Function at 0x404c76
Capabilities:
Create pipe
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
mov edx, eax
mov ecx, dword [esp + 0xc]
xor edx, 0x3f73
push ebx
mov dword [esp + 4], edx
xor ecx, 0x43c
mov edx, dword [esp + 0xc]
lea ebx, [eax - 0x3f73]
push ebp
mov ebp, dword [esp + 0x18]
push esi
lea esi, [edx - 0x3d9f]
mov dword [esp + 0x18], ecx
xor edx, 0x7fe
mov dword [esp + 0x24], esi
lea eax, [ebp - 0xad6]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
xor ebp, 0x40c9
push edi
mov edi, dword [esp + 0x24]
lea eax, [edx - 0x4aa]
cmp ecx, eax
je 0x404d47
push edi
lea eax, [ebx + 0x40c9]
xor ecx, 0x4c0
push eax
mov eax, dword [esp + 0x30]
lea esi, [ebp + 0x39a7]
mov ebp, dword [esp + 0x18]
add eax, 0x3a42
push eax
push esi
push ecx
lea eax, [ebp + 0x3a42]
push eax
mov eax, ebx
xor eax, 0x3525
push eax
call fcn.004133d6
push dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffbaa
mov dword [esp + 0x48], eax
push ecx
push edi
lea ecx, [eax + 0x799]
push ecx
lea ecx, [ebp + 0x3b66]
push ecx
push esi
call fcn.004135e1
mov esi, dword [esp + 0x5c]
add esp, 0x34
mov ebp, eax
jmp 0x404e0f
mov eax, dword [edi + 0x118]
mov ecx, eax
or ecx, 0x39a7
xor ecx, eax
cmp dword [esp + 0x1c], ecx
jbe 0x404e0f
mov ecx, dword [0x5178d4]
imul eax, dword [ecx + 0x90], 0x3b2c
or eax, esi
cmp dword [edi + 0x48], eax
jne 0x404e0f
lea eax, [ebx + 0x40c9]
push eax
mov eax, dword [esp + 0x24]
add eax, 0xffffc563
imul eax, dword [edi + 0xc0]
push eax
mov eax, dword [edi + 0x1c]
or eax, edx
push eax
mov eax, dword [edi + 0x78]
sub eax, dword [edi + 0x58]
push eax
mov eax, esi
xor eax, 0x3b66
push eax
mov eax, dword [0x52a4e8]
add eax, ebx
push eax
mov eax, dword [0x52a434]
add eax, 0xffffc261
push eax
mov eax, dword [ecx + 0x78]
xor eax, dword [esp + 0x2c]
add eax, dword [0x52a470]
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0x671
push 0x258b
push 0x127b
push 0x3054
push 0x350b
push 0x1435
push 0x3461
push 0x275f
push 0x131a
push 0x252e
call fcn.0040537a
add esp, 0x28
mov dword [0x52af74], eax
lea eax, [ebx + 0x35b7]
cmp ebx, eax
je 0x405001
mov eax, dword [esp + 0x10]
add eax, 0x3a61
cmp dword [esp + 0x20], eax
je 0x405001
mov eax, dword [esp + 0x1c]
add eax, 0x228
push edi
push eax
mov eax, ebx
xor eax, 0x35b7
push eax
lea eax, [esi + 0x4fc]
push eax
lea eax, [ebx + 0x3ab3]
push eax
call fcn.00403fb4
mov eax, dword [esp + 0x2c]
lea ecx, [ebp - 0x185]
add eax, 0xfffffbaa
xor esi, 0xff5
push eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffbc0
push eax
push ecx
push edi
push ecx
push esi
call fcn.004047cd
lea ecx, [ebx + 0x3ea1]
push ecx
lea ecx, [eax - 0x607]
add eax, 0x375
push ecx
push edi
lea ecx, [ebp + 0x2c1]
push ecx
push eax
call fcn.00413007
add esp, 0x40
mov dword [esp + 0x20], eax
xor ebp, ebp
mov eax, dword [0x5178d4]
mov ecx, 0xb2d12
sub ecx, dword [eax + 0xe8]
sub ecx, dword [0x52a3f8]
add dword [edi + 0x78], ecx
mov ecx, dword [0x5178d4]
mov eax, dword [ecx + 0x118]
sub eax, 0x160c63
imul eax, dword [ecx + 0x48]
mov dword [ecx + 0x48], eax
mov ecx, dword [0x5178d4]
mov eax, dword [ecx + 0xb4]
mov esi, dword [eax + ebp]
add ebp, 4
mov eax, dword [edi + 0xfc]
sub dword [ecx + 0xe0], eax
mov eax, 0x10fd33
sub eax, dword [edi + 0x5c]
add dword [edi + 0xdc], eax
mov edx, dword [0x5178d4]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x114]
add ecx, 0xfff048dd
add eax, ecx
xor dword [edx + 8], eax
mov eax, dword [0x5178d4]
mov eax, dword [eax + 0x7c]
xor eax, dword [0x52a4c0]
sub eax, 0x13e42d
or dword [0x52a4e4], eax
mov ebx, dword [edi + 0x80]
mov ecx, dword [edi + 0x84]
mov eax, dword [edi + 0xb8]
imul ebx, esi
mov edx, ebx
shr edx, 0x10
mov byte [ecx + eax], dl
mov edx, ebx
inc dword [edi + 0x84]
mov eax, dword [0x5178d4]
shr edx, 8
mov ecx, dword [eax + 0xb8]
mov eax, dword [0x52a45c]
mov byte [eax + ecx], dl
xor eax, eax
inc dword [0x52a45c]
inc eax
sub eax, dword [edi + 0xd8]
mov ecx, dword [0x5178d4]
add dword [ecx + 0x34], eax
mov eax, dword [0x52a41c]
add eax, 0xffec0036
add dword [edi + 0x110], eax
mov eax, dword [0x5178d4]
mov ecx, dword [eax + 0x114]
sub ecx, dword [eax + 0xe0]
mov eax, dword [edi + 0x10c]
sub ecx, 0x1d
add dword [edi + 0xfc], ecx
sub dword [edi + 0xf4], eax
mov eax, dword [edi + 0xac]
sub eax, 0x47
imul eax, dword [0x52a4b4]
mov dword [0x52a4b4], eax
mov eax, dword [0x5178d4]
mov ecx, dword [eax + 0xb8]
mov eax, dword [edi + 0x84]
mov byte [ecx + eax], bl
inc dword [edi + 0x84]
cmp ebp, 0x3550
jl 0x404ea9
mov ebp, dword [esp + 0x20]
pop edi
pop esi
lea eax, [ebp + 0x59d]
pop ebp
pop ebx
pop ecx
ret