Function at 0x18000ab20
Capabilities:
Get common file path
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x50], 0
jmp 0x18000ab42
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x70]
call fcn.18000c670
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
jae 0x18000ad30
movsxd rax, dword [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.18000c5c0
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18000c920
mov eax, dword [0x18007ada4]
mov ecx, 0xbeaf8763
cmp rax, rcx
jne 0x18000ad2b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.mMfAqfeYfRDGgMlTQrgDxZLbcQnq
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.adjROcOJuCkPfpdZD
xor edx, edx
lea rcx, str.NsPnHLZuRKnOOnqlKPajrWoIGVzfD
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x18000ab38
add rsp, 0x68
ret