Function at 0x462a00
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541bdd
mov eax, dword fs:[0]
push eax
sub esp, 0x528
mov eax, dword [0x589ed0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
push 0
push str..pipe3DC7CE6A_0ABB_47B2_BFBD_8AB22DC072C5
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x46319b
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push str..pipe3DC7CE6A_0ABB_47B2_BFBD_8AB22DC072C5
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x518], eax
cmp eax, 0xffffffff
je 0x46319b
mov dword [ebp - 0x478], 0
push 0x400
push ecx
lea ecx, [ebp - 0x474]
mov dword [ebp - 4], 0
call fcn.00463620
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x458], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x478], 3
movq qword [ebp - 0x484], xmm0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x448], 3
movq qword [ebp - 0x454], xmm0
mov dword [ebp - 0x44c], 0
mov byte [ebp - 4], 2
cmp dword [edi + 0x14], 0x10
jb 0x462b06
mov edi, dword [edi]
mov eax, str.exefile
nop dword [eax + eax]
inc eax
cmp byte [eax], 0
jne 0x462b10
sub eax, str.exefile
mov dword [ebp - 0x400], 0x100005
cmp byte [edi], 0
mov dword [ebp - 0x408], eax
mov eax, edi
mov dword [ebp - 0x40c], str.exefile
je 0x462b46
nop dword [eax]
inc eax
cmp byte [eax], 0
jne 0x462b40
sub eax, edi
mov dword [ebp - 0x514], edi
mov edi, dword [ebp - 0x4ec]
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x510], eax
lea eax, [ebp - 0x514]
push edi
push eax
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x508], 0x100005
push eax
call fcn.00463810
cmp dword [esi + 0x14], 0x10
jb 0x462b86
mov esi, dword [esi]
mov eax, str.param
nop dword [eax + eax]
inc eax
cmp byte [eax], 0
jne 0x462b90
sub eax, str.param
mov dword [ebp - 0x508], 0x100005
cmp byte [esi], 0
mov dword [ebp - 0x510], eax
mov eax, esi
mov dword [ebp - 0x514], str.param
je 0x462bc6
nop dword [eax]
inc eax
cmp byte [eax], 0
jne 0x462bc0
sub eax, esi
mov dword [ebp - 0x400], 0x100005
mov dword [ebp - 0x408], eax
lea ecx, [ebp - 0x454]
push edi
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], esi
push eax
lea eax, [ebp - 0x514]
push eax
call fcn.00463810
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x14], 0x10
jb 0x462c03
mov ecx, dword [ecx]
mov eax, str.currentdir
inc eax
cmp byte [eax], 0
jne 0x462c08
sub eax, str.currentdir
mov dword [ebp - 0x508], 0x100005
cmp byte [ecx], 0
mov dword [ebp - 0x510], eax
mov eax, ecx
mov dword [ebp - 0x514], str.currentdir
je 0x462c3a
inc eax
cmp byte [eax], 0
jne 0x462c34
sub eax, ecx
mov dword [ebp - 0x40c], ecx
mov dword [ebp - 0x408], eax
lea ecx, [ebp - 0x454]
push edi
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x400], 0x100005
push eax
lea eax, [ebp - 0x514]
push eax
call fcn.00463810
mov eax, str.normal
inc eax
cmp byte [eax], 0
jne 0x462c71
sub eax, str.normal
mov dword [ebp - 0x400], 0x100005
mov dword [ebp - 0x408], eax
lea ecx, [ebp - 0x454]
push edi
lea eax, [ebp - 0x514]
mov dword [ebp - 0x40c], str.normal
push eax
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x508], 0x102
push eax
call fcn.00463810
mov eax, str.Execute
nop
inc eax
cmp byte [eax], 0
jne 0x462cc0
sub eax, str.Execute
mov dword [ebp - 0x400], 0x100005
mov dword [ebp - 0x408], eax
lea ecx, [ebp - 0x484]
push edi
lea eax, [ebp - 0x454]
mov dword [ebp - 0x40c], str.Execute
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00463810
xorps xmm0, xmm0
mov dword [ebp - 0x4f4], 0
push 1
movups xmmword [ebp - 0x504], xmm0
mov dword [ebp - 0x4f0], 0x100
call fcn.004ba332
push dword [ebp - 0x4f0]
mov dword [ebp - 0x504], eax
mov dword [ebp - 0x500], eax
call fcn.004e4d1e
mov ecx, dword [ebp - 0x4f0]
add esp, 8
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
add eax, ecx
mov dword [ebp - 0x4f4], eax
push 0x100
lea eax, [ebp - 0x504]
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x534], eax
call fcn.00463620
lea eax, [ebp - 0x534]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x484]
call fcn.00463cb0
mov edi, dword [ebp - 0x4f8]
lea eax, [edi + 1]
cmp eax, dword [ebp - 0x4f4]
jb 0x462dd8
mov ecx, dword [ebp - 0x4fc]
sub edi, ecx
mov eax, dword [ebp - 0x4f0]
add eax, eax
lea esi, [edi + 1]
cmp eax, esi
cmovae esi, eax
push esi
push ecx
call fcn.0050aef9
add esp, 8
mov dword [ebp - 0x4fc], eax
add edi, eax
mov dword [ebp - 0x4f0], esi
add eax, esi
mov dword [ebp - 0x4f4], eax
lea eax, [edi + 1]
mov dword [ebp - 0x4f8], eax
mov byte [edi], 0
mov edx, dword [ebp - 0x4fc]
mov ecx, edx
dec dword [ebp - 0x4f8]
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
lea esi, [ecx + 1]
mov byte [ebp - 0x444], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x462e20
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x444]
call fcn.00406210
mov byte [ebp - 4], 5
lea edi, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
mov ecx, dword [ebp - 0x434]
cmovae edi, dword [ebp - 0x444]
xor edx, edx
movq xmm0, qword [str.N1xU1mUxmp]
xor esi, esi
mov ax, word [0x56a028]
mov dword [ebp - 0x400], 0xf
mov dword [ebp - 0x404], 0xa
movq qword [ebp - 0x414], xmm0
mov word [ebp - 0x40c], ax
mov byte [ebp - 0x40a], 0
test ecx, ecx
jle 0x462eb0
lea eax, [ebp - 0x414]
mov al, byte [eax + edx]
xor byte [esi + edi], al
lea eax, [edx + 1]
xor edx, edx
inc esi
div dword [ebp - 0x404]
cmp esi, ecx
jl 0x462e94
mov esi, dword [ebp - 0x518]
lea ecx, [ebp - 0x4ec]
push 0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x444]
cmp dword [ebp - 0x430], 0x10
push ecx
push dword [ebp - 0x434]
cmovae eax, dword [ebp - 0x444]
push eax
push esi
mov dword [ebp - 0x4ec], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x463112
push 0x3e8
lea eax, [ebp - 0x3fc]
push 0
push eax
call fcn.004d90f0
add esp, 0xc
lea eax, [ebp - 0x4ec]
push 0
push eax
push 0x3e8
lea eax, [ebp - 0x3fc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x463112
sub esp, 8
lea ecx, [ebp - 0x42c]
call fcn.004632a0
push 0x100
mov byte [ebp - 4], 7
lea eax, [ebp - 0x3fc]
push ecx
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x420], 0
call fcn.00463620
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 0
lea eax, [ebp - 0x42c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.00465970
test al, al
je 0x462fdb
mov eax, dword [ebp - 0x410]
add eax, 0xfffffff0
mov dword [ebp - 0x410], eax
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x42c], xmm0
mov dword [eax + 0xc], 0
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x400], 0
jmp 0x462fff
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x410], eax
lea ecx, [ebp - 0x4e4]
call fcn.00463240
cmp dword [ebp - 0x420], 0
je 0x4630f9
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00463760
test eax, eax
je 0x4630f9
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00463380
mov eax, dword [eax + 0xc]
shr eax, 0xa
test al, 1
je 0x4630f9
push ecx
lea ecx, [ebp - 0x42c]
call fcn.00463380
cmp dword [eax], 0
jne 0x4630f9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x41c]
call fcn.00463240
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x4630a6
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46309c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4631b9
push edx
push ecx
call fcn.004b9f4f
add esp, 8
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
call fcn.00463240
push dword [ebp - 0x4fc]
call fcn.004e4691
push 1
push dword [ebp - 0x500]
call fcn.004b9f4f
add esp, 0xc
lea ecx, [ebp - 0x474]
call fcn.00463240
mov al, 1
jmp 0x46319d
lea ecx, [ebp - 0x41c]
call fcn.00463240
jmp 0x463112
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x430]
cmp edx, 0x10
jb 0x46314f
mov ecx, dword [ebp - 0x444]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x463145
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4631be
push edx
push ecx
call fcn.004b9f4f
add esp, 8
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x430], 0xf
mov byte [ebp - 0x444], 0
call fcn.00463240
push dword [ebp - 0x4fc]
call fcn.004e4691
push 1
push dword [ebp - 0x500]
call fcn.004b9f4f
add esp, 0xc
lea ecx, [ebp - 0x474]
call fcn.00463240
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ba2f5
mov esp, ebp
pop ebp
ret
call fcn.004e4b18
call fcn.004e4b18
int3