Function at 0x41af15
Capabilities:
Create pipe
Terminate process

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [0x645ebc], eax
mov dword [esp], edx
mov dword [esp + 0x10], 0x23b7
mov dword [esp + 0x2c], 0x2474
mov dword [esp + 4], 0x2370
mov dword [esp + 8], 0x23a3
push ebx
mov dword [esp + 0x10], 0x2537
mov eax, dword [esp + 0x30]
push ebp
add eax, 0xffffff0a
mov ebp, 0x645da0
push esi
push edi
cmp dword [esp + 0x20], eax
jl 0x41b3bd
mov eax, dword [esp + 0x1c]
add eax, 0xffffff08
cmp dword [esp + 0x14], eax
je 0x41b155
add dword [esp + 0x3c], 0xffffff43
xor ecx, ecx
mov eax, dword [0x645d9c]
inc ecx
mov dword [0x645da4], 0xa
mov dword [0x645db0], 0x4f
push 0xd
mov dword [eax + 0x20], edx
mov eax, dword [0x645d9c]
mov dword [0x645dc4], ecx
mov dword [0x645dcc], ecx
mov dword [0x645e10], ecx
mov dword [0x645dd4], edx
mov dword [0x645de0], edx
mov dword [0x645dec], 0x45
mov dword [0x645dfc], 0x27
mov dword [eax + 0x74], edx
mov dword [0x645e18], ecx
mov dword [0x645e30], ecx
mov dword [0x645e50], edx
mov dword [0x645e6c], ecx
mov dword [0x645e7c], ecx
mov dword [0x645e8c], ecx
mov dword [0x645e98], ecx
mov dword [0x645e2c], 0x10
mov dword [0x645e38], edx
mov dword [0x645e48], edx
mov dword [0x645e64], edx
mov dword [0x645e74], 4
mov dword [0x645ea8], 0x12
pop eax
mov dword [0x645e68], eax
mov dword [0x645e78], eax
mov eax, dword [0x645d9c]
mov dword [eax + 0x118], ecx
mov dword [0x645ec8], ecx
mov dword [0x645ec4], edx
add dword [esp + 0x18], 0xffffffdb
xor dword [esp + 0x3c], 0x14
add dword [esp + 0x14], 0x118
xor dword [esp + 0x14], 0x7f6
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
add dword [esp + 0x14], 0x10a
add dword [esp + 0x18], 0xfffffff2
xor dword [esp + 0x18], 0x7ab
xor dword [esp + 0x10], 0x237e
mov eax, dword [0x645d9c]
mov ecx, dword [0x645e50]
cmp ecx, dword [eax + 0x128]
jb 0x41b0c1
mov eax, dword [0x645ea8]
sub eax, dword [0x645de0]
add eax, dword [0x645e30]
jmp 0x41b0d1
mov eax, dword [0x645eb8]
add eax, 0xbe3d4
add eax, dword [0x645e6c]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x3c]
sub edi, 0x14
mov edx, dword [esp + 0x18]
xor esi, 0x6ea
xor dword [0x645e98], eax
xor edx, 0x635
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add ecx, 0x25
xor eax, 0x6d6
push eax
push ecx
push edx
push esi
push edi
push ebp
call fcn.00419eb2
mov dword [esp + 0x28], eax
add dword [esp + 0x54], 0x5c
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
xor esi, 0x7f
mov ecx, dword [esp + 0x30]
add edx, 0x4e
mov eax, dword [esp + 0x54]
xor ecx, 0x778
push ebp
add eax, 0x14a
push eax
push ecx
push edx
push esi
call fcn.0041b9d4
mov dword [esp + 0x48], eax
add esp, 0x2c
xor dword [esp + 0x1c], 0x7fa
jmp 0x41b3bd
mov ecx, dword [esp + 0x20]
mov eax, dword [0x645d9c]
add ecx, 0xffffdd12
cmp dword [eax + 0xd8], ecx
je 0x41b38e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
or eax, 0x24f7
mov dword [esp + 0x28], ecx
cmp ecx, eax
je 0x41b32a
mov eax, dword [0x645d9c]
mov ecx, dword [eax + 0x48]
mov edx, dword [eax + 0xec]
add ecx, dword [0x645e2c]
mov eax, dword [esp + 0x3c]
imul eax, ecx
cmp edx, eax
jmp 0x41b27d
mov eax, dword [esp + 0x3c]
mov ecx, dword [0x645e14]
sub ecx, eax
mov eax, dword [esp + 0x3c]
sub eax, 0x22ee
and ecx, 0x241c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
xor ecx, eax
mov eax, dword [0x645d9c]
sub ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
mov eax, dword [0x645e88]
xor eax, dword [0x645ed0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x18]
or esi, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
imul edx, dword [esp + 0x10]
mov ebp, dword [0x645e74]
imul edi, dword [0x645e6c], 0x243f
sub ebp, eax
mov eax, dword [esp + 0x1c]
sub ebp, 0x2370
mov ecx, dword [0x645df0]
or edx, dword [0x645dcc]
sub ecx, eax
mov eax, dword [esp + 0x14]
sub ecx, 0x2474
or eax, dword [esp + 0x10]
or ebx, dword [0x645e70]
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [0x645d9c]
mov edx, dword [esp + 0x24]
add edx, 3
mov ecx, dword [eax + 0x48]
mov eax, dword [0x645e2c]
add eax, ecx
mov ecx, dword [esp + 0x3c]
imul ecx, eax
cmp edx, ecx
mov dword [esp + 0x24], edx
je 0x41b1ab
mov ecx, dword [esp + 0x3c]
mov eax, dword [0x645d9c]
imul ecx, dword [eax + 0x118]
mov eax, dword [esp + 0x3c]
mov ebp, dword [esp + 0x3c]
and eax, dword [0x645da8]
add ebp, eax
mov eax, dword [esp + 0x10]
add eax, dword [0x645e78]
imul ebx, eax, 0x23ff
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x3c]
mov esi, dword [0x645e90]
sub edi, eax
mov edx, dword [0x645eb8]
xor esi, 0x2405
sub edx, dword [0x645e38]
and esi, dword [0x645e64]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
imul eax, dword [0x645dd8]
sub ecx, dword [0x645ea8]
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
add edx, 3
or eax, 0x24f7
mov dword [esp + 0x28], edx
cmp edx, eax
jne 0x41b189
mov ebp, 0x645da0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, eax
cmp dword [esp + 0x10], ecx
jl 0x41b3bd
mov eax, dword [esp + 0x1c]
push 0x3bce
push 0x316b
push 0x34dc
xor eax, 0x2537
push 0x989
push 0xeaf
mov dword [esp + 0x2c], eax
call fcn.0041a0e0
mov dword [0x6466d4], eax
add esp, 0x14
mov eax, dword [esp + 0x14]
mov ecx, dword [0x645db8]
sub ecx, eax
mov eax, dword [esp + 0x3c]
xor eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
jmp 0x41b3bd
mov ecx, dword [0x645ecc]
jmp 0x41b3a7
mov eax, dword [esp + 0x10]
imul eax, eax, 0x25a8
xor dword [esp + 0x10], eax
add ecx, 2
mov eax, dword [0x645dd4]
sub eax, dword [0x645e38]
imul eax, dword [0x645e5c]
cmp ecx, eax
ja 0x41b396
add dword [esp + 0x3c], 0xffffffc1
mov ebx, 0xb4
xor dword [esp + 0x10], 0x7e3
add dword [esp + 0x20], 0x140
add dword [esp + 0x14], 0x120
add dword [esp + 0x1c], 0x14a
add dword [esp + 0x10], 0xbf
add dword [esp + 0x20], 0xffffff08
xor dword [esp + 0x10], 0xc7
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x3c]
sub edi, 0x48
mov edx, dword [esp + 0x3c]
add esi, 0x177
mov ecx, dword [esp + 0x18]
add edx, ebx
mov eax, dword [esp + 0x3c]
sub ecx, 0xd6
sub eax, 0x1d
push eax
push ebp
push ecx
push edx
push esi
push edi
call fcn.00401856
mov dword [esp + 0x34], eax
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esi, 0x1c
mov ecx, dword [esp + 0x54]
sub edx, 0x169
mov eax, dword [esp + 0x38]
add ecx, ebx
add eax, 0x138
push eax
push ecx
push ebp
push edx
push esi
call fcn.00419c97
add esp, 0x2c
mov dword [esp + 0x3c], eax
xor dword [esp + 0x18], 0x724
push dword [0x645eac]
call dword [sym.imp.KERNEL32.dll_ExitProcess]