Function at 0x1400113a2
Capabilities:
Allocate or change rwx memory
Create pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
jmp 0x140013840
push rbp
push rdi
mov eax, 0x1c08
call fcn.140011109
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x576
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140021008]
xor rax, rbp
mov qword [rbp + 0x1bc0], rax
lea rcx, [0x1400270f7]
call fcn.140011537
lea rcx, [rbp + 4]
call fcn.140011087
lea rcx, [rbp + 4]
call fcn.1400112da
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140011249
mov r8d, 0x14
mov edx, 0xc
lea rcx, [rbp + 0x13d8]
call fcn.140011118
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x13d8]
call fcn.1400110b4
mov dword [rbp + 0x13f4], eax
lea rax, [0x14001d280]
mov qword [rbp + 0x1418], rax
mov rcx, qword [rbp + 0x1418]
call fcn.140011253
inc rax
mov rcx, rax
call fcn.140011244
mov qword [rbp + 0x1b48], rax
mov rax, qword [rbp + 0x1b48]
mov qword [rbp + 0x1438], rax
mov rcx, qword [rbp + 0x1418]
call fcn.140011253
inc rax
mov r8, qword [rbp + 0x1418]
mov rdx, rax
mov rcx, qword [rbp + 0x1438]
call qword [sym.imp.ucrtbased.dll_strcpy_s]
lea rdx, str.content:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov rdx, qword [rbp + 0x1438]
mov rcx, rax
call fcn.1400110a0
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.address:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov rdx, qword [rbp + 0x1438]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
lea r8, str.mykey
mov edx, eax
mov rcx, qword [rbp + 0x1438]
call fcn.140011384
mov dword [rbp + 0x1498], 0x18
mov dword [rbp + 0x14a8], 1
mov qword [rbp + 0x14a0], 0
xor r9d, r9d
lea r8, [rbp + 0x1498]
lea rdx, [rbp + 0x1458]
lea rcx, [rbp + 0x1478]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140013a21
lea rdx, str.Error_creating_pipe
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140013ca7
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x14c4]
mov r8d, eax
mov rdx, qword [rbp + 0x1438]
mov rcx, qword [rbp + 0x1458]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
inc rax
mov rcx, rax
call fcn.140011244
mov qword [rbp + 0x1b68], rax
mov rax, qword [rbp + 0x1b68]
mov qword [rbp + 0x14e8], rax
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
inc rax
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0x14e8]
call fcn.14001140b
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1504]
mov r8d, eax
mov rdx, qword [rbp + 0x14e8]
mov rcx, qword [rbp + 0x1478]
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rdx, str.Encrypted_content:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov rdx, qword [rbp + 0x14e8]
mov rcx, rax
call fcn.1400110a0
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Encrypted_address:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov rdx, qword [rbp + 0x14e8]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
cmp eax, 1
je 0x140013bf7
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
lea r9, [rbp + 0x1524]
mov r8d, 0x40
mov rdx, rax
mov rcx, qword [rbp + 0x1438]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, str.Memory_protection_changed_to_RW.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x1438]
call fcn.140011253
lea r9, [rbp + 0x1524]
mov r8d, dword [rbp + 0x1524]
mov rdx, rax
mov rcx, qword [rbp + 0x1438]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, str.Memory_protection_changed_back_to_RX.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140013b38
mov rax, qword [rbp + 0x1438]
mov qword [rbp + 0x1b88], rax
mov rcx, qword [rbp + 0x1b88]
call fcn.14001128a
cmp qword [rbp + 0x1b88], 0
jne 0x140013c28
mov qword [rbp + 0x1bb8], 0
jmp 0x140013c41
mov qword [rbp + 0x1438], 0x8123
mov rax, qword [rbp + 0x1438]
mov qword [rbp + 0x1bb8], rax
mov rax, qword [rbp + 0x14e8]
mov qword [rbp + 0x1ba8], rax
mov rcx, qword [rbp + 0x1ba8]
call fcn.14001128a
cmp qword [rbp + 0x1ba8], 0
jne 0x140013c72
mov qword [rbp + 0x1bb8], 0
jmp 0x140013c8b
mov qword [rbp + 0x14e8], 0x8123
mov rax, qword [rbp + 0x14e8]
mov qword [rbp + 0x1bb8], rax
mov rcx, qword [rbp + 0x1478]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1458]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001cf70]
call fcn.14001146a
mov rax, rdi
mov rcx, qword [rbp + 0x1bc0]
xor rcx, rbp
call fcn.140011294
lea rsp, [rbp + 0x1bd8]
pop rdi
pop rbp
ret