Function at 0x18000dd00
Capabilities:
Create pipe
Encode data using xor
Get file size

Disassembly:
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x40
mov edi, dword [rsp + 0x90]
lea edx, [rcx - 0x59f]
mov r15d, r9d
mov dword [rsp + 0x90], edx
xor r15d, 0x51a
lea r13d, [r9 + 0x10f9]
mov ebp, r9d
xor edi, 0xc08
xor ebp, 0x595
mov rbx, r8
lea eax, [r15 + 0x4d8]
cmp edi, eax
jge 0x18000dec7
imul eax, dword [0x18004a070], 0x13bff2
mov dword [0x18004a070], eax
mov rax, qword [section..data]
add dword [rax + 0x34], 0xffe4adc1
cmp dword [r8 + 0x60], 0x14078
jne 0x18000dd94
mov rax, qword [section..data]
mov ecx, dword [r8 + 0x88]
sub ecx, dword [rax + 0x110]
or dword [r8 + 0x2c], ecx
jmp 0x18000ddaf
mov ecx, dword [r8 + 0x110]
add ecx, 0x99364
add ecx, dword [r8 + 0x100]
xor dword [r8 + 0xec], ecx
mov eax, dword [r8 + 0x98]
cmp dword [0x18004a0f0], eax
je 0x18000ddd9
mov rcx, qword [section..data]
mov eax, dword [r8 + 0x110]
xor eax, dword [rcx]
add eax, 0x31f08
add dword [rcx + 0xdc], eax
mov eax, dword [r8 + 0x60]
sub eax, dword [r8 + 0x94]
sub eax, 0x1594c6a
mov dword [r8 + 0x88], eax
mov eax, dword [0x18004a010]
sub eax, dword [0x18004a0ec]
mov rcx, qword [section..data]
xor eax, 0xfffcf1c4
add dword [rcx + 0xec], eax
mov eax, dword [r8 + 0x94]
xor eax, dword [r8 + 0x100]
mov ecx, dword [r8 + 0x2c]
sub eax, 0x18d597
add dword [r8 + 0xec], eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x88]
add eax, 0xffebc5ba
add ecx, eax
xor dword [0x18004a0fc], ecx
cmp dword [0x18004a0a4], 0x7020
jae 0x18000de65
mov eax, dword [rdx + 0x88]
add eax, dword [r8 + 0x100]
mov dword [r8 + 0x74], eax
jmp 0x18000de85
mov eax, dword [rdx + 0xe0]
add eax, dword [r8 + 0xdc]
xor eax, dword [r8 + 0xec]
xor eax, 0xfbc04
mov dword [r8 + 0xec], eax
mov rcx, qword [section..data]
mov eax, dword [r8 + 0xa8]
cmp dword [rcx + 0x9c], eax
jbe 0x18000deb8
mov eax, dword [r8 + 0x98]
sub eax, dword [0x18004a038]
sub eax, 0x8fc8
add dword [rcx + 0xa8], eax
jmp 0x18000e09c
xor dword [rcx + 0xec], 0xa78bc
jmp 0x18000e09c
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x108]
xor eax, 0x5f0
or eax, dword [r8 + 0x28]
cmp dword [r8 + 0xd8], eax
ja 0x18000e09c
mov eax, dword [rcx + 0x48]
xor eax, dword [r8 + 0x48]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], r14
cmp ebp, eax
jbe 0x18000df65
mov r14d, r13d
mov esi, ebp
or r14d, edi
cmp ebp, r14d
jne 0x18000df65
nop
mov edx, dword [rbx + 0x110]
imul ecx, dword [0x18004a058], 0xf6e
sub edx, edi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbx + 8]
mov rcx, rdi
mov eax, dword [rbx + 0xfc]
or rcx, rax
xor edx, dword [rbx + 0x104]
and ecx, 0x182c
xor edx, 0x1104
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esi, 3
cmp esi, r14d
je 0x18000df10
mov rcx, qword [section..data]
mov edx, dword [rsp + 0x90]
mov eax, dword [rbx + 0x54]
xor eax, dword [0x18004a068]
and eax, dword [rcx + 0x108]
mov esi, dword [rbx + 0x50]
cmp esi, eax
jne 0x18000e08f
mov qword [rsp + 0x78], r12
mov r14d, r15d
xor r14d, edi
mov r12d, r15d
and r12d, 0x150d
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + 0x74]
mov r8d, r15d
mov r10d, dword [rbx + 0x94]
and eax, edx
or eax, dword [rbx + 0xe0]
sub r10d, edi
sub r8d, dword [rbx + 0xd8]
xor ebp, eax
mov r11d, dword [rbx + 0x28]
mov r9d, dword [rbx + 0x78]
or r11d, 0x117c
mov edx, dword [rbx + 0x98]
xor r11d, ebp
mov ecx, dword [rcx + 0x108]
xor r9d, 0xab3
mov qword [rsp + 0x38], r10
sub edx, ebp
mov dword [rsp + 0x30], r11d
mov eax, r13d
mov dword [rsp + 0x28], r14d
and rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [0x18004a118]
mov r8d, ebp
mov ecx, dword [rbx + 0x48]
or r8d, 0x117c
or edx, r13d
xor r8d, 0xc36
xor edx, ebp
or ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenThread]
imul ecx, dword [rbx + 0x108], 0x49c
mov edx, ebp
mov r9d, dword [rbx]
and edx, 0xab3
mov r8d, dword [rbx + 0x54]
or r9d, r15d
xor r8d, dword [rbx + 0x28]
add edx, 0x117c
sub ecx, r15d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [section..data]
add esi, 2
mov eax, dword [rbx + 0x54]
xor eax, dword [0x18004a068]
mov edx, dword [rsp + 0x90]
and eax, dword [rcx + 0x108]
cmp esi, eax
je 0x18000dfa0
mov r12, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov eax, dword [rsp + 0x90]
add eax, 0xfffff52e
add rsp, 0x40
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret