Function at 0x18000d8e0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x98]
lea ebp, [r8 - 0x324]
mov ebx, dword [rsp + 0x90]
lea r14d, [rdx + 0x1137]
xor ebx, 0x129c
lea r13d, [r9 + 0x80d]
mov rdi, rcx
lea r12, [0x18004a010]
lea esi, [rax - 0xec]
lea r15d, [rax + 0x7d2]
lea eax, [rbp + 0x375]
cmp r14d, eax
je 0x18000da3d
mov rax, qword [section..data]
lea r9d, [rbp + 0x7f2]
mov edx, ebx
mov qword [rsp + 0x20], rax
xor esi, 0x1815
lea r8d, [r13 - 0x900]
xor edx, 0x105a
mov ecx, esi
call fcn.18000e2f0
add dword [rdi + 0x94], 0x13f138
lea r8d, [rbx + 0xc08]
mov r9d, eax
mov dword [rsp + 0x20], r8d
mov r8, r12
lea edx, [rbx + 0xf6e]
lea ecx, [rax - 0x26e]
xor r9d, 0x1e69
mov esi, eax
call fcn.18000dd00
cmp dword [rdi + 0xe0], 0xc5a3
mov ebp, eax
jne 0x18000d9d5
mov ecx, dword [rdi + 0xa8]
add ecx, dword [rdi + 0x50]
xor ecx, dword [rdi + 0x2c]
xor ecx, 0x2eab1
mov dword [rdi + 0x2c], ecx
jmp 0x18000d9e6
mov eax, dword [0x18004a0a4]
add eax, 0xc61add5
mov dword [0x18004a014], eax
add ebx, 0x1a0b
add ebp, 0xf92
sub r14d, 0x69b
cmp dword [rdi + 0x50], 0xca29
je 0x18000da09
mov dword [rdi + 0x18], 0x2a1c08ea
xor ebp, 0x10b2
cmp dword [rdi + 0x2c], 0x9126
jbe 0x18000da28
mov eax, dword [rdi + 0x9c]
add eax, 0xf4de
mov dword [rdi + 0x44], eax
jmp 0x18000da3d
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xdc]
sub eax, 0xf648
xor dword [rcx + 0x50], eax
mov eax, r13d
xor eax, 0x1900
cmp esi, eax
je 0x18000da84
cmp dword [0x18004a120], 0x3a91
je 0x18000da68
mov ecx, dword [rdi + 0x14]
mov rax, qword [section..data]
add ecx, 0x431181ed
mov dword [rax + 0x5c], ecx
mov eax, dword [0x18004a024]
xor eax, dword [0x18004a118]
sub eax, 0x3487c0
mov dword [rdi + 0xe8], eax
jmp 0x18000dccb
mov r8, qword [section..data]
mov eax, ebp
and eax, 0x912
xor eax, dword [rdi]
cmp dword [r8 + 0xd4], eax
jae 0x18000dc9b
mov eax, dword [r8 + 0x90]
or eax, ebx
xor eax, 0x1a0b
cmp esi, eax
jae 0x18000dc1a
mov eax, esi
sub eax, r14d
xor eax, r15d
cmp esi, eax
je 0x18000dc1a
mov r9d, dword [r8 + 0x34]
mov edx, dword [rdi + 0x100]
xor r9d, 0x49c
and r9d, dword [r8 + 0x54]
or edx, r13d
add edx, dword [r8 + 0xe0]
mov r8d, ebp
mov ecx, dword [rdi + 0x60]
sub r8d, r13d
add ecx, 0xbd2
mov qword [rsp + 0x20], r12
and ecx, 0x1a0b
call fcn.18000e2f0
mov r10d, dword [0x18004a0a0]
mov edx, eax
add r10d, dword [rdi + 0x108]
mov ecx, r14d
mov r9d, dword [rdi + 0x94]
mov r11d, r13d
mov r8d, dword [rdi + 0x110]
xor r11d, ebx
or r9d, dword [0x18004a0ac]
and r11d, 0xf6e
mov dword [rsp + 0x30], r10d
xor r8d, 0x129c
imul edx, eax
mov r15d, eax
imul ecx, ebp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r11d
xor edx, 0xc87
call sym.zpodb664uz4.dll_MmiiJHu18
mov ecx, dword [rdi + 0xdc]
or ecx, dword [rdi + 0x4c]
call qword [sym.imp.KERNEL32.dll_ExitThread]
lea eax, [r14 + r13]
movsxd rcx, eax
call qword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov rax, qword [section..data]
xor r14d, 0x177b
mov ebx, dword [0x18004a0e4]
mov r8d, dword [rdi + 0x48]
and ebx, 0x1a0b
mov r11d, dword [0x18004a0ac]
sub esi, dword [rax + 0x78]
lea edx, [r14 - 0xe7b]
mov r10d, dword [rdi + 0x64]
or r11d, r15d
mov r9d, dword [rdi + 0x84]
sub esi, 0xc08
mov ecx, dword [rdi + 0x28]
sub r10d, ebp
mov qword [rsp + 0x38], rbx
xor r9d, ebp
mov dword [rsp + 0x30], r11d
imul r8d, ebp
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r10d
sub r8d, dword [rax + 0x28]
mov eax, ebp
and rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x18000dccb
mov eax, dword [rdi + 0x2c]
sub eax, dword [rdi + 8]
mov ecx, dword [rdi + 0x108]
cmp ecx, eax
jae 0x18000dccb
mov eax, dword [rdi + 0x28]
sub eax, dword [0x18004a010]
cmp ecx, eax
ja 0x18000dccb
mov eax, dword [r8 + 0xe0]
add eax, dword [rdi + 0x64]
add eax, dword [0x18004a04c]
sub r15d, eax
mov rbx, qword [rsp + 0x70]
lea eax, [r15 - 0x1390]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret