Function at 0x402360
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 3
pop esi
cmp dword [ebp + 8], esi
jl 0x4025c1
xor eax, eax
xor edx, edx
inc edx
mov dword [ebp - 0x34], eax
xor edi, edi
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x30], al
cmp dword [ebp + 8], esi
jle 0x40249b
mov eax, dword [ebx + esi*4]
mov ecx, str._AutoExit
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4023cc
test dx, dx
je 0x4023c5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4023cc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4023a3
xor edx, edx
mov eax, edi
inc edx
jmp 0x4023d3
sbb eax, eax
xor edx, edx
inc edx
or eax, edx
mov ecx, dword [ebp - 0x2c]
test eax, eax
push 0xe
movzx ecx, cl
cmove ecx, edx
push str._RootProcessId:
push dword [ebx + esi*4]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x30], cl
call fcn.0040afd9
add esp, 0xc
test eax, eax
jne 0x402448
mov eax, dword [ebx + esi*4]
lea ecx, [ebp - 0x14]
push edi
add eax, 0x1e
push ecx
push eax
call fcn.0040b621
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov edi, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x34]
jne 0x402416
sub ecx, edx
sar ecx, 1
jne 0x4025c1
push edi
xor edi, edi
push edi
push 0x101000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x424614], eax
test eax, eax
je 0x4025c1
mov eax, dword [ebx + esi*4]
mov ecx, str._Minimize
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402479
test dx, dx
je 0x402472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402479
add eax, 4
add ecx, 4
test dx, dx
jne 0x402450
xor edx, edx
mov ecx, edi
inc edx
jmp 0x402480
sbb ecx, ecx
xor edx, edx
inc edx
or ecx, edx
movzx eax, byte [0x42455a]
test ecx, ecx
cmove eax, edx
inc esi
mov byte [0x42455a], al
cmp esi, dword [ebp + 8]
jl 0x40239b
push edx
push 0x402348
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push dword [ebx + 8]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edi, eax
test edi, edi
je 0x4025c1
lea ecx, [ebp - 0x10]
call fcn.004021cd
test eax, eax
je 0x4025c1
lea eax, [ebp - 0x10]
xor edx, edx
push eax
xor eax, eax
inc edx
push eax
mov eax, 0x1000
push eax
push eax
push edx
push 0xe
push 0x40000003
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4025c1
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x4025c1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4025c1
xor edi, edi
push 0x20000
inc edi
push edi
call fcn.0040abde
push eax
call fcn.0040b893
pop ecx
pop ecx
push eax
call fcn.0040b6a4
pop ecx
pop ecx
push eax
push edi
mov dword [0x424610], eax
call fcn.0040abde
push eax
call fcn.0040b893
pop ecx
pop ecx
push eax
call fcn.0040b6a4
pop ecx
pop ecx
xor eax, eax
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
test edi, edi
jne 0x4025ee
mov eax, 0x80004005
jmp 0x4025c4
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
push edi
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x4025d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x4025d3
cmp eax, 0x3e5
jne 0x4025c4
push dword [ebp - 0x30]
mov edx, ebx
mov ecx, edi
push esi
call fcn.00402022
test eax, eax
jne 0x4025ee
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004037b9
leave
ret
mov edx, edi
mov ecx, esi
call fcn.00401e47
test eax, eax
je 0x4025c1
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push esi
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
cmp byte [0x424559], 0
je 0x402576
xor eax, eax
jmp 0x4025c4