax, esi
push eax
mov eax, edi
xor eax, ebp
push eax
mov eax, esi
imul eax, ebp
push eax
mov eax, ebp
and eax, 0x20f1
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebx + 8]
sub eax, esi
imul edi, ebp
push eax
mov eax, dword [ebx + 0x48]
imul eax, dword [0x572784]
push esi
imul eax, eax, 0x20f1
push eax
mov eax, dword [0x566634]
push edi
mov eax, dword [eax + 0x38]
imul eax, dword [0x572670]
and eax, dword [0x572770]
push eax
mov eax, dword [ebx + 0x68]
xor eax, 0x144e
push eax
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebp, dword [esp + 0x38]
mov eax, esi
or eax, ebp
or eax, 0x146c
push eax
mov eax, dword [esp + 0x44]
and eax, dword [esp + 0x4c]
or eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebx + 0x8c]
sub eax, dword [ebx + 0x58]
add eax, ebp
imul eax, esi
or eax, dword [esp + 0x40]
add dword [ebx + 0xf4], eax
jmp 0x405ee7
imul eax, dword [ebx + 0xfc], 0x146c
sub edx, eax
add dword [ebx + 0xc0], edx
jmp 0x405ee7
mov eax, dword [ebx + 0x10c]
or eax, dword [ebx + 0x1c]
or eax, edx
cmp dword [ebx + 0xf8], eax
jne 0x405ee7
mov eax, dword [0x566634]
mov eax, dword [eax + 0x48]
and eax, dword [0x572788]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
lea eax, [esi + 0x6a0]
pop esi
pop ebp
add esp, 0x24
ret