Function at 0x417eb3
Capabilities:
Create pipe

Disassembly:
add al, ch
and dword [esi], 0
mov dword [esi + 4], 0x75
jmp 0x417eac
jae 0x417eb1
jb 0x417eb1
call 0x53974213
push edi
push esi
sub esp, 0x1b4
mov dword [esp + 4], edx
call 0x417ec7
add al, ch
mov edi, ecx
jae 0x417ecf
pop esi
ret
jb 0x417ecf
call 0x22ab9bb
add byte [ecx], dh
fisttp dword [ecx + 0x24848dc5]
xor al, 1
add byte [eax], al
call 0x43680e
xor ebx, ebx
mov ebp, eax
lea eax, [esp + 0x134]
lea esi, [esp + 8]
lea ecx, [esp + 0x14]
mov edx, 0x4040a0
inc ebx
lock xadd dword [0x43c004], ebx
js 0x417efa
jns 0x417efa
call 0x1b98277
jns 0x417eff
js 0x417eff
call 0x4708858c
add al, 0x80
add byte [eax], al
add byte [ebx - 0x76fff79a], al
xor al, 0x24
mov dword [esi], eax
mov dword [esi + 4], 0x80
and dword [esi + 8], 0
mov dword [esp], esi
jne 0x417f14
je 0x417f14
call 0x1b7828f
ja 0x417f19
jbe 0x417f19
call 0x1b88293
jbe 0x417f1e
ja 0x417f1e
call 0x3b1b0ab
mov dword [ecx], esi
jo 0x417f25
jno 0x417f25
call 0xe1299993
and byte [eax], al
add byte [ecx + 0x66], bl
test eax, eax
push 0x1a
call fcn.0041a00c
pop ecx
test ax, ax
jne 0x417f7e
mov edx, esp
mov ecx, ebp
jge 0x417f3b
jl 0x417f3b
call 0x62ba27
add byte [esi - 0x7b], ah
sal byte [ebp + 0x39], 0x8d
dec esp
and al, 0x18
call 0x41a07a
test ax, ax
jne 0x417f7e
lea ecx, [esp + 0x18]
jno 0x417f4e
jo 0x417f4e
call 0x40823d0c
add byte [ecx + 0x7e037f31], cl
add eax, ebp
mov edx, 0x4040bd
mov dword [ecx], esi
jg 0x417f5a
jle 0x417f5a
call 0xac2980c8
and byte [eax], al
add byte [ecx + 0x66], bl
test eax, eax
push 1
call fcn.0041a00c
pop ecx
test ax, ax
jne 0x417f7e
mov edx, esp
mov ecx, ebx
ja 0x417f70
jbe 0x417f70
call 0x62855c
add byte [esi - 0x7b], ah
ror byte [edi], 0x84
cmp dword [ecx], eax
add byte [eax], al
call 0x41a07a
test ax, ax
je 0x4180b7
jbe 0x417f83
ja 0x417f83
call 0x1c08305
jle 0x417f88
jg 0x417f88
call 0x1b382ff
jae 0x417f8d
jb 0x417f8d
call 0x1bc830b
jp 0x417f92
jnp 0x417f92
call 0x1bd8313
jge 0x417f97
jl 0x417f97
call 0x3465ec28
lea ebp, [esp + 0x34]
lea esi, [esp + 0x20]
je 0x417fa4
jne 0x417fa4
call 0x1bb8323
jnp 0x417fa9
jp 0x417fa9
call 0x1b68321
je 0x417fae
jne 0x417fae
call 0xeacb713b
mov ecx, esi
mov edx, ebp
push ebx
push eax
call fcn.0040ff10
pop eax
pop ecx
jg 0x417fc0
jle 0x417fc0
call 0x83a7864f
inc esp
xor al, 0
mov eax, dword [esi]
and word [esp + eax*2 + 0x34], 0
mov eax, 0x1000
js 0x417fd2
jns 0x417fd2
call 0x40815c3e
add byte [edx], ch
push 0x403fdc
push 0
push eax
push eax
push 1
push 0
push 0x40000001
push ebp
call sub.KERNEL32.dll_CreateNamedPipeW
cmp eax, 0xffffffff
je 0x418066
mov ebx, eax
mov eax, dword [0x403fe4]
movsd xmm0, qword [0x403fdc]
lea ecx, [esp + 0x28]
jae 0x418007
jb 0x418007
call 0xf249c194
movups xmmword [ecx], xmm0
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
jns 0x418013
js 0x418013
call 0x80a98081
add byte [eax], al
add byte [edx + 3], ch
push 0
push 0x80
push 3
push ecx
push 0
push 0x40000000
push ebp
call sub.KERNEL32.dll_CreateFileW
cmp eax, 0xffffffff
je 0x418074
mov ecx, ebx
mov esi, eax
jnp 0x418038
jp 0x418038
call 0x3f4124
jmp dword [esi - 0x7b]
call 0x417dfd
test ax, ax
je 0x4180a6
mov ebp, eax
jns 0x418049
js 0x418049
call 0xe8e568a3
add dword [eax], eax
push esi
call sub.ntdll.dll_NtClose
jns 0x418054
js 0x418054
call 0x1bb83d3
jnp 0x418059
jp 0x418059
call 0xe8d568b0
add dword [eax], eax
push ebx
call sub.ntdll.dll_NtClose
jb 0x418064
jae 0x418064
call 0x229af53
add byte [eax], al
add byte [eax], al
call 0x2292f59
add bl, ch
sbb al, 0x76
add esi, dword [edi + 1]
jmp 0x418094
call 0x41806c
add al, ch
call sub.KERNEL32.dll_GetLastError
jmp 0x418090
jbe 0x418079
ja 0x418079
call 0x2292365
add byte [ebx + 3], bh
call sub.KERNEL32.dll_GetLastError
jnp 0x418083
jp 0x418083
call 0xe8ab68da
add dword [eax], eax
push ebx
call sub.ntdll.dll_NtClose
call 0x41808f
add al, ch
mov bp, 0xe
jle 0x418099
jg 0x418099
call 0xc4c36926
mov ah, 1
add byte [eax], al
mov eax, ebp
add esp, 0x1b4
pop esi
pop edi
pop ebx
pop ebp
ret
ja 0x4180ab
jbe 0x4180ab
call 0x465c53a
mov eax, dword [esp + 4]
mov dword [edi], ebx
xor ebp, ebp
mov dword [eax], esi
jmp 0x418094
lea ecx, [esp + 0x1c]
jg 0x4180c0
jle 0x4180c0
call 0x4082427e
add byte [ecx + 0x72037331], cl
add eax, ebp
mov edx, 0x4040c1
mov dword [ecx], esi
jae 0x4180cc
jb 0x4180cc
call 0x3a29823a
pop ds
add byte [eax], al
push 1
call fcn.0041a00c
pop ecx
test ax, ax
jb 0x4180dc
jae 0x4180dc
call 0x1b58455
jne 0x4180e1
je 0x4180e1
call 0x1b5845a
jne 0x4180e6
je 0x4180e6
call 0xfee305f9
invalid
jne 0x417f8d
jo 0x4180f1
jno 0x4180f1
call 0x1065dd80
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 8]
jne 0x4180fe
je 0x4180fe
call 0x1c08480
jle 0x418103
jg 0x418103
call 0xfed06a52
invalid
dec ebx
jmp 0x417f97