Function at 0x4018e2
Capabilities:
Create pipe
Encode data using xor
Write file on windows
Write pipe

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
add edx, 0x21b
push ebp
mov ebp, dword [esp + 0x18]
add ecx, 0xffffef8b
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
lea edi, [ebp - 0x1038]
xor ebp, 0x1e6c
lea eax, [edi + 0x12e0]
mov dword [esp + 8], edi
cmp ebp, eax
je 0x401e60
cmp edx, eax
je 0x401e60
lea eax, [ecx + 0xcf2]
push ebx
push esi
cmp edi, eax
jge 0x401c37
mov eax, dword [0x584ab4]
mov esi, dword [esp + 0x2c]
mov eax, dword [eax + 0xd8]
cmp eax, dword [esi + 0xe0]
ja 0x401957
mov eax, dword [esi]
sub dword [esi + 0x68], eax
mov eax, dword [esi + 0xfc]
mov dword [0x679be8], eax
mov eax, dword [esi + 0x28]
add dword [esi + 0xf8], eax
mov ecx, dword [0x584ab4]
mov eax, dword [ecx + 0x3c]
cmp eax, dword [ecx + 0x118]
jb 0x401985
mov dword [esi + 0x44], 0xbe14a
jmp 0x401997
mov eax, dword [esi + 0x11c]
xor eax, dword [0x679c08]
mov dword [esi + 0x128], eax
mov ecx, dword [esi + 0x104]
xor edi, edi
mov edx, dword [0x584ab4]
add ecx, 0xf4d3c
mov eax, dword [esi + 0xc4]
add eax, ecx
xor dword [edx + 0x44], eax
mov ecx, dword [esi + 0x11c]
mov eax, dword [esi + 0x7c]
add ecx, 0x3f
xor dword [esi + 0x44], 0x1c2c0d
add eax, ecx
push eax
push 0x3000
push dword [0x679b34]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [eax + 0x2800]
mov eax, dword [0x584ab4]
mov dword [eax + 0xdc], ecx
mov eax, dword [esi + 0x1c]
cmp eax, dword [esi + 0xc4]
jae 0x401a0d
mov ecx, dword [esi + 0x74]
mov eax, dword [0x584ab4]
sub ecx, 0x37fc4c0
mov dword [eax + 0x64], ecx
jmp 0x401a1c
mov eax, dword [esi + 0x48]
sub eax, dword [esi + 0x80]
or dword [0x679b80], eax
mov eax, dword [esi + 0xc8]
cmp eax, dword [esi + 0x90]
jne 0x401a37
mov eax, dword [0x679b70]
xor dword [esi + 0xe0], eax
jmp 0x401a43
mov eax, dword [0x584ab4]
add dword [eax + 0x64], 0xfffffa56
mov ecx, dword [0x584ab4]
add ebp, 0x31c
mov eax, dword [0x679bcc]
mov dword [ecx + 0x88], eax
cmp dword [esi + 0x84], 0x18420
jae 0x401a76
mov eax, dword [esi + 0xec]
sub eax, 0xb847
mov dword [0x679c28], eax
mov eax, dword [esi + 0xac]
add eax, dword [esi + 0xc8]
xor eax, 0xafd8a
mov dword [esi + 0x60], eax
mov eax, dword [0x584ab4]
mov ecx, dword [eax + 0xd8]
mov eax, dword [esi + 0xe0]
add ecx, 0xfffc7fc9
add eax, ecx
xor dword [0x679b50], eax
mov eax, dword [0x679ba4]
add eax, dword [0x679b98]
xor eax, dword [esi + 0x60]
xor eax, 0xfcb29
mov dword [esi + 0x60], eax
mov ecx, dword [0x584ab4]
mov eax, dword [0x679c18]
add eax, 0xfffa05e6
xor dword [ecx + 0x60], eax
cmp dword [esi + 0x90], 0x7f9e
jb 0x401ae5
xor dword [esi + 0x60], 0x67342
mov ecx, dword [0x584ab4]
mov eax, dword [esi + 0x80]
cmp eax, dword [ecx + 0x12c]
ja 0x401b0d
mov eax, dword [ecx + 0xd8]
add eax, 0xb575
xor dword [esi + 0x60], eax
mov ecx, dword [0x584ab4]
mov eax, dword [ecx + 0x128]
xor ebp, 0x1f6d
sub eax, 0x3b1eca9f
mov dword [esi + 0x78], 0x429570
xor eax, dword [esi + 0x60]
sub eax, dword [esi + 0xd8]
sub eax, dword [esi + 0x70]
add eax, 0x1b4cf2
mov dword [esi + 0x60], eax
mov ecx, dword [0x584ab4]
mov eax, dword [ecx + 0x48]
add eax, dword [esi + 0x3c]
xor eax, 1
add dword [ecx + 0x134], eax
xor ecx, ecx
mov eax, dword [0x584ab4]
inc ecx
mov eax, dword [eax + 0x118]
xor eax, dword [esi + 0x104]
xor eax, 1
imul eax, dword [0x679b64]
mov dword [0x679b64], eax
mov eax, dword [0x679bdc]
add eax, 0xfff689fe
add eax, dword [esi + 0x128]
or dword [esi + 0x134], eax
mov eax, dword [esi + 0x78]
mov edx, dword [edi + eax]
add edi, 4
mov eax, dword [0x584ab4]
sub ecx, dword [eax + 0x48]
sub ecx, dword [0x679b2c]
add dword [esi + 0xd4], ecx
mov eax, dword [esi + 0x104]
inc eax
imul eax, dword [esi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [0x584ab4]
mov eax, dword [0x679c0c]
dec eax
xor dword [0x679bb4], eax
mov ebx, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x90]
mov eax, dword [esi + 0x70]
add ecx, 0xffbbe3f8
add eax, ecx
imul ebx, edx
or dword [esi + 0xd4], eax
mov eax, dword [0x679b54]
mov ecx, dword [esi + 0x88]
mov edx, ebx
shr edx, 0x10
mov byte [eax + ecx], dl
mov edx, ebx
mov eax, dword [0x584ab4]
inc dword [0x679b54]
shr edx, 8
mov ecx, dword [eax + 0x88]
mov eax, dword [eax + 0x64]
mov byte [ecx + eax], dl
mov eax, dword [0x584ab4]
inc dword [eax + 0x64]
mov ecx, dword [esi + 0x64]
mov eax, dword [0x679b78]
mov byte [eax + ecx], bl
inc dword [esi + 0x64]
cmp edi, 0xbe160
jl 0x401b39
jmp 0x401e5e
mov ebx, dword [esp + 0x2c]
mov eax, dword [ebx + 0x134]
imul eax, ecx
cmp edi, eax
jbe 0x401e4e
imul eax, edi, 0x1038
push eax
mov eax, dword [ebx + 0xd0]
xor eax, 0x12d6
push eax
call dword [sym.imp.KERNEL32.dll_HeapWalk]
mov edx, dword [ebx + 0x70]
mov eax, dword [ebx + 0x1c]
mov esi, dword [ebx + 0x18]
sub eax, 0x1075
add esi, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [edx - 0x12e0]
sub edx, dword [ebx + 0xe8]
add eax, ebp
and edx, dword [ebx + 0xc]
push eax
push edx
push ecx
push ebx
push esi
call fcn.004018ac
add esp, 0x18
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x24]
add ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebx + 0x94]
add eax, 0x1170
add eax, ecx
imul ebp, eax
pop esi
pop ebx
pop edi
lea eax, [ebp + 4]
pop ebp
pop ecx
ret