Function at 0x140003e20
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140086080]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov r14, rcx
mov edx, 1
lea rcx, [r11 - 0x58]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [rsp + 0x40], 0x18
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov esi, r12d
lea rdi, [r14 + 0xa0]
lea rbx, [r14 + 0xc8]
nop dword [rax]
mov r8d, r12d
test esi, esi
setne r8b
xor r9d, r9d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140003f9f
mov qword [rbx], rax
test esi, esi
je 0x140003f4d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x1388
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov r9d, 1
xor r8d, r8d
mov edx, 0x40000003
lea rcx, str..PipeEA2F5A1F_7EEB_4333_9727_C5DE84FC08C2
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x140003f64
lea rdx, [rbx - 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, r12d
test eax, eax
sete cl
mov dword [rbx + 0x1014], ecx
test eax, eax
je 0x140003f4d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
inc esi
add rdi, 8
add rbx, 0x1030
cmp esi, 2
jge 0x140003fdc
jmp 0x140003eb0
mov rdi, qword [0x14008a328]
test rdi, rdi
je 0x140003fdc
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], ebx
lea r8, str._ERROR___d___create_pipe_failed__err__d_._n
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rdi]
jmp 0x140003fdc
mov rdi, qword [0x14008a328]
test rdi, rdi
je 0x140003fdc
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
lea r8, str._ERROR___d___create_event__d_failed__err__d_.
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rdi]
lea r13, str.stop
nop dword [rax]
nop word [rax + rax]
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [r14 + 0xa0]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebp, eax
mov rdi, qword [0x14008a328]
test rdi, rdi
je 0x140004044
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], ebp
lea r8, str._INFO___d___event_index__d_.
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
mov rdi, qword [0x14008a328]
cmp ebp, 1
ja 0x14000432d
test ebp, ebp
je 0x140004305
imul rcx, rbp, 0x1030
lea rsi, [r14 + 0xb0]
add rsi, rcx
cmp dword [rsi + 0x102c], 0
je 0x140003ff0
mov dword [rsp + 0x58], r12d
mov r9d, 1
lea r8, [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x140004217
lea rdi, [rsi + 0x28]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.14003a810
lea r9, [rsi + 0x1028]
mov qword [rsp + 0x20], rsi
mov r8d, 0x1000
mov rdx, rdi
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400041c6
mov rbx, qword [0x14008a328]
test rbx, rbx
je 0x140004101
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov qword [rsp + 0x20], rdi
lea r8, str._INFO___d___read_data__s_
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x140004120
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140005100
nop
lea rdx, [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
cmp rsi, 0x10
cmovae rdx, rdi
cmp qword [rsp + 0x70], 4
jne 0x140004186
mov rcx, r12
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x140004179
cmp rcx, 4
jne 0x140004160
mov eax, r12d
jmp 0x14000417e
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000428e
cmp rsi, 0x10
jb 0x140003ff0
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400041b9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004390
mov rcx, rdi
call fcn.140038090
jmp 0x140003ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
je 0x140003ff0
mov rbx, qword [0x14008a328]
test rbx, rbx
je 0x14000420a
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], edi
lea r8, str._ERROR___d___read_data_failed__err__d_.
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rbx]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004250
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [0x14008a328]
test rbx, rbx
je 0x140004250
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], edi
lea r8, str._INFO___d___get_overlapped_result_failed__err__d_.
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
test edi, edi
je 0x140003ff0
cmp edi, 0x3e5
je 0x140003ff0
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rdx, rsi
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, r12d
test eax, eax
sete cl
mov dword [rsi + 0x102c], ecx
jmp 0x140003ff0
mov byte [r14 + 0x98], 0
mov rbx, qword [0x14008a328]
test rbx, rbx
je 0x1400042c8
mov rbx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], ebp
lea r8, str._INFO___d___stop_by_event__d.
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
nop
cmp rsi, 0x10
jb 0x14000435f
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400042fb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004390
mov rcx, rdi
call fcn.140038090
jmp 0x14000435f
test rdi, rdi
je 0x14000435f
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
lea r8, str._INFO___d___stop_by_event_0.
mov edx, 3
mov rcx, qword [0x14008a328]
call qword [rbx]
jmp 0x14000435f
test rdi, rdi
je 0x14000435f
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x20], ebx
lea r8, str._ERROR___d___out_of_range__err__d_.
mov edx, 1
mov rcx, qword [0x14008a328]
call qword [rdi]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140038070
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14003eae4
int3