Function at 0x14035b2a0
Capabilities:
Create pipe
Hash data using murmur3
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x69abe755
pushf
not eax
add eax, 0xa9c9dd69
xor eax, 0xe91055c4
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xbe42bd4c
xor eax, 0xe699afa8
rol eax, 0xc7
popf
cmp eax, 4
jne 0x14035b2dd
popf
pop rax
jmp 0x14035b66e
cmp eax, 0
jne 0x14035b2ec
popf
pop rax
jmp 0x14035b427
cmp eax, 3
jne 0x14035b2fb
popf
pop rax
jmp 0x14035b5bf
cmp eax, 1
jne 0x14035b30a
popf
pop rax
jmp 0x14035b4eb
cmp eax, 0xd
jne 0x14035b319
popf
pop rax
jmp 0x14035bb86
cmp eax, 7
jne 0x14035b328
popf
pop rax
jmp 0x14035b7dc
cmp eax, 0xe
jne 0x14035b337
popf
pop rax
jmp 0x14035bc88
cmp eax, 0xb
jne 0x14035b346
popf
pop rax
jmp 0x14035ba53
cmp eax, 0xc
jne 0x14035b355
popf
pop rax
jmp 0x14035bb1b
cmp eax, 8
jne 0x14035b364
popf
pop rax
jmp 0x14035b8d6
cmp eax, 0x10
jne 0x14035b373
popf
pop rax
jmp 0x14035bdaf
cmp eax, 2
jne 0x14035b382
popf
pop rax
jmp 0x14035b55f
cmp eax, 9
jne 0x14035b391
popf
pop rax
jmp 0x14035b941
cmp eax, 0x12
jne 0x14035b3a0
popf
pop rax
jmp 0x14035beb1
cmp eax, 6
jne 0x14035b3af
popf
pop rax
jmp 0x14035b719
cmp eax, 0x11
jne 0x14035b3be
popf
pop rax
jmp 0x14035be31
cmp eax, 5
jne 0x14035b3cd
popf
pop rax
jmp 0x14035b6df
cmp eax, 0x16
jne 0x14035b3dc
popf
pop rax
jmp 0x14035c028
cmp eax, 0xa
jne 0x14035b3eb
popf
pop rax
jmp 0x14035b9e0
cmp eax, 0x14
jne 0x14035b3fa
popf
pop rax
jmp 0x14035bf9a
cmp eax, 0xf
jne 0x14035b409
popf
pop rax
jmp 0x14035bd30
cmp eax, 0x13
jne 0x14035b418
popf
pop rax
jmp 0x14035bf09
cmp eax, 0x15
jne 0x14035b427
popf
pop rax
jmp 0x14035c001
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov edi, r8d
mov r14, rcx
xor r15d, r15d
test rcx, rcx
jne 0x14035b4a5
push rax
pushf
mov eax, 0xea95f812
pushf
not eax
add eax, 0xd90e5c67
xor eax, 0xad839581
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xcdd628ec
xor eax, 0xe8bfd87a
rol eax, 0x63
popf
pushf
not eax
add eax, 0xaa30a70b
xor eax, 0xc7c87c19
rol eax, 0x21
popf
pushf
not eax
add eax, 0xc175afcf
xor eax, 0xc71ad623
rol eax, 0x7a
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xeaa88eb3
pushf
not eax
add eax, 0xebbdd1bf
xor eax, 0xbbd61c95
rol eax, 0x78
popf
pushf
not eax
add eax, 0xc1846304
xor eax, 0x9e82d0ce
rol eax, 0x74
popf
pushf
not eax
add eax, 0xb8a37440
xor eax, 0xcdf7af8b
rol eax, 0x26
popf
jmp 0x14035b2ce
call fcn.14039d39a
mov dword [rax], r15d
call fcn.1402298c4
mov dword [rax], socket
call fcn.1402a5aaf
or eax, 0xffffffff
push rax
pushf
mov eax, 0x61e1e7e3
pushf
not eax
add eax, 0xc060fd1b
xor eax, 0xaa20848b
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xea120cca
xor eax, 0xdf1a1525
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xe422b00f
xor eax, 0x84076057
rol eax, 0x19
popf
pushf
not eax
add eax, 0xeb071f61
xor eax, 0xf8c1fa79
rol eax, 0x1d
popf
jmp 0x14035b2ce
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
or ebx, 0xffffffff
mov dword [rcx + 4], ebx
mov dword [rcx], ebx
test edi, 0xffff3f7f
je 0x14035b615
push rax
pushf
mov eax, 0x6d47d13c
pushf
not eax
add eax, 0x99bed7f4
xor eax, 0xb63387cd
rol eax, 0xab
popf
pushf
not eax
add eax, 0x99e385ad
xor eax, 0xf0e91ac5
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xdaf328e9
xor eax, 0xcdf8806a
rol eax, 0x27
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xdf677566
pushf
not eax
add eax, 0xf96a4187
xor eax, 0xfce37fae
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xf3156556
xor eax, 0xdc091363
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xc70f6278
xor eax, 0xe0aa9c5c
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x803d085b
xor eax, 0xb0e6325a
rol eax, 0x42
popf
jmp 0x14035b2ce
call fcn.14039d39a
mov dword [rax], r15d
call fcn.1402298c4
mov dword [rax], socket
call fcn.1402a5aaf
push rax
pushf
mov eax, 0xe9921d5a
pushf
not eax
add eax, 0xbaffd559
xor eax, 0x9ce5023d
rol eax, 0xf
popf
pushf
not eax
add eax, 0xe83751fe
xor eax, 0x9da74b5f
rol eax, 0x91
popf
pushf
not eax
add eax, 0xe2bc2412
xor eax, 0xd1b35e85
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x98cc7d82
xor eax, 0x949612e2
rol eax, 0xb3
popf
jmp 0x14035b2ce
mov eax, ebx
jmp 0x14035b55f
mov eax, edi
mov ecx, 0xa38fc1c7
pushf
not ecx
add ecx, 0xec44dcdd
xor ecx, 0xd8eec453
rol ecx, 0xee
popf
pushf
not ecx
add ecx, 0xd256da43
xor ecx, 0xdb05362c
rol ecx, 0xf7
popf
and eax, ecx
cmp eax, ecx
je 0x14035b7a9
push rax
pushf
mov eax, 0x29c5a68d
pushf
not eax
add eax, 0xc3811bf2
xor eax, 0xba1fb73f
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xf284b615
xor eax, 0xc05ada40
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x80fae234
xor eax, 0xfca7029f
rol eax, 0x99
popf
pushf
not eax
add eax, 0xad7b984e
xor eax, 0x82b2d4d5
rol eax, 0x16
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0x5afe89c5
pushf
not eax
add eax, 0xb96c2231
xor eax, 0xce905780
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xd8b91f35
xor eax, 0xf479aa3a
rol eax, 0x1a
popf
jmp 0x14035b2ce
mov r12d, 0x2290cf99
pushf
not r12d
add r12d, 0xbc9c4bf3
xor r12d, 0xb32efc12
rol r12d, 0x4d
popf
pushf
not r12d
add r12d, 0x95ce55bc
xor r12d, 0xe5f4f097
rol r12d, 0xef
popf
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r15
mov eax, edi
shr eax, 7
not eax
and eax, 1
mov dword [rsp + 0x58], eax
mov r9d, edx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
jmp 0x14035b83f
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14035b8a2
push rax
pushf
mov eax, 0xe89bd9b8
pushf
not eax
add eax, 0xd578ae50
xor eax, 0x89a0e258
rol eax, 0xff
popf
pushf
not eax
add eax, 0x84957ce7
xor eax, 0xf016199d
rol eax, 0x18
popf
pushf
not eax
add eax, 0xa12834eb
xor eax, 0xb87a5e20
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x84de283e
xor eax, 0xa3731802
rol eax, 0x34
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xf8443792
pushf
not eax
add eax, 0xe6730e11
xor eax, 0x80db0673
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xb6a0a18f
xor eax, 0xce99ea06
rol eax, 0x7f
popf
jmp 0x14035b2ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140231f91
jmp 0x14035b6df
call fcn.14022f15e
movsxd rsi, eax
mov dword [rsp + 0xa8], esi
cmp esi, ebx
jne 0x14035b99a
push rax
pushf
mov eax, 0xecfc5a67
pushf
not eax
add eax, 0x9c6f5f5a
xor eax, 0xdb016077
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xe3c392fe
xor eax, 0xc36961f3
rol eax, 0x67
popf
pushf
not eax
add eax, 0xe8f57e11
xor eax, 0xdfc85b01
rol eax, 0xdd
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xd41c7fff
pushf
not eax
add eax, 0x9c6cf2f3
xor eax, 0xda06efbe
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xd061cf18
xor eax, 0x8e3d7460
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x8a2218c5
xor eax, 0xb509a5a2
rol eax, 0x55
popf
jmp 0x14035b2ce
call fcn.1402298c4
mov dword [rax], r12d
call fcn.14039d39a
mov dword [rax], r15d
mov rcx, qword [rsp + 0x30]
jmp 0x14035b9f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
jmp 0x14035ba02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14035b6df
mov r12, rsi
mov r13, rsi
sar r13, 6
lea rdx, [0x1b4b3c87a]
pushf
sub rdx, 0x74a0f6aa
popf
mov rax, rsi
and eax, 0x3f
lea rcx, [rax + rax*8]
mov qword [rsp + 0x40], rcx
mov rax, qword [rdx + r13*8]
mov byte [rax + rcx*8 + 0x38], 0x89
mov rax, qword [rdx + r13*8]
mov byte [rax + rcx*8 + 0x39], r15b
mov rax, qword [rdx + r13*8]
and byte [rax + rcx*8 + 0x3d], 0xfe
mov ecx, esi
call fcn.1403ab598
call fcn.14022f15e
movsxd r15, eax
mov dword [rsp + 0xa8], r15d
cmp r15d, ebx
jne 0x14035bae8
push rax
pushf
mov eax, 0xb8032e78
pushf
not eax
add eax, 0xca695dc0
xor eax, 0x8c144b68
rol eax, 0x95
popf
pushf
not eax
add eax, 0x91de1e91
xor eax, 0x8bea5045
rol eax, 0x83
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0x718159e0
pushf
not eax
add eax, 0x98e6ef35
xor eax, 0xe31dd09f
rol eax, 0x32
popf
pushf
not eax
add eax, 0xe8d2fa28
xor eax, 0xd2e3e846
rol eax, 0x4a
popf
jmp 0x14035b2ce
lea rcx, [0x1b9a7ba23]
pushf
sub rcx, 0x7994e853
popf
mov rax, qword [rcx + r13*8]
mov rcx, qword [rsp + 0x40]
mov byte [rax + rcx*8 + 0x38], 0
call fcn.1402298c4
mov dword [rax], 0x18
call fcn.14039d39a
and dword [rax], 0
jmp 0x14035b9f0
mov rax, r15
mov r13, r15
sar r13, 6
and eax, 0x3f
lea rbx, [rax + rax*8]
lea rcx, [0x183237cf3]
pushf
sub rcx, 0x4310ab23
popf
mov rax, qword [rcx + r13*8]
mov byte [rax + rbx*8 + 0x38], 0x89
mov rax, qword [rcx + r13*8]
mov byte [rax + rbx*8 + 0x39], 0
mov rax, qword [rcx + r13*8]
and byte [rax + rbx*8 + 0x3d], 0xfe
mov ecx, r15d
call fcn.1403ab598
and dword [rsp + 0x90], 0
lea rcx, [rsp + 0x90]
call fcn.1402d486c
test eax, eax
jne 0x14035bc42
push rax
pushf
mov eax, 0x20b5ef93
pushf
not eax
add eax, 0xdfa9995c
xor eax, 0xd1f6f55b
rol eax, 0x45
popf
pushf
not eax
add eax, 0xe52f4546
xor eax, 0xbe03b042
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xcfa9d923
xor eax, 0xc07e7a32
rol eax, 0xa
popf
pushf
not eax
add eax, 0xd442b993
xor eax, 0xf5b9700d
rol eax, 0x38
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xa7b31b2c
pushf
not eax
add eax, 0xb1376e85
xor eax, 0xf05c1621
rol eax, 0x71
popf
pushf
not eax
add eax, 0xe442cfae
xor eax, 0xaf110090
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xa231657a
xor eax, 0xa673a6ae
rol eax, 0xd
popf
jmp 0x14035b2ce
mov eax, 0x5fb5dad2
pushf
not eax
add eax, 0xe028b9bd
xor eax, 0xaedb5794
rol eax, 0x28
popf
pushf
not eax
add eax, 0xa7d2488a
xor eax, 0xfe4cca5b
rol eax, 0xdd
popf
test eax, edi
jne 0x14035bcfd
push rax
pushf
mov eax, 0xe8468227
pushf
not eax
add eax, 0xbbbe80b8
xor eax, 0xdc6f62c0
rol eax, 0x55
popf
pushf
not eax
add eax, 0xf2ee9122
xor eax, 0xd9ef9a7a
rol eax, 0xef
popf
pushf
not eax
add eax, 0x8815f41e
xor eax, 0xedd49b9c
rol eax, 0x90
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0x812b63e0
pushf
not eax
add eax, 0x8bd42843
xor eax, 0xa40c3126
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xdaa84e6c
xor eax, 0xb5332281
rol eax, 0x5a
popf
jmp 0x14035b2ce
bt edi, 0xe
jb 0x14035bd7c
push rax
pushf
mov eax, 0x65ad66ab
pushf
not eax
add eax, 0xe23f96dd
xor eax, 0xf466f28f
rol eax, 0xba
popf
pushf
not eax
add eax, 0xf325db0a
xor eax, 0xfa635767
rol eax, 0x22
popf
pushf
not eax
add eax, 0xb695a208
xor eax, 0xa1105fa7
rol eax, 0xa9
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0x9ae958c0
pushf
not eax
add eax, 0xc81c8c03
xor eax, 0xea7fa8c7
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x9c591ba6
xor eax, 0xb896cde3
rol eax, 0x2f
popf
jmp 0x14035b2ce
cmp dword [rsp + 0x90], eax
jne 0x14035bdfe
push rax
pushf
mov eax, 0x7d5e21a0
pushf
not eax
add eax, 0xb44ad4f5
xor eax, 0xc262b89d
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x90c18528
xor eax, 0xda93802d
rol eax, 6
popf
pushf
not eax
add eax, 0xb66c5194
xor eax, 0xd2cf986d
rol eax, 0x31
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0xc2ef097c
pushf
not eax
add eax, 0x8b0f8d5c
xor eax, 0xf0d352d3
rol eax, 0x89
popf
pushf
not eax
add eax, 0xdcdbad20
xor eax, 0xe73994ae
rol eax, 0xe8
popf
jmp 0x14035b2ce
mov rdx, r12
sar rdx, 6
mov rax, r12
and eax, 0x3f
lea rcx, [rax + rax*8]
lea r8, [0x1b1ff0e17]
pushf
sub r8, 0x71ec3c47
popf
mov rax, qword [r8 + rdx*8]
and byte [rax + rcx*8 + 0x38], 0x7f
mov rax, qword [r8 + r13*8]
and byte [rax + rbx*8 + 0x38], 0x7f
jmp 0x14035bf09
lea r8, [0x1ada020b8]
pushf
sub r8, 0x6d8d4ee8
popf
push rax
pushf
mov eax, 0xbbaf56f7
pushf
not eax
add eax, 0xae732b41
xor eax, 0xb1605e3b
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xa1ab1f66
xor eax, 0xad0ab5f0
rol eax, 0x50
popf
pushf
not eax
add eax, 0x811df403
xor eax, 0xadcf2381
rol eax, 0xe1
popf
jmp 0x14035b2ce
test dil, dil
jns 0x14035bf67
push rax
pushf
mov eax, 0xb5e39038
pushf
not eax
add eax, 0x8a0c3365
xor eax, 0x9a75be6d
rol eax, 0x68
popf
pushf
not eax
add eax, 0xcc750f1b
xor eax, 0xea52ae03
rol eax, 0x13
popf
pushf
not eax
add eax, 0x92d0cf82
xor eax, 0xe3fd3696
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xca187d6b
xor eax, 0xa6ae18fa
rol eax, 0xb
popf
jmp 0x14035b2ce
push rax
pushf
mov eax, 0x2f426262
pushf
not eax
add eax, 0xeecc7d2a
xor eax, 0xffff69b5
rol eax, 0x27
popf
pushf
not eax
add eax, 0xf5282fdf
xor eax, 0xaf6e76be
rol eax, 0x28
popf
jmp 0x14035b2ce
mov rax, r12
sar rax, 6
and r12d, 0x3f
lea rcx, [r12 + r12*8]
mov rax, qword [r8 + rax*8]
or byte [rax + rcx*8 + 0x38], 0x10
mov rax, qword [r8 + r13*8]
or byte [rax + rbx*8 + 0x38], 0x10
push rax
pushf
mov eax, 0xcdbcc1d9
pushf
not eax
add eax, 0xafe4c960
xor eax, 0xcc3478bb
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x818afa7f
xor eax, 0x929fe117
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x89f63b6c
xor eax, 0xf03277fc
rol eax, 0xa3
popf
jmp 0x14035b2ce
mov rdx, qword [rsp + 0x30]
mov ecx, esi
call fcn.14039e719
mov rdx, qword [rsp + 0x38]
mov ecx, r15d
call fcn.14039e719
mov dword [r14], esi
mov dword [r14 + 4], r15d
xor eax, eax
jmp 0x14035b55f
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14029db6b
nop