Function at 0x404cbc
Capabilities:
Create pipe
Encode data using xor
Terminate process
Write file on windows
Write pipe

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x20]
push ebx
mov dword [0xaa13a4], eax
mov ebx, 0xaa1270
push ebp
xor ebp, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x28], 0x17b0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0xc], 0x146c
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0xc]
xor eax, 0x569
push esi
push edi
cmp dword [esp + 0x20], eax
je 0x404f68
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
add edi, 0x1105
mov edx, dword [esp + 0x14]
xor esi, 0xb69
mov eax, dword [esp + 0x14]
xor edx, 0x349d
mov ecx, dword [0xa662e4]
add eax, 0x62f
push eax
push ecx
push edx
push esi
push edi
call fcn.00405748
mov dword [esp + 0x28], eax
add esp, 0x14
mov eax, dword [0xaa1290]
cmp eax, dword [0xaa1278]
ja 0x404d68
mov ecx, dword [0xaa1378]
mov eax, dword [0xa662e4]
add ecx, 0xfff71741
mov dword [eax + 0xd4], ecx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
add edi, 0x223b
mov edx, dword [esp + 0x30]
xor esi, 0x1899
mov ecx, dword [esp + 0x14]
xor edx, 0x6b5
mov eax, dword [esp + 0x30]
xor ecx, 0x38f4
sub eax, 0x344
push eax
push ebx
push ecx
push edx
push esi
push edi
call fcn.00404728
mov dword [esp + 0x48], eax
mov ecx, 0x414180
mov eax, dword [0xa662e4]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov eax, dword [eax + 0xc]
cmp eax, dword [0xaa12d8]
mov edx, dword [esp + 0x28]
cmovae ecx, dword [0xaa1324]
xor edx, 0x144e
mov dword [0xaa1324], ecx
add esi, 0x1a9b
mov ecx, dword [esp + 0x48]
add edi, 0x1f05
mov eax, dword [esp + 0x34]
sub ecx, 0x1055
add eax, 0x222b
add ebx, 0x206d
push eax
push 0xaa1270
push ecx
push edx
push esi
push edi
push ebx
call fcn.004052c4
add esp, 0x34
mov dword [esp + 0x14], eax
mov edi, ebp
mov ecx, dword [0xa662e4]
mov eax, dword [0xaa127c]
sub eax, dword [ecx + 0xdc]
xor eax, 0xfb6cf
sub dword [ecx + 0x10c], eax
mov eax, dword [0xaa1324]
mov ebx, dword [0xaa12f0]
mov edx, dword [eax + edi]
add edi, 4
mov eax, dword [0xa662e4]
imul ebx, edx
mov ecx, dword [eax + 0x7c]
xor ecx, dword [0xaa1358]
mov eax, dword [0xaa1390]
mov edx, ebx
add eax, 0xffec1bd3
shr edx, 8
add eax, ecx
mov ecx, dword [0xaa1380]
mov dword [0xaa1390], eax
dec ecx
mov eax, dword [0xaa1300]
add eax, ecx
mov ecx, dword [0xaa12f4]
mov dword [0xaa1380], eax
mov eax, dword [0xaa1328]
mov byte [eax + ecx], dl
mov ecx, dword [0xaa12f4]
mov eax, dword [0xaa1328]
inc ecx
mov dword [0xaa12f4], ecx
mov byte [eax + ecx], bl
inc dword [0xaa12f4]
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0xc4]
add dword [ecx + 0xe8], eax
mov eax, dword [0xaa1378]
add eax, dword [0xaa1290]
mov esi, dword [0xaa12d8]
xor eax, 0x8e8bf
or dword [0xaa128c], eax
mov eax, dword [0xaa1358]
mov edx, dword [0xa662e4]
add eax, 0xfff4d2ee
or esi, eax
mov eax, dword [0xaa137c]
add eax, dword [0xaa1290]
sub dword [0xaa131c], eax
mov dword [0xaa12d8], esi
mov eax, dword [edx + 0x68]
xor eax, 0xfff09a7e
imul eax, dword [0xaa12e0]
mov dword [0xaa12e0], eax
mov eax, dword [0xaa12b4]
add eax, 0xffec0036
xor dword [0xaa1380], eax
mov eax, 0xffe85340
mov ecx, dword [edx + 0x7c]
xor ecx, esi
sub eax, ecx
add dword [edx + 0xe8], eax
mov ecx, dword [0xa662e4]
mov eax, dword [ecx + 0x90]
sub eax, dword [ecx + 0xe8]
add eax, 0xb2d12
imul eax, dword [ecx + 0x7c]
mov dword [ecx + 0x7c], eax
cmp edi, 0x39d08
jl 0x404e1c
mov ebx, 0xaa1270
mov eax, dword [esp + 0x18]
xor eax, 0x11d6
cmp dword [esp + 0x30], eax
jle 0x404fea
add dword [esp + 0x30], 0xfffffc81
cmp dword [0xaa12b8], 0x2144
je 0x404fa7
mov eax, dword [0xa662e4]
mov ecx, dword [eax + 0x90]
mov eax, dword [0xaa128c]
add eax, 0xe9bd3794
add eax, ecx
mov dword [0xaa12f0], eax
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x10]
sub edi, 0x613
mov edx, dword [esp + 0x1c]
add esi, 0x223b
mov ecx, dword [esp + 0x10]
add edx, 0x1105
mov eax, dword [esp + 0x1c]
add ecx, 0x144e
add eax, 0x1899
push eax
push ebx
push ecx
push edx
push esi
push edi
call fcn.00403b70
add esp, 0x18
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
add eax, 0x222b
cmp dword [esp + 0x18], eax
jg 0x4050df
add dword [esp + 0x10], 0x105c
mov dword [0xaa1370], ebx
mov eax, dword [0xaa137c]
sub dword [0xaa12b4], eax
mov ecx, dword [0xa662e4]
mov eax, dword [0xaa1308]
add eax, 0x190e11
push 0x12
xor dword [ecx + 0x1c], eax
mov eax, dword [0xa662e4]
mov ecx, dword [eax + 0x20]
xor ecx, dword [0xaa128c]
pop eax
sub eax, ecx
mov ecx, dword [0xaa133c]
add dword [0xaa134c], eax
mov eax, dword [0xaa1350]
inc eax
imul eax, dword [0xaa1394]
mov dword [0xaa1394], eax
mov eax, dword [0xaa1314]
xor dword [ecx + ebp], eax
add ebp, 4
mov eax, dword [0xaa12ec]
xor eax, dword [0xaa128c]
mov ecx, dword [0xa662e4]
xor eax, 0x18c92d
or dword [ecx + 0x90], eax
mov ecx, dword [0xa662e4]
mov eax, dword [0xaa12ec]
add eax, 0xffe736c2
imul eax, dword [ecx + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [0xaa1340]
add dword [0xaa1314], eax
cmp ebp, 0x241d24
jl 0x40500b
push dword [0xaa13a4]
mov eax, dword [0xaa138c]
add eax, dword [0xaa1328]
mov edx, dword [0xaa133c]
push eax
push dword [0xaa1370]
mov dword [0xaa1320], edx
call edx
mov dword [0xaa1360], eax
jmp 0x4052b4
mov ebp, dword [0xaa1330]
jmp 0x40518c
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x30]
mov eax, dword [0xaa1288]
or eax, dword [0xaa12e0]
xor edx, dword [esp + 0x30]
mov ecx, dword [0xaa1398]
xor ecx, dword [0xaa12b8]
imul esi, eax
mov eax, dword [esp + 0x20]
add eax, dword [0xaa1278]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov ebx, dword [0xaa12a8]
mov ecx, dword [esp + 0x14]
sub ebx, eax
mov eax, dword [0xa662e4]
xor edi, dword [0xaa1308]
xor esi, dword [eax + 0x48]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
add eax, ecx
imul edx, eax
mov eax, dword [0xa662e4]
mov ecx, dword [eax + 0xd8]
mov eax, dword [esp + 0x1c]
or ecx, 0x146c
xor eax, dword [0xaa1394]
sub ecx, dword [0xaa130c]
sub eax, 0x223b
push eax
push ecx
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
add ebp, 2
mov eax, dword [esp + 0x18]
add eax, 0x1110
cmp ebp, eax
jl 0x4050ea
mov eax, dword [0xa662e4]
mov ecx, dword [esp + 0x14]
imul ecx, dword [eax + 0xe0]
mov eax, dword [esp + 0x30]
add eax, ecx
cmp dword [esp + 0x10], eax
jbe 0x4052b4
mov eax, dword [0xaa1384]
xor eax, dword [0xaa1278]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [0xaa1338]
xor ecx, 0x1105
imul ebx, dword [0xaa1290]
and eax, 0x222a
mov esi, dword [0xaa1348]
or eax, 1
or edx, dword [0xaa135c]
add ecx, 0x20f1
xor edi, dword [0xaa12f8]
add esi, 0xffffee2a
or ebp, dword [0xaa1348]
add edi, 0x1f05
push eax
imul eax, dword [0xaa12dc], 0x1105
xor ebx, 0x1899
push eax
push ecx
push edx
push esi
push edi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
and edi, 0x1f05
mov eax, dword [0xa662e4]
imul edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
imul edi, dword [0xaa131c]
mov esi, dword [eax + 0x1c]
mov eax, dword [0xa662e4]
sub esi, dword [0xaa12d8]
and edx, dword [0xaa1388]
sub esi, 0x144e
mov eax, dword [eax + 0x110]
sub eax, 0x17b0
add ecx, eax
imul eax, dword [0xaa12b8], 0x1899
push eax
push ecx
push edx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x20]
and eax, 0x1a9b
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [0xaa1360]
call dword [sym.imp.KERNEL32.dll_ExitProcess]