Function at 0x1400de9d0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push r13
push r14
sub rsp, 0x508
mov rax, qword [0x1401f22c8]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x1401f39e8]
xor r13d, r13d
test rcx, rcx
lea r14d, [r13 + 1]
je 0x1400dea37
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 4
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov qword [rsp + 0x520], rbx
call fcn.1400c7a00
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x78], r14d
call fcn.1400dbe80
test rax, rax
mov qword [rsp + 0x70], rax
je 0x1400df605
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x4f8], r12
or r12, 0xffffffffffffffff
call fcn.1401617b0
mov rdx, qword [0x1401f39f0]
test rdx, rdx
je 0x1400deaa0
lea rcx, [rsp + 0x2c0]
call fcn.140167a80
jmp 0x1400deb09
lea rcx, [rsp + 0xb0]
call fcn.1401617b0
lea rdx, str..PIPEEverything_Service
lea rcx, [rsp + 0xb0]
call fcn.1401624e0
call fcn.1400bd380
test rax, rax
je 0x1400deae7
call fcn.1400bd380
lea rdx, str.___s_
lea rcx, [rsp + 0xb0]
mov r8, rax
call fcn.140163070
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x2c0]
call fcn.140167a80
lea rcx, [rsp + 0xb0]
call fcn.140001150
mov rdx, qword [rsp + 0x2c8]
lea rcx, str.createnamedpipe__S_n
call fcn.1400b1c70
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b1c70
mov rcx, qword [0x1401f39e0]
call fcn.1400c7a50
test eax, eax
jne 0x1400df5e5
mov qword [rsp + 0x528], rbp
mov qword [rsp + 0x530], rsi
mov qword [rsp + 0x500], rdi
mov qword [rsp + 0x4f0], r15
mov r15d, 0x3e8
nop
nop
lea rcx, [0x1401f3988]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x1401f39b0]
test r11, r11
mov rbp, r11
je 0x1400def58
mov rax, qword [r11]
mov rcx, qword [0x1401f39b8]
test rax, rax
mov qword [0x1401f39b0], rax
cmove rcx, r13
mov qword [0x1401f39b8], rcx
lea rcx, [0x1401f3988]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rbp + 8]
lea rcx, str.device_event__08x_n
call fcn.1400b1c70
mov r11d, dword [rbp + 8]
sub r11d, 0x8001
je 0x1400def18
sub r11d, r14d
je 0x1400dee4e
sub r11d, r14d
je 0x1400dee20
sub r11d, r14d
je 0x1400ded35
cmp r11d, 2
jne 0x1400def27
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400def27
lea r8d, [r11 + 0xe]
lea rdx, [0x14019ade0]
add rcx, 0x20
call fcn.1400ca290
test eax, eax
je 0x1400dec51
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_n
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
call fcn.1400dcb10
jmp 0x1400def27
mov rcx, qword [rbp + 0x10]
lea rdx, [0x14019adf0]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400ca290
test eax, eax
je 0x1400dec89
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_FAILED_n
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
call fcn.1400dccd0
jmp 0x1400def27
mov rcx, qword [rbp + 0x10]
lea rdx, [0x14019ae10]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400ca290
test eax, eax
je 0x1400decc1
lea rcx, str.GUID_IO_VOLUME_LOCK_n
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
call fcn.1400dcb10
jmp 0x1400def27
mov rcx, qword [rbp + 0x10]
lea rdx, [0x14019ae20]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400ca290
test eax, eax
je 0x1400decf9
lea rcx, str.GUID_IO_VOLUME_LOCK_FAILED_n
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
call fcn.1400dccd0
jmp 0x1400def27
mov rcx, qword [rbp + 0x10]
lea rdx, [0x14019ae30]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400ca290
test eax, eax
je 0x1400def27
lea rcx, str.GUID_IO_VOLUME_UNLOCK_n
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
call fcn.1400dccd0
jmp 0x1400def27
mov rsi, qword [rbp + 0x10]
cmp dword [rsi + 4], 6
jne 0x1400def27
mov rdx, qword [rsi + 0x10]
lea rcx, str.monitor_unregister_device_notification_by_handle__p_n
call fcn.1400b1c70
mov r11, qword [0x1401f39c0]
test r11, r11
je 0x1400def27
nop
nop
nop
nop
mov edx, dword [r11 + 0xa8]
mov ecx, r13d
test edx, edx
je 0x1400deda4
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x78], r8
je 0x1400dede4
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400ded90
mov edx, dword [r11 + 0xb8]
mov ecx, r13d
test edx, edx
je 0x1400dedd7
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x80], r8
je 0x1400dedff
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400dedc0
mov r11, qword [r11]
test r11, r11
jne 0x1400ded70
jmp 0x1400def27
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x1400def27
call fcn.1400c7d50
mov qword [rdi + 0x78], r13
jmp 0x1400def27
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x1400def27
call fcn.1400c7d50
mov qword [rdi + 0x80], r13
jmp 0x1400def27
mov rax, qword [rbp + 0x10]
lea rcx, str.dbch_devicetype__d__dbch_size__d_n
mov r8d, dword [rax]
mov edx, dword [rax + 4]
call fcn.1400b1c70
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400def27
call fcn.1400dcb10
jmp 0x1400def27
mov rdi, qword [rbp + 0x10]
cmp dword [rdi + 4], 6
jne 0x1400def27
mov rdx, qword [rdi + 0x10]
lea rcx, str.restart_monitor_by_handle__p_n
call fcn.1400b1c70
mov r11, qword [0x1401f39c0]
test r11, r11
je 0x1400def27
nop
mov r8d, dword [r11 + 0xa8]
mov ecx, r13d
test r8d, r8d
je 0x1400deeb5
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x78], r9
je 0x1400deef2
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400deea0
mov r8d, dword [r11 + 0xb8]
mov ecx, r13d
test r8d, r8d
je 0x1400deee8
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x80], r9
je 0x1400def05
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400deed0
mov r11, qword [r11]
test r11, r11
jne 0x1400dee80
jmp 0x1400def27
mov rcx, qword [0x1401f39d8]
mov dword [rdx + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400def27
mov rcx, qword [0x1401f39d8]
mov dword [rdx + 0x58], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400def27
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400def27
call fcn.1400dcb10
mov rcx, qword [rbp + 0x10]
call fcn.1400be6d0
mov rcx, rbp
call fcn.1400be6d0
lea rcx, [0x1401f3988]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x1401f39b0]
test r11, r11
mov rbp, r11
jne 0x1400deba0
lea rcx, [0x1401f3988]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [rsp + 0x2b0]
cmp r11d, 0x40
jae 0x1400def8c
mov rax, qword [0x1401f39d8]
mov qword [rsp + r11*8 + 0xb0], rax
add dword [rsp + 0x2b0], r14d
jmp 0x1400def94
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
jne 0x1400df1eb
cmp dword [0x1401f37d4], 6
jb 0x1400defe3
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
lea r8d, [r12 + 9]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov edx, 0x40000003
mov r9d, 0xff
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
jmp 0x1400df01b
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
cmp r12, 0xffffffffffffffff
je 0x1400df348
lea rcx, str.connect..._n
call fcn.1400b1c70
lea rdx, [rsp + 0x88]
mov rcx, r12
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0x9c], r13d
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400df10f
mov ecx, 0x110
call fcn.1400be650
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.140193570
mov qword [rdi + 0x50], r12
call fcn.1400c7a00
mov qword [rdi + 0x28], rax
call fcn.1400c7a00
mov ecx, dword [0x1401f39d4]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x1401f39c0], r13
mov dword [0x1401f39d4], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400df0c3
mov rax, qword [0x1401f39c8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400df0ce
mov qword [0x1401f39c0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x1401f39d0], r14d
mov qword [0x1401f39c8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400df0ed
call fcn.1400be6d0
mov ecx, 4
call fcn.1400be650
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
jmp 0x1400df1eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1400df1d9
mov ecx, 0x110
call fcn.1400be650
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.140193570
mov qword [rdi + 0x50], r12
call fcn.1400c7a00
mov qword [rdi + 0x28], rax
call fcn.1400c7a00
mov ecx, dword [0x1401f39d4]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x1401f39c0], r13
mov dword [0x1401f39d4], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400df189
mov rax, qword [0x1401f39c8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400df194
mov qword [0x1401f39c0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x1401f39d0], r14d
mov qword [0x1401f39c8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400df1b3
call fcn.1400be6d0
mov ecx, 4
call fcn.1400be650
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400def94
cmp eax, 0x218
je 0x1400df1eb
cmp eax, 0x3e5
jne 0x1400df317
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400df2d4
lea rcx, str.connected_n
call fcn.1400b1c70
mov ecx, 0x110
call fcn.1400be650
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.140193570
mov qword [rdi + 0x50], r12
call fcn.1400c7a00
mov qword [rdi + 0x28], rax
call fcn.1400c7a00
mov ecx, dword [0x1401f39d4]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x1401f39c0], r13
mov dword [0x1401f39d4], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400df284
mov rax, qword [0x1401f39c8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400df28f
mov qword [0x1401f39c0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x1401f39d0], r14d
mov qword [0x1401f39c8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400df2ae
call fcn.1400be6d0
mov ecx, 4
call fcn.1400be650
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400def94
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400df303
mov rax, qword [rsp + 0xa0]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400df30b
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
je 0x1400def94
jmp 0x1400df36a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.connect_named_pipe_failed__d_n
mov edx, eax
call fcn.1400b1c70
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
or r12, 0xffffffffffffffff
jmp 0x1400df36a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_createnamedpipe__d_n
mov edx, eax
call fcn.1400b1c70
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
mov rdi, qword [0x1401f39c0]
test rdi, rdi
je 0x1400df535
nop
nop
mov edx, dword [rdi + 0x58]
mov rbx, qword [rdi]
lea rcx, str.update_client__d_n
call fcn.1400b1c70
mov rcx, rdi
call fcn.1400dbfc0
mov rcx, rdi
call fcn.1400dde60
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400ddff0
cmp dword [rdi + 0x5c], r13d
je 0x1400df3d8
mov edx, dword [rdi + 0x58]
lea rcx, str._d:_disconnected._n
call fcn.1400b1c70
mov rcx, rdi
call fcn.1400de620
mov edx, dword [rsp + 0x2b0]
jmp 0x1400df525
cmp qword [rdi + 0x80], r13
je 0x1400df42e
cmp dword [rdi + 0x90], r13d
je 0x1400df42e
mov edx, dword [rdi + 0x58]
lea rcx, str.client__d_write_pending_n
call fcn.1400b1c70
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400df424
mov rax, qword [rdi + 0x48]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400df435
mov dword [rsp + 0x2b4], r14d
jmp 0x1400df435
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400df45b
mov rax, qword [rdi + 0x28]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400df463
mov dword [rsp + 0x2b4], r14d
cmp dword [rdi + 0xa8], r13d
mov r9d, r13d
jbe 0x1400df4c4
mov r8, r13
mov rax, qword [rdi + 0xa0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x80], 2
jne 0x1400df4b4
cmp edx, 0x40
jae 0x1400df4ac
mov rax, qword [rax + 0x70]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400df4b4
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xa8]
jb 0x1400df472
cmp dword [rdi + 0xb8], r13d
mov r9d, r13d
jbe 0x1400df525
mov r8, r13
mov rax, qword [rdi + 0xb0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x88], 2
jne 0x1400df515
cmp edx, 0x40
jae 0x1400df50d
mov rax, qword [rax + 0x78]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400df515
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xb8]
jb 0x1400df4d3
test rbx, rbx
mov rdi, rbx
jne 0x1400df380
mov ebx, dword [rsp + 0x40]
cmp dword [rsp + 0x2b4], r13d
lea rcx, str.sleep__d__d_n
cmovne ebx, r14d
mov r8d, ebx
call fcn.1400b1c70
mov ecx, dword [rsp + 0x2b0]
or r9d, 0xffffffff
test ebx, ebx
lea rdx, [rsp + 0xb0]
cmovne r9d, r15d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [0x1401f39d8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b1c70
mov rcx, qword [0x1401f39e0]
call fcn.1400c7a50
test eax, eax
je 0x1400deb80
cmp r12, 0xffffffffffffffff
mov r15, qword [rsp + 0x4f0]
mov rdi, qword [rsp + 0x500]
mov rsi, qword [rsp + 0x530]
mov rbp, qword [rsp + 0x528]
je 0x1400df5e5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x2c0]
call fcn.140001150
mov r12, qword [rsp + 0x4f8]
mov rcx, qword [0x1401f39e8]
test rcx, rcx
je 0x1400df648
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x1401f39c0]
test rcx, rcx
je 0x1400df664
mov rbx, qword [rcx]
call fcn.1400de620
test rbx, rbx
mov rcx, rbx
jne 0x1400df654
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401f39e8]
mov rbx, qword [rsp + 0x520]
test rcx, rcx
je 0x1400df6ba
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1401931f0
add rsp, 0x508
pop r14
pop r13
ret