Function at 0x1400410d8
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r15, r8
movzx ebx, dx
xor r12d, r12d
mov dword [rsp + 0x60], r12d
test rcx, rcx
je 0x1400414ca
test r8, r8
je 0x1400414ca
mov qword [r8], r12
lea rdx, [rbp + 0x110]
call fcn.1400414fc
test eax, eax
js 0x1400414cf
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x68]
call fcn.140213264
test eax, eax
js 0x1400414cf
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rdx]
lea rcx, [rbp + 0x10]
call fcn.140038d88
nop
mov rcx, qword [rsp + 0x68]
call fcn.14021325c
lea rax, [0x14037e168]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
lea rax, [0x14037cd58]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r12
mov byte [rbp - 0x40], r12b
lea esi, [r12 + 2]
mov dword [rbp - 0x3c], esi
lea rax, [0x14037cd88]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov dword [rbp - 0x20], r12d
xor r9d, r9d
lea edi, [rsi - 1]
mov r8d, edi
lea rdx, [0x14037e15c]
lea rcx, [rbp + 0x90]
call fcn.140037aac
mov dword [rsp + 0x60], edi
xor r9d, r9d
mov r8d, 0x80000100
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140037e60
mov eax, edi
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
lea rcx, [rbp + 0x90]
call fcn.140038964
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.140037458
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140036e6c
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140036fb0
mov dword [rbp - reloc.OLEAUT32.dll_SafeArrayGetElement], 0x18
mov dword [rbp - 8], r12d
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
or dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9d, edi
mov edx, 0xc0003
lea r8d, [r12 + 6]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rdi, rax
mov rsi, rax
mov qword [rbp - 0x80], rax
cmp rax, 0xffffffffffffffff
jne 0x1400412e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
mov eax, 0x80004005
cmovns r14d, eax
cmp r14d, 0x800700b7
je 0x14004136a
cmp r14d, 0x800700e7
je 0x14004136a
cmp r14d, 0x80070005
je 0x14004136a
test r14d, r14d
js 0x1400413be
mov qword [rsp + 0x78], r12
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14005f888
mov r14, rax
mov qword [rbp], rax
mov rsi, r12
mov qword [rbp - 0x80], r12
mov qword [rax], rdi
mov qword [rax + 8], r12
mov word [rax + 0x10], bx
mov rdi, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], r12
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
mov r9, rdi
lea r8, [0x1400416a8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140041372
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
mov eax, 0x80004005
cmovns r14d, eax
jmp 0x14004138c
mov r14d, 0x805e0003
jmp 0x1400413be
mov rbx, r12
mov qword [rsp + 0x70], rbx
mov qword [r14 + 8], rax
mov rdi, r12
mov qword [rsp + 0x78], r12
mov qword [r15], r14
mov r14d, r12d
test rbx, rbx
je 0x14004139f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], r12
test rdi, rdi
je 0x1400413b9
mov rcx, rdi
call fcn.14004109c
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.14005f854
mov qword [rsp + 0x78], r12
test rsi, rsi
je 0x1400413d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], r12
lea rcx, [rbp - 0x50]
call fcn.140037f54
nop
lea rax, [0x14037e168]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400414bc
mov word [rsp + 0x40], r12w
lea r8, [rbp - 0x6c]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorControl]
test eax, eax
je 0x1400414ad
mov eax, 0x8000
test word [rsp + 0x40], ax
jne 0x1400414ad
lea r8, [rsp + 0x44]
lea rdx, [rbp - 0x68]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorOwner]
mov rcx, qword [rbp - 0x68]
call fcn.14006c080
lea r8, [rsp + 0x44]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorGroup]
mov rcx, qword [rbp - 0x60]
call fcn.14006c080
lea r9, [rsp + 0x44]
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
cmp dword [rsp + 0x48], r12d
je 0x140041484
mov rcx, qword [rbp - 0x58]
call fcn.14006c080
lea r9, [rsp + 0x44]
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
cmp dword [rsp + 0x48], r12d
je 0x1400414ad
mov rcx, qword [rbp - 0x78]
call fcn.14006c080
mov rcx, qword [rsp + 0x58]
call fcn.14006c080
mov qword [rsp + 0x58], r12
lea rcx, [rbp + 0x10]
call fcn.140038964
mov eax, r14d
jmp 0x1400414cf
mov eax, 0x80070057
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.14005f5e0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret