Function at 0x140009a00
Capabilities:
Connect pipe
Create pipe

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, rax
mov qword [rbp + 0x60], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x140009ad7
xor r9d, r9d
or r8, rax
lea rdx, str.Failed_to_create_connection
lea rcx, [rsp + 0x78]
call fcn.140010e50
nop
lea rax, vtable.RSException.0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x58], rax
xor edi, edi
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
or r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400108c0
nop
lea rax, vtable.CMessageException.0
mov qword [rsp + 0x40], rax
lea rdx, [0x14001c6a0]
lea rcx, [rsp + 0x40]
call sub.MSVCR100.dll__CxxThrowException
nop
lea rcx, [rbp - 0x10]
call fcn.140012fb0
mov r13, rax
lea rax, vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r13
xor edi, edi
nop word [rax + rax]
mov dword [rsp + 0x78], edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rdi
or r8, 0xffffffffffffffff
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x78]
call fcn.1400108c0
nop
lea rcx, [rsp + 0x78]
call fcn.140010200
nop
lea rcx, [rsp + 0x78]
call fcn.140010200
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov edx, 0x40000003
mov r9d, 0xff
mov r8d, 6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi + 0x78], rax
mov rax, qword [rbp - 0x68]
mov rcx, rdi
mov qword [rbp - 0x68], rcx
test rax, rax
je 0x140009b98
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_]
mov r11, qword [rbp - 0x78]
mov rcx, rdi
mov qword [rbp - 0x78], rcx
test r11, r11
je 0x140009bbb
mov rcx, r11
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_]
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rcx, [rsp + 0x78]
cmp qword [rsi + 0x78], r8
je 0x140009d22
lea rdx, [0x140016f20]
call fcn.140010e50
lea rcx, [rsi + 0x40]
lea r8, [rbp + 0x58]
mov rdx, rax
call fcn.140012760
lea rdx, [rbp - 0x48]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov r8d, dword [rbp + 0x58]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi + 0x70], rax
mov qword [rbp - 0x50], rax
cmp r12d, 0x217
je 0x140009c94
cmp r12d, 0x3e5
jne 0x140009ca5
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140009c57
dec eax
je 0x140009c77
jmp 0x140009b00
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov rdx, qword [rsi + 0x78]
mov rcx, rsi
call qword [rax + 8]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x140009b00
test r13, r13
je 0x140009c86
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009d93
mov rax, qword [rsi]
mov r8, qword [rsi + 8]
mov rdx, qword [rsi + 0x78]
mov rcx, rsi
call qword [rax + 8]
xor r9d, r9d
or r8, 0xffffffffffffffff
lea rdx, str.Failed_to_create_connection
lea rcx, [rsp + 0x78]
call fcn.140010e50
nop
lea rax, vtable.RSException.0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x68], rax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400108c0
nop
lea rax, vtable.CMessageException.0
mov qword [rsp + 0x40], rax
lea rdx, [0x14001c6a0]
lea rcx, [rsp + 0x40]
call sub.MSVCR100.dll__CxxThrowException
nop
lea rdx, str.Failed_to_create_connection
call fcn.140010e50
nop
lea rax, vtable.RSException.0
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x68], rax
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
or r8, 0xffffffffffffffff
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400108c0
nop
lea rax, vtable.CMessageException.0
mov qword [rsp + 0x40], rax
lea rdx, [0x14001c6a0]
lea rcx, [rsp + 0x40]
call sub.MSVCR100.dll__CxxThrowException
nop
add rsp, 0x110
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret