Function at 0x10009a8b
Capabilities:
Encode data using xor
Read pipe
Write pipe

Disassembly:
push ecx
push ecx
mov ecx, dword [esp + 0x24]
mov edx, ecx
add dword [esp + 0x20], 0xffffff3d
xor edx, 0x3aad
push ebx
mov ebx, dword [esp + 0x14]
add ecx, 0xffffc553
push ebp
mov ebp, dword [esp + 0x24]
add ebx, 0x55b
push esi
mov esi, dword [esp + 0x18]
push edi
lea edi, [ebp - 0x3f02]
mov dword [esp + 0x14], ebx
add ebx, 0xfffffe9b
mov dword [esp + 0x10], edi
xor ebp, 0x311
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], ebx
cmp edx, ebx
je 0x10009c23
lea eax, [edi + 0x3ea3]
cmp ebp, eax
jge 0x10009c0c
xor edi, edi
mov ecx, dword [0x10055f54]
mov eax, dword [ecx + 0x88]
mov ebx, dword [eax + edi]
add edi, 4
imul ebx, dword [ecx + 0x3c]
mov eax, dword [esi + 0x34]
add eax, dword [esi + 0xe0]
xor eax, dword [esi + 0xc0]
xor eax, 0x31402
mov dword [esi + 0xc0], eax
mov edx, ebx
mov ecx, dword [0x10074a98]
mov eax, dword [0x10074acc]
shr edx, 8
mov byte [ecx + eax], dl
inc dword [0x10074a98]
mov eax, dword [esi + 0xd8]
sub eax, 0x3d764
xor dword [esi + 0x50], eax
mov eax, dword [0x10055f54]
mov eax, dword [eax + 0x50]
xor eax, 0x157c02
add dword [esi + 0xf4], eax
mov eax, dword [0x10074aac]
add eax, 0xffffffed
add eax, dword [esi + 0xe0]
add dword [esi + 0xcc], eax
mov eax, dword [0x10055f54]
mov ecx, dword [eax + 0x58]
mov eax, dword [0x10074acc]
mov byte [eax + ecx], bl
mov eax, dword [0x10055f54]
inc dword [eax + 0x58]
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xc0]
sub ecx, eax
sub ecx, 0x3d5e13cc
xor ecx, eax
mov dword [esi + 0xd8], ecx
mov eax, dword [esi + 0x48]
sub eax, dword [0x10074aa0]
xor eax, 0x62841
or dword [0x10074b1c], eax
mov eax, dword [0x10074b20]
sub eax, dword [esi + 0xcc]
add eax, 0xdcf10
add dword [esi + 0x28], eax
cmp edi, 0x2bc80
jl 0x10009afb
mov eax, dword [esi + 0xe0]
xor ebp, 0x356
add eax, dword [esi + 0xcc]
mov edi, dword [esp + 0x10]
xor eax, 0xa89b
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
mov dword [esi + 0x3c], eax
jmp 0x10009c23
mov eax, dword [esi + 0xc]
imul eax, dword [0x10074a88]
cmp edi, eax
jae 0x10009c23
mov eax, dword [0x10074aa4]
sub eax, ecx
add edi, eax
cmp edi, ebx
jg 0x10009c57
xor ecx, 0x4021
cmp edi, ecx
jg 0x10009cde
mov ecx, dword [0x10055f54]
mov eax, dword [esi + 0xd8]
add eax, dword [esi + 0xb0]
xor eax, dword [ecx + 0x3c]
xor eax, 0x3f41633d
mov dword [ecx + 0x3c], eax
jmp 0x10009cde
mov eax, dword [esi + 0xd0]
mov ebx, dword [esi + 0x2c]
sub eax, 0x3ea3
cmp ebx, eax
jbe 0x10009cde
mov eax, dword [esi + 0xd8]
xor eax, dword [esi + 0x64]
cmp edi, eax
ja 0x10009cc9
mov eax, dword [esi + 0xb4]
add eax, edx
add eax, edi
push eax
mov eax, dword [esi + 0xf0]
or eax, dword [esp + 0x34]
or eax, edx
xor edx, edi
push eax
mov eax, dword [0x10055f54]
mov eax, dword [eax + 0x6c]
sub eax, dword [esi + 0x84]
push eax
mov eax, dword [esi + 0xa4]
add eax, edi
imul eax, dword [esi + 0xe8]
push eax
mov eax, dword [esi + 0xa8]
and eax, edi
push eax
mov eax, ebp
sub eax, dword [esi + 0x64]
sub eax, dword [esp + 0x28]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov ecx, dword [esi + 0xd0]
inc ebx
mov edx, dword [esp + 0x2c]
sub ecx, 0x3ea3
cmp ebx, ecx
ja 0x10009c69
pop edi
xor ebp, 0x5e8
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
pop ecx
ret