Function at 0x10005040
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x30]
lea edx, [ecx + 0xa0]
mov ecx, dword [esp + 0x14]
add eax, 0xffffec04
add dword [esp + 0x24], 0x569
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov dword [esp + 0xc], eax
lea ebp, [ecx + 0x71b]
mov eax, dword [esp + 0x28]
add ebx, 0xffffea70
add eax, 0x221
mov dword [esp + 8], edx
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
add edi, 0x1f5
lea eax, [ecx + 0x3b6]
mov dword [esp + 0x40], ebp
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ebx
cmp ecx, eax
je 0x100051c7
lea eax, [edx - 0x8b3]
cmp ecx, eax
je 0x10005102
lea eax, [edi - 0x95]
cmp ecx, eax
je 0x10005278
mov esi, dword [esp + 0x28]
mov ecx, esi
push 0x1292
call fcn.10006fc0
mov eax, dword [esi + 0x1e0]
add esp, 4
mov edi, dword [esp + 0x34]
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0x118]
xor eax, 0x139b
sub dword [esi + 0x68], eax
lea eax, [edi - 0x214]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x28]
mov ebx, dword [esi + 0x50]
mov eax, dword [esi + 0x12c]
imul eax, ebx
mov dword [esp + 0x24], ebx
add eax, dword [esi + 0xc8]
cmp ebx, eax
jne 0x10005278
mov eax, dword [esi + 0x10c]
mov edi, edx
xor eax, ebp
cmp edx, eax
je 0x10005196
mov ebx, dword [esp + 0x40]
lea ebp, [ecx + 0x14e4]
nop dword [eax]
mov eax, dword [esi]
mov ecx, 0x139b
and eax, dword [esi + 0x40]
xor cx, word [esi + 0x38]
sub eax, 0x1869
push eax
mov eax, dword [esp + 0x18]
movzx eax, ax
movzx ecx, cx
imul ecx, eax
push ebp
movzx eax, cx
push eax
mov eax, dword [esi + 0x38]
or eax, dword [esp + 0x2c]
or eax, 0x11d7
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [esi + 0x10c]
inc edi
xor eax, ebx
cmp edi, eax
jne 0x10005140
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov eax, dword [esi + 0x50]
add ebx, 2
imul eax, dword [esi + 0x12c]
mov dword [esp + 0x24], ebx
add eax, dword [esi + 0xc8]
cmp ebx, eax
je 0x10005124
mov edi, dword [esp + 0x34]
lea eax, [edi - 0x214]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x28]
mov eax, ebx
and eax, 0x11d7
cmp dword [esi + 0x1c4], eax
jb 0x10005278
mov ebx, dword [esi + 0x50]
lea eax, [ebx - 0x1648]
xor eax, edi
cmp edx, eax
jne 0x10005278
mov ecx, dword [esi + 0x12c]
mov eax, ecx
mov edx, dword [esi + 0x1c]
and eax, edi
add dword [esi + 0x1c4], eax
mov eax, dword [esi + 0xf8]
sub eax, ecx
mov edi, dword [esp + 0x34]
add eax, 0x190f
push esi
push ecx
push eax
mov eax, edx
sub esp, 8
imul eax, edx
sub edx, dword [esp + 0x38]
and eax, dword [esi + 0xfc]
push eax
push ecx
mov ecx, dword [esp + 0x3c]
mov eax, ecx
sub eax, dword [esi + 0x118]
xor eax, dword [esp + 0x2c]
push eax
mov eax, dword [esi + 0x40]
and eax, ecx
and eax, ebp
push eax
imul eax, edx, 0x1a46
push eax
mov eax, dword [esi + 0x10c]
imul eax, ebx
push ecx
mov ecx, edi
sub ecx, dword [esi + 0x10]
xor ecx, dword [esi + 0x38]
imul eax, ebp
push eax
call fcn.1000fab0
add esp, 0x30
lea eax, [edi - 0x214]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, ecx
lea eax, [edi - 0x214]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret