Function at 0x18000dcf0
Capabilities:
Create pipe
Encode data using xor
Get file size

Disassembly:
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x40
mov edi, dword [rsp + 0x90]
lea edx, [rcx - 0x117c]
mov r15d, r9d
mov dword [rsp + 0x90], edx
xor r15d, 0x1a0b
lea r13d, [r9 - 0x1a0b]
mov ebp, r9d
xor edi, 0x685
xor ebp, 0xc57
mov rbx, r8
lea eax, [r15 + 0x150d]
cmp edi, eax
jge 0x18000deb7
imul eax, dword [0x180026070], 0x13bff2
mov dword [0x180026070], eax
mov rax, qword [section..data]
add dword [rax + 0x34], 0xffe4adc1
cmp dword [r8 + 0x60], 0x14078
jne 0x18000dd84
mov rax, qword [section..data]
mov ecx, dword [r8 + 0x88]
sub ecx, dword [rax + 0x110]
or dword [r8 + 0x2c], ecx
jmp 0x18000dd9f
mov ecx, dword [r8 + 0x110]
add ecx, 0x99364
add ecx, dword [r8 + 0x100]
xor dword [r8 + 0xec], ecx
mov eax, dword [r8 + 0x98]
cmp dword [0x1800260f0], eax
je 0x18000ddc9
mov rcx, qword [section..data]
mov eax, dword [r8 + 0x110]
xor eax, dword [rcx]
add eax, 0x31f08
add dword [rcx + 0xdc], eax
mov eax, dword [r8 + 0x60]
sub eax, dword [r8 + 0x94]
sub eax, 0x1594c6a
mov dword [r8 + 0x88], eax
mov eax, dword [0x180026010]
sub eax, dword [0x1800260ec]
mov rcx, qword [section..data]
xor eax, 0xfffcf1c4
add dword [rcx + 0xec], eax
mov eax, dword [r8 + 0x94]
xor eax, dword [r8 + 0x100]
mov ecx, dword [r8 + 0x2c]
sub eax, 0x18d597
add dword [r8 + 0xec], eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x88]
add eax, 0xffebc5ba
add ecx, eax
xor dword [0x1800260fc], ecx
cmp dword [0x1800260a4], 0x7020
jae 0x18000de55
mov eax, dword [rdx + 0x88]
add eax, dword [r8 + 0x100]
mov dword [r8 + 0x74], eax
jmp 0x18000de75
mov eax, dword [rdx + 0xe0]
add eax, dword [r8 + 0xdc]
xor eax, dword [r8 + 0xec]
xor eax, 0xfbc04
mov dword [r8 + 0xec], eax
mov rcx, qword [section..data]
mov eax, dword [r8 + 0xa8]
cmp dword [rcx + 0x9c], eax
jbe 0x18000dea8
mov eax, dword [r8 + 0x98]
sub eax, dword [0x180026038]
sub eax, 0x8fc8
add dword [rcx + 0xa8], eax
jmp 0x18000e08c
xor dword [rcx + 0xec], 0xa78bc
jmp 0x18000e08c
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x108]
xor eax, 0x165c
or eax, dword [r8 + 0x28]
cmp dword [r8 + 0xd8], eax
ja 0x18000e08c
mov eax, dword [rcx + 0x48]
xor eax, dword [r8 + 0x48]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], r14
cmp ebp, eax
jbe 0x18000df54
mov r14d, r13d
mov esi, ebp
or r14d, edi
cmp ebp, r14d
jne 0x18000df54
nop
mov edx, dword [rbx + 0x110]
imul ecx, dword [0x180026058], 0xab3
sub edx, edi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbx + 8]
mov rcx, rdi
mov eax, dword [rbx + 0xfc]
or rcx, rax
xor edx, dword [rbx + 0x104]
and ecx, 0x644
xor edx, 0x117c
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc esi
cmp esi, r14d
je 0x18000df00
mov rcx, qword [section..data]
mov edx, dword [rsp + 0x90]
mov eax, dword [rbx + 0x54]
xor eax, dword [0x180026068]
and eax, dword [rcx + 0x108]
mov esi, dword [rbx + 0x50]
cmp esi, eax
jne 0x18000e07f
mov qword [rsp + 0x78], r12
mov r14d, r15d
xor r14d, edi
mov r12d, r15d
and r12d, 0x1104
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 0x74]
mov r8d, r15d
mov r10d, dword [rbx + 0x94]
and eax, edx
or eax, dword [rbx + 0xe0]
sub r10d, edi
sub r8d, dword [rbx + 0xd8]
xor ebp, eax
mov r11d, dword [rbx + 0x28]
mov r9d, dword [rbx + 0x78]
or r11d, 0x10e0
mov edx, dword [rbx + 0x98]
xor r11d, ebp
mov ecx, dword [rcx + 0x108]
xor r9d, 0x1a0b
mov qword [rsp + 0x38], r10
sub edx, ebp
mov dword [rsp + 0x30], r11d
mov eax, r13d
mov dword [rsp + 0x28], r14d
and rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [0x180026118]
mov r8d, ebp
mov ecx, dword [rbx + 0x48]
or r8d, 0x10e0
or edx, r13d
xor r8d, 0x644
xor edx, ebp
or ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenThread]
imul ecx, dword [rbx + 0x108], 0xb5d
mov edx, ebp
mov r9d, dword [rbx]
and edx, 0x10e0
mov r8d, dword [rbx + 0x54]
or r9d, r15d
xor r8d, dword [rbx + 0x28]
add edx, 0xf6e
sub ecx, r15d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [section..data]
add esi, 3
mov eax, dword [rbx + 0x54]
xor eax, dword [0x180026068]
mov edx, dword [rsp + 0x90]
and eax, dword [rcx + 0x108]
cmp esi, eax
je 0x18000df90
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov eax, dword [rsp + 0x90]
add eax, 0x644
add rsp, 0x40
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret