Function at 0x14002eb30
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
movaps xmmword [rsp + 0xf0], xmm6
mov qword [rsp + 0x80], rcx
mov byte [rsp + 0x43], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rsp + 0x94], ecx
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x44], 8
mov dil, 1
xorps xmm6, xmm6
lea rbx, [rsp + 0x50]
mov r14, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x9c], eax
mov rax, qword [0x141d439e0]
test rax, rax
jne 0x14002ebd8
nop dword [rax]
movaps xmmword [rsp + 0x50], xmm6
mov edx, 0x10
mov rcx, rbx
call r14
mov rax, qword [rsp + 0x50]
mov qword [0x141d439e0], rax
mov rax, qword [0x141d439e0]
test rax, rax
je 0x14002ebb0
mov eax, 1
lock xadd qword [0x141d439e0], rax
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x9c]
mov qword [rsp + 0xa8], rax
lea rax, [0x140014560]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xb8], rax
lea rax, [0x140014680]
mov qword [rsp + 0xc0], rax
lea rax, [0x141d35818]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0xd8]
mov rdx, rbx
call fcn.1400079e0
cmp qword [rsp + 0x88], 0
sete al
or dil, al
test dil, 1
jne 0x14002ec99
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xd8]
mov r8, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xe8]
lea r12, [r8 + rax]
mov qword [rsp + 0xc8], rax
test rax, rax
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x88], rcx
je 0x14002ece0
movzx eax, byte [r8]
test al, al
js 0x14002ed00
lea r14, [r8 + 1]
mov ebx, eax
jmp 0x14002ed55
mov r15d, 4
mov edx, 8
xor edi, edi
xor ebx, ebx
xor r14d, r14d
xor ebp, ebp
jmp 0x14002eda8
mov ebx, eax
and ebx, 0x1f
movzx edx, byte [r8 + 1]
and edx, 0x3f
cmp al, 0xdf
jbe 0x14002ed4c
movzx ecx, byte [r8 + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp al, 0xf0
jb 0x14002f02f
lea r14, [r8 + 4]
movzx eax, byte [r8 + 3]
and ebx, 7
shl ebx, 0x12
shl ecx, 6
and eax, 0x3f
or eax, ecx
or ebx, eax
cmp ebx, 0xffff
jbe 0x14002ed55
jmp 0x14002f044
lea r14, [r8 + 2]
shl ebx, 6
or ebx, edx
mov eax, 1
xor ebp, ebp
mov rcx, r12
sub rcx, r14
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
lea rdx, [rax + rcx]
lea r15, [rax + rcx]
inc r15
cmp rdx, 3
mov eax, 4
cmovb r15, rax
lea rdx, [r15 + r15]
mov di, 1
movabs rax, 0x7ffffffffffffffe
cmp rdx, rax
ja 0x14002f1e9
movzx eax, byte [0x141d43a20]
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x14002f1e9
mov rsi, rax
mov rax, qword [rsp + 0xa0]
inc eax
mov dword [rsp + 0x98], eax
mov word [rsi], bx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 1
mov ebx, 1
jmp 0x14002ee0f
xor eax, eax
mov r13d, ebp
cmp rbx, qword [rsp + 0x50]
je 0x14002eebe
mov ebp, eax
mov word [rsi + rbx*2], r13w
inc rbx
mov qword [rsp + 0x60], rbx
test r14, r14
je 0x14002ee30
test bp, bp
jne 0x14002edf0
cmp r14, r12
je 0x14002ee30
movzx ecx, byte [r14]
test cl, cl
js 0x14002ee5d
inc r14
mov r13d, ecx
xor eax, eax
jmp 0x14002edf5
mov r15, qword [rsp + 0x50]
cmp di, 1
jne 0x14002ef70
xor r13d, r13d
mov r14d, 0
mov edi, 0
mov r8d, 0
cmp rbx, r15
jne 0x14002ee02
jmp 0x14002eee7
mov r13d, ecx
and r13d, 0x1f
movzx edx, byte [r14 + 1]
and edx, 0x3f
cmp cl, 0xdf
jbe 0x14002ef10
movzx eax, byte [r14 + 2]
shl edx, 6
and eax, 0x3f
or eax, edx
cmp cl, 0xf0
jb 0x14002ef22
movzx ecx, byte [r14 + 3]
add r14, 4
and r13d, 7
shl r13d, 0x12
shl eax, 6
and ecx, 0x3f
or ecx, eax
or ecx, r13d
mov r13d, ecx
cmp r13d, 0xffff
ja 0x14002ef3d
xor eax, eax
jmp 0x14002edf5
mov r8, r12
sub r8, r14
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
movzx ecx, di
cmp ax, 1
sbb r8, 0xffffffffffffffff
add r8, rcx
mov ebp, eax
inc r8
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140059920
mov rsi, qword [rsp + 0x58]
jmp 0x14002ee02
add r14, 2
shl r13d, 6
or r13d, edx
xor eax, eax
jmp 0x14002edf5
add r14, 3
shl r13d, 0xc
or eax, r13d
mov r13d, eax
cmp r13d, 0xffff
jbe 0x14002eeb7
lea ecx, [r13 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov eax, r13d
mov r13d, ecx
jmp 0x14002edf5
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, rsi
mov edx, dword [rsp + 0x94]
mov edi, dword [rsp + 0x44]
mov r8d, edi
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002f0e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rsp + 0x98]
cmp ecx, 0xa
jge 0x14002f06d
cmp eax, 5
jne 0x14002eff0
mov eax, ecx
mov qword [rsp + 0xa0], rax
jmp 0x14002effb
test edi, edi
je 0x14002f06d
xor edi, edi
cmp eax, 0x57
jne 0x14002f06d
mov dword [rsp + 0x44], edi
xor edi, edi
test r15, r15
lea rbx, [rsp + 0x50]
mov r14, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
je 0x14002eb90
mov rcx, qword [0x141d439e8]
xor edi, edi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14002eb90
lea r14, [r8 + 3]
shl ebx, 0xc
or ebx, ecx
cmp ebx, 0xffff
jbe 0x14002ed55
lea ecx, [rbx + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov eax, 2
mov ebp, ebx
mov ebx, ecx
jmp 0x14002ed5c
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test r15, r15
je 0x14002f09f
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x88], 0
je 0x14002f0be
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, 0xffffffffffffffff
je 0x14002f0cd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r15, r15
je 0x14002f100
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x6c], 0
mov word [rsp + 0x74], 0
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x71], al
xor al, 1
mov byte [rsp + 0x70], al
mov dword [rsp + 0x68], 0
mov dword [rsp + 0xa8], 0x18
mov qword [rsp + 0xb0], 0
mov dword [rsp + 0xb8], 1
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0xc8]
call fcn.140033680
test rax, rax
je 0x14002f1aa
mov rax, qword [rsp + 0x80]
mov qword [rax + 8], rdx
mov qword [rax], 1
cmp qword [rsp + 0x88], 0
jne 0x14002f0aa
jmp 0x14002f0be
mov rax, qword [rsp + 0x80]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
mov qword [rax], 0
cmp qword [rsp + 0x88], 0
je 0x14002f0cd
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14002f0cd
ud2