Function at 0x18000a358
Capabilities:
Create pipe
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xd8]
lea edi, [r9 + 0x86]
mov r9d, dword [rsp + 0xe0]
lea r13d, [rdx + 0x239]
mov ebp, dword [rsp + 0xb0]
lea eax, [r13 - 0x15f]
add r9d, 0xc1
lea r10d, [rdx + 0x51e]
add ebx, 0xde
mov dword [rsp + 0xd8], r10d
add ebp, 0xfffffe4f
mov dword [rsp + 0xe0], r9d
lea r12d, [rdx - 0x3a44]
mov esi, edx
mov dword [rsp + 0x98], r12d
lea r15d, [r8 - 0x3b1e]
cmp edx, eax
jge 0x18000aac6
mov r14, qword [rsp + 0xd0]
lea eax, [rbx + 0x131]
cmp edi, eax
jge 0x18000a476
lea eax, [r13 + 0x2e5]
cmp edi, eax
jge 0x18000a476
lea eax, [r13 - 0x10a]
cmp r12d, eax
jg 0x18000a431
add r15d, 0x3ed6
mov dword [r14 + 0xf8], 0xb63e
mov dword [r14 + 0x108], 0x3e383021
jmp 0x18000a476
mov rdx, qword [r14 + 0x128]
movsxd r8, dword [r14 + 0x1b0]
movsxd rax, ebp
xor rdx, rax
cmp r8, rdx
jae 0x18000a476
mov ecx, dword [r14 + 0x80]
or ecx, r13d
xor ecx, 0x3a6e
mov eax, dword [r14 + 0x150]
add r8d, 2
xor eax, r15d
sub esi, ecx
imul r15d, eax
movsxd rax, r8d
cmp rax, rdx
jb 0x18000a45a
lea eax, [rsi + 0x2a]
cmp r13d, eax
jle 0x18000a94c
and dword [r14 + 0x198], 0
mov rax, qword [r14 + 0x1c8]
imul edx, dword [rax + 0xd8], 0x89ce5232
mov rax, qword [r14 + 0x30]
mov ecx, dword [rax + 0x1b8]
xor ecx, 0x690
cmp ecx, edx
jbe 0x18000a4c2
mov eax, 0x3afd
sub rax, qword [r14 + 0x110]
add qword [r14 + 0x1e0], rax
mov edx, dword [r14 + 0xf8]
mov r12d, 0x3b73
cmp edx, dword [r14 + 0x108]
ja 0x18000a566
lea ebx, [r12 - 0x55]
mov eax, edx
mov r9d, ebx
imul eax, edx
add dword [r14 + 0x198], eax
mov rax, qword [r14 + 0x30]
or qword [rax + 0xa8], r12
add qword [r14 + 0xb0], 0xfffffffff14a0805
mov r10, qword [r14 + 0x30]
imul eax, dword [r10 + 0x120], 0x6505a4ab
cmp eax, ebx
jbe 0x18000a54b
imul r11, qword [r14 + 0x110], 0x3b1e
mov r8, qword [r14 + 0x1e0]
add r8, r11
inc r9d
mov qword [r14 + 0x1e0], r8
imul ecx, dword [r10 + 0x120], 0x6505a4ab
movsxd rax, r9d
cmp rax, rcx
jb 0x18000a52b
inc edx
cmp edx, dword [r14 + 0x108]
jbe 0x18000a4e1
mov r10d, dword [rsp + 0xd8]
mov r9d, dword [rsp + 0xe0]
mov rax, qword [r14 + 0x1c0]
mov rcx, qword [rax + 0x110]
mov rax, qword [r14]
or rcx, 0x3f62
xor qword [r14 + 0x100], rcx
mov ecx, dword [rax + 0x1b8]
mov eax, 0x3a44
sub ecx, 0x239
cmp ecx, eax
je 0x18000a5b9
mov rdx, qword [r14 + 0x30]
sub eax, ecx
mov ecx, eax
mov rax, qword [rdx + 0x128]
or rax, r12
mov qword [r14 + 0x110], rax
sub rcx, 1
jne 0x18000a5a2
mov r8d, dword [rsp + 0xd8]
lea edx, [r10 - 0x465]
mov r10d, dword [rsp + 0x98]
lea r11d, [rdi + 0x15f]
lea ebp, [r9 - 0xde]
add r10d, 0x3aed
lea eax, [r15 - 0x3e9]
add edi, 0xffffffd9
mov dword [rsp + 0x58], eax
lea ebx, [r15 + 0x34]
mov dword [rsp + 0x50], edx
lea r9d, [r15 - 0x259]
mov dword [rsp + 0x48], r10d
lea ecx, [r13 + 0x259]
mov dword [rsp + 0x40], r11d
add esi, 0xb9
mov dword [rsp + 0x38], ebx
add r8d, 0xfffffdac
mov dword [rsp + 0x30], edi
mov rdx, r14
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.180002c24
mov dword [r14 + 0x118], 0xdb0a3999
sub r13d, 0x20f
mov rax, qword [r14 + 0x1c0]
mov ecx, dword [rax + 0x1b8]
sub ecx, 0x15f
cmp ecx, 0x3b4c
jbe 0x18000a67b
mov rax, qword [r14 + 0x168]
lea rax, [rax*2 + 0x3afd]
mov qword [r14 + 0x168], rax
mov rdx, qword [r14 + 0x1e0]
cmp rdx, qword [r14 + 0x1c8]
jb 0x18000a696
lea rax, [r14 + 0x120]
or qword [r14 + 0x40], rax
mov rax, qword [r14 + 0x80]
mov ecx, dword [rax + 0xe8]
add ecx, 0x41d
cmp ecx, 0x3ed6
jae 0x18000a6c6
mov rax, qword [r14 + 0x18]
sub rax, 0x3b5d
imul rax, rdx
mov qword [r14 + 0x1e0], rax
mov rax, qword [r14 + 0xd0]
mov ebp, 0x3d0e
imul ecx, dword [rax + 0xe8], 0x3a699728
mov dword [r14 + 0x17c], ecx
cmp qword [r14 + 0x168], r12
ja 0x18000a704
mov rax, qword [r14 + 0x80]
mov rcx, qword [rax + 0xa8]
sub rcx, rbp
mov qword [r14 + 0x100], rcx
lea rax, [0x18002c330]
mov qword [r14 + 0x180], rax
mov rax, qword [r14 + 0xd0]
mov eax, dword [rax + 0xd8]
add eax, 0x10
cmp qword [r14 + 0x38], rax
jb 0x18000a73a
mov rax, qword [r14 + 0x18]
mov rcx, qword [r14]
add qword [rcx + 0x110], rax
inc qword [r14 + 0x18]
mov rax, qword [r14 + 0x1b0]
xor qword [r14 + 0xb8], 0x7c70
mov eax, dword [rax + 0xe8]
sub eax, 0x3aed
cdqe
cmp rax, 0xad4
jge 0x18000a92d
mov r10, rax
lea rsi, [r14 + 0x170]
shl r10, 2
lea rdi, [r14 + 0xb0]
mov r15d, 0x3b20
or qword [r14 + 0xf0], rsi
mov eax, 2
sub rax, 1
jne 0x18000a78c
mov qword [r14 + 0xa8], rdi
mov r8d, ebp
mov rax, qword [r14 + 0x180]
mov ebx, dword [r10 + rax]
mov rax, qword [r14 + 0x80]
imul ecx, dword [rax + 0x1b8], 0x5c0054a6
cmp ecx, ebp
jb 0x18000a7ea
movzx eax, byte [0x18001f5a7]
inc r8d
imul rax, rax, 0x3b5d
mov qword [r14 + 0x18], rax
mov rax, qword [r14 + 0x80]
imul edx, dword [rax + 0x1b8], 0x5c0054a6
movsxd rax, r8d
cmp rax, rdx
jbe 0x18000a7bc
movzx ecx, byte [0x18001f7a5]
imul ebx, dword [r14 + 0x118]
add rcx, 0x3c7d
add qword [r14 + 0x100], rcx
mov rax, qword [r14 + 0x80]
imul ecx, dword [rax + 0x1b8], 0xcac877f6
cmp ecx, r15d
jge 0x18000a844
mov edx, r15d
sub edx, ecx
mov rcx, qword [r14 + 0x1c8]
mov rax, qword [rcx + 0xe0]
or qword [r14 + 0x1e0], rax
inc qword [rcx + 0xe0]
sub rdx, 1
jne 0x18000a822
imul rax, qword [r14 + 0xa8], 0x3b5d
mov r8d, dword [r14 + 0x17c]
add qword [r14 + 0x1e0], rax
mov rax, qword [r14 + 0xb8]
mov r11, qword [r14 + 0x80]
add rax, 0x3afd
mov qword [r14 + 0x88], rax
mov rax, qword [r14 + 0x1b0]
imul ecx, dword [r11 + 0x120], 0xa469516
mov edx, dword [rax + 0x1b8]
sub edx, 0x180
movsxd rax, edx
cmp rax, rcx
ja 0x18000a8c0
mov r9, qword [rdi]
xor r9, 0xfffffffffffffee7
inc edx
mov qword [rdi], r9
imul ecx, dword [r11 + 0x120], 0xa469516
movsxd rax, edx
cmp rax, rcx
jbe 0x18000a8a1
mov eax, 0x3c75
mov edx, ebx
sub eax, dword [r11 + 0x1b8]
add r8d, eax
mov rax, qword [r14 + 0x1c8]
mov ecx, r8d
shr edx, cl
movzx ecx, byte [rax + 0x120]
imul eax, ecx, 0xb
movsxd rcx, dword [r14 + 0x160]
and dl, al
mov rax, qword [r14 + 0x48]
mov byte [rcx + rax], dl
inc dword [r14 + 0x160]
test r8d, r8d
jne 0x18000a85d
movzx eax, byte [0x18001f9a2]
add r10, 4
imul rax, rax, 0x3ed6
sub qword [r14 + 0x168], rax
cmp r10, 0x2b50
jl 0x18000a780
add qword [r14 + 0x10], 0x786b
imul rax, qword [r14 + 0xe0], 0x3b73
mov qword [r14 + 0x100], rax
jmp 0x18000aac6
mov ecx, dword [r14 + 0x110]
imul ecx, dword [r14 + 0xb0]
mov edx, dword [r14 + 0xe0]
xor edx, dword [r14 + 0x70]
xor ecx, dword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [r14 + 0x1b8]
mov r8d, ebx
movsxd rax, r15d
or r8d, esi
sub rcx, rax
movsxd rdx, edi
add rcx, qword [r14 + 0x138]
add qword [r14 + 0xa8], rcx
mov rax, qword [r14 + 0x170]
movsxd rcx, dword [rsp + 0xe0]
sub rcx, qword [r14 + 0x1b0]
imul rax, rcx
mov rcx, qword [r14 + 0xb8]
mov qword [r14 + 0x170], rax
movsxd rax, esi
or qword [r14 + 0xd0], rax
movsxd rax, ebx
mov r9, rax
and rdx, rax
and r9, qword [r14 + 0x1e0]
movsxd rax, r12d
and rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r9d, dword [r14 + 0x120]
lea r10d, [r15 + 0x3c7d]
mov r8d, dword [rsp + 0xd8]
lea edx, [rsi - 0x3afd]
mov eax, dword [r14 + 0xa8]
mov ecx, 0x3f59
or ebx, ecx
xor r8d, r15d
mov r11d, r8d
add r9d, 0x4e2
and r9d, ecx
and r11d, ebp
sub r11d, dword [r14 + 0x1b0]
mov ecx, r13d
xor eax, r15d
xor ecx, esi
imul ecx, dword [r14 + 0x150]
or r10d, 0x3f0a
mov dword [rsp + 0x40], r10d
add r11d, ebp
mov dword [rsp + 0x38], edx
mov rdx, r14
mov dword [rsp + 0x30], r8d
mov r8d, ebx
imul eax, r12d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], eax
call fcn.180014cd0
mov rdx, qword [r14 + 0x120]
mov r12d, 0x3b73
mov rcx, qword [r14 + 0x38]
mov rax, rdx
or rax, qword [r14 + 0x138]
add qword [r14 + 0xb0], rax
imul rcx, qword [r14]
mov rax, qword [r14 + 0x80]
imul rax, rcx
mov rcx, qword [r14 + 0x20]
imul rcx, qword [r14 + 0xa8]
mov qword [r14 + 0x80], rax
imul rax, qword [r14 + 0x1b0], 0x3b4c
imul rcx, rdx
xor rax, r12
sub rax, rcx
add qword [r14 + 0x1e0], rax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
lea eax, [r13 + 0x8f]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret