Function at 0x1000e310
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
sub esp, 0x18
mov ecx, dword [esp + 0x30]
lea eax, [edx - 0x19ad]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
lea ebp, [ecx - 0x1292]
mov dword [esp + 0xc], eax
add ecx, 0x7bb
mov dword [esp + 0x18], ebp
push edi
mov edi, dword [esp + 0x34]
lea eax, [edx - 0x71b]
add edi, 0xffffec65
mov dword [esp + 0x34], eax
lea eax, [ecx - 0x93b]
mov dword [esp + 0x40], edi
mov edx, edi
mov dword [esp + 0x14], ecx
lea esi, [ebx + 0x7bb]
mov dword [esp + 0x18], esi
cmp edx, eax
je 0x1000e6c6
mov esi, dword [esp + 0x30]
mov ecx, 0x1550
push str._hkqfrmZtajkulhuem__J_mxdrafastwZlZulng__Jgbhp_pe_mnrqoerkgls_fYofvv_tgs_ecnn_Y_acji
push 0xb9
push 0xb2
mov eax, dword [esi + 0x24]
mov edx, esi
mov eax, dword [eax + 0x1c4]
sub eax, 0x1196
push eax
push 0x1d40
push 0x11d7
call fcn.1000c0b0
mov dword [esi + 0xe8], eax
mov ecx, 0x1a46
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0xf8]
push 0x1004a3b8
mov dword [esi + 0x50], 0x1bdf
push 0x79
mov eax, dword [eax + 0x64]
xor eax, 0x19ae
push 0xd2
push eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x64]
xor eax, 0x362d
push eax
push 0x13fc
call fcn.1000c0b0
mov dword [esi + 0xe8], eax
mov ecx, 0x1292
mov eax, dword [esi + 0x19c]
add esp, 0x30
mov eax, dword [eax + 0x40]
xor eax, 0x1c409
mov dword [esi + 0x34], eax
mov dword [esi + 0x90], eax
mov edx, dword [esi + 0x19c]
mov eax, dword [edx + 0x40]
sub eax, 0x4ba
cmp eax, ecx
jbe 0x1000e443
imul edi, dword [esi + 0x2c], 0x1784
nop
mov dword [esi + 0xfc], edi
inc ecx
mov eax, dword [edx + 0x40]
sub eax, 0x4ba
cmp ecx, eax
jb 0x1000e430
mov edx, esi
mov ecx, 0x119a
call fcn.100095f0
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x19c]
imul eax, dword [eax + 0x64], 0x1cf01213
cmp eax, 0x1550
je 0x1000e46f
lea eax, [esi + 0x194]
xor dword [esi + 0x50], eax
mov dword [esi + 0xec], 0
mov ecx, 0xffffeb05
mov eax, dword [esi + 0x19c]
sub ecx, dword [eax + 0xfc]
imul eax, dword [esi + 0xc8], 0x174d
add dword [esi + 0x118], ecx
xor dword [esi + 0x30], eax
xor edi, edi
nop
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0xec]
mov eax, dword [esi + 4]
mov cl, byte [ecx + edi]
xor cl, byte [edx + eax]
xor edx, edx
mov eax, dword [esi + 0x28]
mov byte [edi + eax], cl
inc edi
mov eax, dword [esi + 0x19c]
imul eax, dword [eax + 0x198], 0xfc01ee3
add eax, dword [esi + 0xec]
div dword [esi + 0xc]
mov dword [esi + 0xec], edx
mov ecx, dword [esi]
mov eax, dword [esi + 0x50]
xor eax, 0x1a4d
sub dword [ecx + 0x118], eax
mov eax, dword [esi + 0x38]
add eax, 0x19ad
mov dword [esi + 0xfc], eax
cmp edi, 0x1d344
jl 0x1000e4a0
mov edi, dword [esp + 0x40]
mov eax, dword [esi + 0x18]
add edi, 0x132f
mov dword [esp + 0x18], eax
mov dword [esi + 0x90], eax
test eax, eax
je 0x1000e564
mov ecx, dword [esi]
mov eax, dword [esi + 0x19c]
sub eax, 0x16cb
or dword [ecx + 0x50], eax
mov ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x19c]
add eax, 0x38
or dword [ecx + 0xc8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, eax
mov eax, dword [esi + 0x13c]
add eax, 0x13a4
mov dword [esi + 0x50], eax
test ecx, ecx
je 0x1000e564
push dword [esp + 0x18]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
imul eax, dword [esi + 0x98], 0x14e4
lea edx, [esi + 0x94]
or dword [esi + 0x50], edx
xor dword [esi + 0x10], eax
mov dword [esi + 0x90], 0x4187c
mov eax, dword [esi + 0x19c]
mov ecx, dword [eax + 0x64]
xor ecx, 0xc3d
cmp ecx, 0x1592
jg 0x1000e5bb
imul eax, dword [esi], 0x1590
mov dword [esp + 0x18], eax
mov eax, 0x1593
sub eax, ecx
nop dword [eax]
sub eax, 1
jne 0x1000e5b0
mov eax, dword [esp + 0x18]
mov dword [edx], eax
mov edx, esi
mov ecx, 0x19ad
call fcn.100095f0
mov dword [esi + 0x1d8], eax
lea ecx, [esi + 0x7c]
mov eax, dword [esi + 0x2c]
mov edx, esi
or dword [esi + 0x98], eax
dec eax
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x30]
imul eax, ecx
mov ecx, 0x119a
mov dword [esi + 0x30], eax
call fcn.100095f0
mov dword [esi + 0x1dc], eax
mov edx, 0x1197
lea eax, [esi + 0x78]
add dword [esi + 0x30], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax + 0x64]
sub eax, 0x816
cmp eax, edx
jbe 0x1000e644
mov ebx, dword [esi + 0x19c]
mov ecx, dword [esi + 0x10]
mov ebp, dword [esi + 0xf8]
add ecx, 0x1648
inc edx
add ecx, ebx
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 0x64]
sub eax, 0x816
cmp edx, eax
jb 0x1000e624
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
mov edx, esi
mov ecx, 0x190f
mov eax, dword [eax + 0x64]
xor eax, 0x11fb2
mov dword [esi + 0x90], eax
call fcn.100095f0
mov dword [esi + 0x1e0], eax
mov eax, dword [esi + 0x58]
mov eax, dword [eax + 0x64]
xor eax, 0xcc2
cmp dword [esi + 0x7c], eax
ja 0x1000e680
imul eax, dword [esi + 0x2c], 0x137
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x24]
mov eax, dword [eax + 0x64]
add eax, 0x1e0a6
mov dword [esi + 0x90], eax
cmp dword [esi + 0x98], 0x132f
jb 0x1000e6ab
mov eax, dword [esi + 0x30]
xor eax, dword [esi + 0x50]
xor eax, 0x1869
mov dword [esi + 0x30], eax
mov edx, esi
mov ecx, 0x1a46
call fcn.100095f0
mov edx, dword [esp + 0x40]
mov dword [esi + 0x1e4], eax
jmp 0x1000e88a
mov eax, edi
xor eax, esi
mov esi, dword [esp + 0x30]
and eax, 0x1590
cmp ebx, eax
jle 0x1000e84e
mov eax, dword [esi + 0xc8]
add eax, ecx
or eax, ebp
cmp ebx, eax
je 0x1000e840
mov ecx, dword [esi + 0x170]
xor ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x40]
mov eax, dword [esi + 0xd8]
xor eax, dword [esi + 0xf8]
or dword [esi + 0x58], eax
mov eax, dword [esi + 0x118]
push ecx
mov edi, dword [esi + 0x154]
xor eax, ebp
add edi, dword [esi + 0x194]
push esi
push eax
and edi, dword [esi + 0x58]
lea eax, [ebx + 0x7bb]
mov edx, dword [esi + 0x98]
xor eax, 0x139b
push ecx
push ecx
push ecx
push eax
mov eax, dword [esp + 0x30]
add edx, 0x14e4
imul eax, dword [esp + 0x5c]
push eax
mov eax, ebx
xor eax, 0x1a46
or eax, ebp
push eax
push edi
push ecx
call fcn.1000b090
mov ecx, dword [esi + 0x64]
xor ecx, dword [esp + 0x6c]
mov dword [esp + 0x4c], eax
xor ecx, 0x1292
mov eax, dword [esi + 0x70]
imul edi, dword [esi + 0x194], 0x11d7
sub eax, 0x156f
add dword [esi + 0x98], eax
mov eax, dword [esi + 0x13c]
imul eax, dword [esp + 0x6c]
mov edx, dword [esi]
mov ebp, dword [esi + 0xf8]
or edx, 0x174d
sub ebp, ebx
mov ebx, dword [esi + 0x78]
sub ebx, dword [esp + 0x44]
add ebp, 0x1784
push eax
push ecx
mov ecx, dword [esp + 0x74]
mov eax, ecx
or eax, dword [esp + 0x4c]
push eax
push edx
push edi
push ebx
mov ebx, dword [esp + 0x5c]
mov edx, ecx
imul eax, ecx, 0x1112
push ebp
or eax, 0x11d7
push eax
lea eax, [ebx + 0x190f]
push eax
mov eax, edx
add edx, 0xffffe6f1
or eax, 0x14e4
and edx, ecx
push eax
mov eax, dword [esp + 0x64]
mov ecx, esi
add eax, 0xffffcd7a
push eax
mov eax, dword [esp + 0x74]
and eax, 0x14e4
push eax
call fcn.10001500
add esp, 0x5c
mov ebp, eax
mov eax, dword [esi + 0x38]
imul eax, dword [esi + 0x118]
mov ecx, dword [esp + 0x34]
mov edi, dword [esi + 0x12c]
mov edx, dword [esp + 0x40]
or edi, ebx
or eax, ebx
mov ebx, dword [esp + 0x2c]
xor ecx, eax
mov eax, dword [esi + 0xf8]
add eax, dword [esp + 0x20]
and eax, 0x132f
mov dword [esp + 0x34], ecx
sub dword [esi + 0x1c], eax
jmp 0x1000e88e
mov eax, dword [esi + 0xf8]
xor eax, edx
xor eax, ebp
or edi, eax
jmp 0x1000e88a
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x1b8]
and eax, ecx
mov edx, dword [esi + 0xfc]
cmp edx, eax
jne 0x1000e888
mov edi, ebx
sub edi, dword [esp + 0x10]
imul edi, ebp
nop dword [eax]
mov eax, dword [esi + 8]
or ecx, edi
add edx, 2
and eax, ecx
cmp edx, eax
je 0x1000e870
mov edi, dword [esp + 0x40]
mov dword [esi + 0x1b8], ecx
mov edx, edi
mov ecx, dword [esp + 0x34]
lea eax, [ebx + 0x4f2]
cmp ecx, eax
jge 0x1000ead5
lea eax, [ebp + 0x1197]
cmp dword [esp + 0x10], eax
jge 0x1000e91a
mov eax, dword [esi + 0x58]
imul eax, dword [eax + 0x64], 0xe41d2200
mov dword [esi + 0x90], eax
cmp dword [esi], 0x1112
jae 0x1000e8d0
imul eax, dword [esi + 0xc8], 0x190f
mov dword [esi + 0x13c], eax
mov edx, esi
mov ecx, 0x13a4
call fcn.100095f0
mov dword [esi + 0x1f4], eax
mov eax, dword [esi + 0xf8]
mov eax, dword [eax + 0x64]
sub eax, 0x19ad
mov dword [esi + 0x1d4], eax
mov eax, dword [esi + 0xfc]
mov ecx, dword [esi + 0x24]
add eax, 0x11d7
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x94]
or eax, 0x16cb
xor dword [ecx + 0x10], eax
jmp 0x1000eaa8
lea eax, [ebx + 0x7bb]
mov dword [esp + 0x10], ebx
and eax, ebx
mov dword [esp + 0x20], eax
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x194]
mov ecx, eax
imul ecx, dword [esp + 0x14]
xor ecx, eax
mov eax, edx
mov dword [esi + 0x194], ecx
lea ecx, [ebx + 0x7bb]
and eax, ecx
imul eax, dword [esi + 0x10c]
mov dword [esi + 0x10c], eax
mov eax, dword [esi + 0x19c]
add eax, 0xffffe1e2
add eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 0xfc]
add eax, 0x132f
xor eax, ecx
mov ecx, dword [esi + 0x1c4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x14]
add eax, 0x935
imul ecx, ebp
and eax, 0x14fb
sub eax, 0x71b
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x68]
imul eax, dword [esi + 0x40]
sub ecx, 0x1a4d
or eax, edi
mov edi, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, edi
xor eax, 0x139b
sub eax, 0x1f54
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
add eax, 0x5ed
cmp ecx, eax
jg 0x1000e9e0
mov eax, dword [esi + 0x28]
mov dword [esi + 0x90], eax
mov dword [esi + 0x50], 0
jmp 0x1000ea45
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 8]
add ecx, 0x692
add eax, ecx
cmp edi, eax
jbe 0x1000ea45
mov eax, dword [esi + 0x24]
sub eax, dword [esp + 0x18]
add dword [esi + 0x12c], eax
mov eax, dword [esi + 0x40]
mov ecx, dword [esp + 0x2c]
xor eax, ecx
sub eax, dword [esi + 0xd0]
add ecx, 0xfffffe22
push eax
mov eax, dword [esp + 0x28]
add eax, ecx
and eax, dword [esi + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [esi + 0xf8]
imul eax, dword [esp + 0x20]
mov edx, dword [esp + 0x40]
imul eax, dword [esi + 0x1c4]
mov dword [esi + 0x1c4], eax
mov eax, dword [esi + 0xc8]
add eax, dword [esp + 0x14]
add dword [esi + 0x68], eax
sub edx, dword [esi + 0x98]
or edx, dword [esi + 0xfc]
mov eax, dword [esi + 0x198]
add eax, dword [esi + 0x38]
xor eax, 0x16cb
mov dword [esi + 0xf8], edx
mov edx, dword [esi + 0x13c]
sub ebp, eax
mov ecx, edx
mov eax, 0x14e4
and ecx, 0x132f
sub eax, ecx
mov ecx, dword [esp + 0x34]
add dword [esi + 0x170], eax
mov eax, dword [esi + 0x10]
imul eax, edx
imul ecx, ebp
or eax, dword [esi + 0x50]
or ecx, dword [esi + 0x14]
imul eax, ecx
mov dword [esi + 0x14], eax
mov ecx, dword [esp + 0x10]
mov eax, ebx
add ecx, 0x139b
cmp ebp, ecx
jge 0x1000ead7
mov ecx, dword [esi + 0x12c]
pop edi
mov ecx, dword [ecx + 0x14]
xor ecx, 0x1a4d
mov dword [esi + 0x1ec], ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret