Function at 0x14000afb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400650c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
xor edi, edi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x29]
call qword [sym.imp.libprotobuf_lite.dll_protected:_void___cdecl_google::protobuf::MessageLite::constructor_class_google::protobuf::Arena____ptr64__bool____ptr64]
lea rsi, vtable.PipeMessage.0
mov qword [rbp - 0x29], rsi
mov dword [rbp - 0x19], edi
xor eax, eax
mov dword [rbp - 9], eax
lea rcx, [rbp - 9]
call qword [sym.imp.libprotobuf_lite.dll_public:_void___cdecl_google::protobuf::internal::CachedSize::constructor_void____ptr64]
mov qword [rbp - 0x29], rsi
mov dword [rbp - 0x19], 4
mov dword [rbp - 5], 2
lea rcx, [rbp - 0x11]
call qword [sym.imp.libprotobuf_lite.dll_public:_void___cdecl_google::protobuf::internal::ArenaStringPtr::InitDefault_void____ptr64]
test byte [rbp - 0x21], 1
je 0x14000b03a
mov rax, qword [rbp - 0x21]
and rax, 0xfffffffffffffffc
mov r8, qword [rax]
jmp 0x14000b042
mov r8, qword [rbp - 0x21]
and r8, 0xfffffffffffffffc
lea rdx, str.tabtip.exe
lea rcx, [rbp - 0x11]
call qword [sym.imp.libprotobuf_lite.dll_public:_void___cdecl_google::protobuf::internal::ArenaStringPtr::Set_char_const____ptr64__class_google::protobuf::Arena____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x29]
call qword [sym.imp.libprotobuf_lite.dll_public:_bool___cdecl_google::protobuf::MessageLite::SerializePartialToString_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64_const___ptr64]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
mov r8d, dword [rbp + 0x17]
inc r8d
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 1]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000b119
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea r8d, [rax + 0x24]
lea rdx, str.write_pipe_message_to_service_error.
lea rcx, [rbp + 0x27]
call fcn.140001ca0
nop
lea rdx, [rbp + 0x27]
mov ecx, 1
call fcn.140002860
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14000b208
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2c4
jmp 0x14000b202
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
mov r8d, 0x10
lea rdx, str.start_tabtip_app
lea rcx, [rbp - 0x49]
call fcn.140001ca0
nop
lea rdx, [rbp - 0x49]
mov ecx, 1
call fcn.140002860
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x14000b194
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b18f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2ca
call fcn.14001ee3c
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
mov r8d, 0x46
lea rdx, str.powershell__ExecutionPolicy_Bypass__Command__Start_Process_tabtip.exe_
lea rcx, [rbp + 0x27]
call fcn.140001ca0
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
call fcn.1400281d8
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14000b208
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b202
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2d0
call fcn.14001ee3c
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14000b243
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b23e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2be
call fcn.14001ee3c
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
mov qword [rbp - 0x29], rsi
test byte [rbp - 0x21], 1
je 0x14000b268
lea rcx, [rbp - 0x21]
call fcn.140013980
jmp 0x14000b270
mov rax, qword [rbp - 0x21]
and rax, 0xfffffffffffffffc
test rax, rax
jne 0x14000b28e
mov eax, dword [rbp - 5]
test eax, eax
je 0x14000b28e
cmp eax, 2
jne 0x14000b28b
lea rcx, [rbp - 0x11]
call qword [sym.imp.libprotobuf_lite.dll_public:_void___cdecl_google::protobuf::internal::ArenaStringPtr::Destroy_void____ptr64]
mov dword [rbp - 5], edi
lea rcx, [rbp - 0x29]
call qword [sym.imp.libprotobuf_lite.dll_public_virtual:_void___cdecl_google::protobuf::MessageLite::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14001ede0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140025cfc
nop
call fcn.140025cfc
int3
call fcn.140025cfc
int3
call fcn.140025cfc
int3