Function at 0x180014cd0
Capabilities:
Connect pipe
Copy file
Create pipe

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
lea ebx, [r9 + 0x215]
mov r13d, r9d
mov rsi, r8
mov rax, rdx
mov rdi, rcx
mov r12d, r9d
cmp r9d, ebx
jae 0x180015203
movzx r15d, byte [rbp + 0x148]
lea rdx, [0x180000000]
xor edi, edi
lea r8d, [rdi + 0x69]
nop dword [rax]
cmp r12d, 0x12c
ja 0x1800151d2
je 0x180015185
lea eax, [r12 - 0x15]
cmp eax, 0xee
ja case.0x180014d65.32
movzx eax, byte [rdx + rax + 0x1555c]
mov ecx, dword [rdx + rax*4 + 0x1552c]
add rcx, rdx
jmp rcx
mov eax, dword [0x180029c0c]
mov dword [rsp + 0x49], eax
movzx eax, byte [0x180029c10]
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4e], 0
jmp case.0x180014d65.32
mov word [rsp + 0x48], 0x45
jmp case.0x180014d65.32
lea rcx, [rbp - 0x80]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180014da0
movzx eax, word [0x180029c20]
lea rdx, [0x180029c24]
mov word [rcx], ax
movzx eax, byte [0x180029c22]
mov byte [rcx + 2], al
lea rcx, [rbp - 0x76]
mov word [rbp - 0x77], r8w
mov r8d, 3
call fcn.18001d4d0
movzx eax, word [0x180029c28]
lea rdx, [0x180000000]
mov word [rbp - 0x74], ax
mov r8d, 0x69
movzx eax, byte [0x180029c2a]
mov byte [rbp - 0x72], al
jmp case.0x180014d65.32
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], rdi
mov edx, 0xb0
xor ecx, ecx
call fcn.180015650
test al, al
je 0x180014ffd
mov r8, qword [rsi + 0x20]
mov edx, 0x117
mov rcx, qword [rsi + 0x28]
call fcn.1800168c0
mov qword [0x180036b50], rax
lea rdx, [0x180000000]
mov r8d, 0x69
jmp case.0x180014d65.32
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180036b68], rax
jmp case.0x180014d65.32
mov r8d, 1
mov byte [rsp + 0x52], 0
lea rdx, [0x180029c3f]
lea rcx, [rsp + 0x52]
call fcn.18001d4d0
mov r8d, 4
mov byte [rsp + 0x53], 0
lea rdx, [0x180029c4c]
lea rcx, [rbp - 0x80]
call fcn.18001d4d0
mov eax, dword [str.4dj3]
lea rdx, [0x180000000]
mov dword [rbp - 0x7d], eax
mov r8d, 0x69
movzx eax, byte [0x180029c54]
mov byte [rbp - 0x79], al
jmp case.0x180014d65.32
movzx eax, word [0x180029c5e]
mov word [rsp + 0x4e], ax
movzx eax, byte [0x180029c60]
mov byte [rsp + 0x50], al
mov byte [rsp + 0x51], 0x66
jmp case.0x180014d65.32
mov ecx, 0x1e
mov eax, ecx
sub eax, 0x1e
je 0x180014f06
sub eax, 1
je 0x180014f59
sub eax, 1
je 0x180014f00
cmp eax, 1
je 0x18001550c
jmp 0x180014f64
mov dword [rsp + 0x40], edi
jmp 0x180014f64
xor r9d, r9d
xor edx, edx
mov rcx, rsi
lea r8d, [r9 + 0x28]
call fcn.18000d9b0
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x180036b30], rdi
je 0x180014f59
cmp rcx, 0x78
jge 0x180014f38
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor edx, edx
mov rcx, rsi
lea r8d, [r9 + 0x28]
call fcn.18000d9b0
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x180036b30], rdi
jne 0x180014f27
mov ecx, 0x1f
mov r12d, 0xa0
inc ecx
cmp ecx, 0x22
jb 0x180014ee4
cmp qword [0x180036b50], 0
je 0x180014ffd
mov r8, qword [rsi + 0x20]
mov edx, 0x117
mov rcx, qword [rsi + 0x30]
call fcn.1800168c0
mov qword [0x180036b58], rax
test rax, rax
je 0x180014ffd
mov r8, qword [rsi + 0x20]
mov edx, 0x117
mov rcx, qword [rsi + 0x38]
call fcn.1800168c0
mov qword [0x180036b60], rax
test rax, rax
jne 0x180015176
mov r14d, 0x77
cmp r14d, 0x77
je 0x18001512f
cmp r14d, 0x3e4a
je 0x180015118
cmp r14d, 0x7c1d
je 0x1800150b9
cmp r14d, 0xb9f0
je 0x180015007
cmp r14d, 0xf7c3
jne 0x18001515b
mov byte [rsp + 0x40], 0
jmp 0x18001550c
mov qword [rsp + 0x38], rdi
lea rcx, [rbp - 0x68]
mov edx, 3
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x200
mov r9d, 0xff
mov dword [rsp + 0x20], 0x200
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp rax, 0xffffffffffffffff
movzx r15d, r15b
mov rbx, rax
cmove r15d, edi
test r15b, r15b
je 0x18001515b
mov edi, 0xf3
mov ecx, edi
sub ecx, 0xf2
je 0x180015084
cmp ecx, 1
jne 0x1800150a8
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
cmp rbx, 0xffffffffffffffff
je 0x1800150a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r15b, r15b
jmp 0x1800150a8
test r15b, r15b
je 0x1800150a8
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec edi
cmp edi, 0xf1
ja 0x180015056
xor edi, edi
jmp 0x18001515b
movzx eax, word [0x180029c78]
lea rdx, [rbp - 0x57]
mov r8d, 0xa
mov word [rbp - 0x59], ax
movzx eax, byte [0x180029c7a]
mov byte [rbp - 0x57], al
lea ecx, [r8 - 5]
call fcn.18001d774
mov r8d, 0xa
lea rdx, [rbp - 0x56]
mov ecx, 0xf94
call fcn.18001d774
mov eax, dword [str._V236e]
mov r15b, 1
mov dword [rbp - 0x52], eax
movzx eax, word [0x180029c80]
mov word [rbp - 0x4e], ax
movzx eax, byte [0x180029c82]
mov byte [rbp - 0x4c], al
jmp 0x18001515b
movzx eax, word [0x180029c68]
mov word [rbp - 0x5b], ax
movzx eax, byte [0x180029c6a]
mov byte [rbp - 0x59], al
jmp 0x18001515b
movzx eax, word [0x180029c6c]
mov word [rbp - 0x68], ax
movabs rax, 0x5c657069705c2e
mov qword [rbp - 0x66], rax
mov eax, dword [str.V559]
mov dword [rbp - 0x5f], eax
movzx eax, byte [0x180029c74]
mov byte [rbp - 0x5b], al
add r14d, 0x3dd3
cmp r14d, 0x1351f
jbe 0x180014fc3
lea ebx, [r13 + 0x215]
lea rdx, [0x180000000]
mov r8d, 0x69
jmp case.0x180014d65.32
mov r8d, 2
lea rdx, [0x180029c14]
lea rcx, [rbp - 0x72]
call fcn.18001d4d0
movzx eax, word [0x180029c18]
lea rdx, [0x180029c1c]
mov r8d, 2
mov word [rbp - 0x71], ax
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x6f], 0x61384c
call fcn.18001d320
lea rdx, [0x180000000]
mov r8d, 0x69
jmp case.0x180014d65.32
cmp r12d, 0x155
jne case.0x180014d65.32
mov dword [rsp + 0x58], 0x6e75614c
mov byte [rsp + 0x5c], 0
add r12d, 0x29
cmp r12d, ebx
jb 0x180014d30
mov rdi, qword [rbp + 0x130]
mov rax, qword [rbp + 0x138]
lea ebx, [r13 + 0x8c9]
cmp r13d, ebx
jae 0x18001550c
mov r14d, 0x6f4e
lea rcx, [0x180017250]
mov r15d, 0x6269
mov r12d, 0x2069
nop dword [rax]
cmp r13d, 0x46d
ja 0x18001541a
je 0x180015407
cmp r13d, 0x266
ja 0x1800153b4
je 0x1800153a9
cmp r13d, 0x5f
je 0x180015386
cmp r13d, 0x10c
je 0x180015363
cmp r13d, 0x1b9
jne 0x1800154f5
movzx eax, word [0x180029cba]
mov word [rsp + 0x62], ax
movzx eax, byte [0x180029cbc]
mov byte [rsp + 0x64], al
mov byte [rsp + 0x65], 0
jmp 0x1800154f5
xor r14d, r14d
nop
mov edi, 0x7e
mov eax, edi
sub eax, 0x7e
je 0x1800152d4
sub eax, 0x7d
je 0x1800152c7
cmp eax, 0x7d
jne 0x180015345
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180015345
mov rcx, qword [rsi + 0x38]
lea rdx, [rsi + 0x58]
call qword [rsi + 0x30]
jmp 0x180015345
mov rcx, qword [rsi + 0x18]
lea rbx, [rsi + 0x58]
mov rdx, rbx
call qword [rsi + 0x10]
test al, al
je 0x180014ffd
cmp qword [rbx + 0x18], 0x10
jb 0x1800152f4
mov rbx, qword [rbx]
movzx eax, word [rsi + 0x78]
lea r9, [rbp + 0x148]
mov r8, qword [0x180036b28]
mov edx, 0x1f
mov rcx, rbx
mov word [rbp + 0x148], ax
call fcn.180014070
test al, al
jne case.0x180014d65.29
mov r8, qword [0x180036b28]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov qword [rsp + 0x20], r14
lea edx, [r9 + 0x54]
call fcn.180015650
test al, al
je 0x180014ffd
add edi, 0x7d
cmp edi, 0x1f5
jb 0x1800152a5
jmp 0x1800152a0
mov byte [rsp + 0x40], 1
jmp 0x18001550c
mov r8d, 2
mov word [rsp + 0x5f], 0x72
lea rdx, [0x180029ce4]
lea rcx, [rsp + 0x58]
call fcn.18001d320
jmp 0x1800154ee
mov r8d, 2
mov word [rsp + 0x5c], 0x63
lea rdx, [0x180029ccc]
lea rcx, [rsp + 0x5d]
call fcn.18001d4d0
jmp 0x1800154ee
mov word [rsp + 0x68], r14w
jmp 0x1800154f5
cmp r13d, 0x313
je 0x1800153e6
cmp r13d, 0x3c0
jne 0x1800154f5
mov r8d, 1
lea rdx, [0x180029d1c]
lea rcx, [rsp + 0x68]
call fcn.18001d320
jmp 0x1800154ee
movzx eax, word [0x180029ca2]
mov word [rsp + 0x6a], ax
movzx eax, byte [0x180029ca4]
mov byte [rsp + 0x6c], al
mov byte [rsp + 0x6d], 0
jmp 0x1800154f5
mov word [rsp + 0x6e], r15w
mov dword [rsp + 0x70], 0x7a737269
jmp 0x1800154f5
cmp r13d, 0x721
ja 0x180015492
je 0x18001546f
cmp r13d, 0x51a
je 0x180015465
cmp r13d, 0x5c7
je 0x180015450
cmp r13d, 0x674
jne 0x1800154f5
mov word [rsp + 0x77], 0x7a
jmp 0x1800154f5
mov byte [rsp + 0x74], 0x6b
mov word [rsp + 0x75], r12w
mov byte [rsp + 0x77], 0
jmp 0x1800154f5
mov byte [rsp + 0x74], 0
jmp 0x1800154f5
movzx eax, word [rax]
lea rdx, [rbp + 0x148]
mov r9, rsi
mov word [rbp + 0x148], ax
xor r8d, r8d
mov ecx, 0xd0
call fcn.180014670
jmp 0x1800154ee
cmp r13d, 0x7ce
je 0x1800154d8
cmp r13d, 0x87b
jne 0x1800154f5
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call qword [sym.imp.dbghelp.dll_FindExecutableImage]
lea rcx, [rsi + 0xa]
cmp rcx, rdi
je 0x1800154ee
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1800154cd
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
call fcn.180017d50
jmp 0x1800154ee
mov qword [rsi], rcx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [0x180017250]
mov rax, qword [rbp + 0x138]
add r13d, 0xad
cmp r13d, ebx
jb 0x180015230
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret