Function at 0x64e8c8
Capabilities:
Check os version
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406d68
xor eax, eax
push ebp
push 0x64ebce
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
cmp dword [ebp - 4], 0
je 0x64eba8
cmp byte [ebp + 0x14], 0
je 0x64e922
cmp dword [ebp + 0x10], 0
jne 0x64e932
cmp dword [ebp + 0xc], 0
jne 0x64e932
cmp dword [ebp + 8], 0
je 0x64eba8
jmp 0x64e932
cmp dword [ebp - 8], 0
jne 0x64e932
cmp dword [ebp - 0xc], 0
je 0x64eba8
cmp byte [ebp + 0x14], 0
je 0x64e94a
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x64ebec
call fcn.00407264
jmp 0x64e95a
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x64ec24
call fcn.00407264
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x28]
call fcn.00406e0c
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x64e98e
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x64eba8
mov dword [ebp - 0x48], 0xc
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
call sub.kernel32.dll_GetVersion_1
cmp al, 5
ja 0x64e9b9
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x64e9f2
push 0
lea eax, [ebp - 0x44]
push eax
push 1
push 0x64ec4c
call sub.advapi32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
jne 0x64e9dd
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x64eba8
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x44]
push eax
call sub.advapi32.dll_GetSecurityDescriptorSacl
push 0x224
call fcn.004093c0
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0x200
call fcn.00403b8c
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.0040700c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x64ea33
mov eax, dword [ebp - 0x34]
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
call fcn.004068c4
mov ecx, dword [ebp - 0x34]
add ecx, ecx
mov edx, dword [ebp - 0x24]
call fcn.0040331c
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 8]
mov dword [eax + 0x204], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x208], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x20c], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 0xc]
mov dword [eax + 0x210], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
mov dword [eax + 0x214], edx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x218], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [eax + 0x21c], edx
cmp byte [ebp + 0x14], 1
cmc
sbb eax, eax
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x220], eax
cmp byte [ebp + 0x14], 0
je 0x64eaba
mov dword [ebp - 0x30], 0x10000
jmp 0x64eac1
mov dword [ebp - 0x30], 0x1000
lea eax, [ebp - 0x48]
push eax
push 0
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 1
push 6
push 0x40003
mov eax, dword [ebp - 0x28]
call fcn.00406e0c
push eax
call sub.kernel32.dll_CreateNamedPipeW
mov edx, dword [ebp - 0x24]
mov dword [edx + 0x200], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x200], 0xffffffff
jne 0x64eb09
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_LocalFree
jmp 0x64eba8
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push 0
push 4
push 6
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x200]
push eax
call sub.advapi32.dll_SetSecurityInfo
mov eax, dword [ebp - 0x44]
push eax
call sub.kernel32.dll_LocalFree
cmp byte [ebp + 0x14], 0
je 0x64eb46
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x64e788]
call fcn.0064fa48
jmp 0x64eb55
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x64e71c]
call fcn.0064f2c4
mov eax, dword [0x76aa3c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx]
xor eax, eax
push ebp
push 0x64eb9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x24]
mov eax, dword [0x76aa38]
call fcn.004932b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64eba4
mov eax, dword [0x76aa3c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax]
call dword [edx + 4]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64ebd5
lea eax, [ebp - 0x2c]
call fcn.004066c4
lea eax, [ebp - 0x28]
call fcn.00406d70
lea eax, [ebp - 4]
call fcn.00406d70
ret