Function at 0x14000d6d0
Capabilities:
Encode data using xor
Read pipe
Write pipe

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov esi, r9d
lea ebx, [r9 + 0x445]
xor esi, 0x3ec6
lea edi, [r9 - 0x3e7]
mov ebp, ecx
xor r9d, 0x2096
xor ebp, 0xffb
lea eax, [rsi + 0x68b]
cmp r9d, eax
jge 0x14000d9e1
lea eax, [rbx + 0x9ac]
cmp esi, eax
je 0x14000d8d6
mov r8, qword [section..data]
lea edx, [rbp + 0x4bb]
mov eax, ebx
mov r9d, ebx
mov ecx, ebx
xor eax, 0x3a8b
xor r9d, 0xa5c
mov dword [rsp + 0x20], eax
xor ecx, 0x3c80
call fcn.140017540
mov eax, edi
lea edx, [rbx - 0x68b]
mov rbx, qword [rsp + 0x90]
lea r9d, [rsi + 0x32c]
xor eax, 0x3f7a
xor edi, 0x3874
mov r8d, edi
mov dword [rsp + 0x20], eax
mov rcx, rbx
call fcn.140002a90
mov r11d, eax
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
movsxd rdx, dword [rbx + 0x7c]
mov eax, 0x1b8702
sub eax, dword [rbx + 0x108]
add dword [rbx + 0x38], eax
mov rax, qword [rbx + 0xb8]
mov r9d, dword [rax + r10]
add r10, 4
imul r9d, dword [rbx + 0x70]
mov rax, qword [section..data]
mov rcx, qword [rax + 0xc8]
mov r8d, r9d
shr r8d, 0x10
mov byte [rdx + rcx], r8b
inc dword [rbx + 0x7c]
mov ecx, dword [rbx + 0x98]
imul ecx, dword [rbx + 0x88]
mov eax, dword [rbx + 0x78]
add eax, 0x6f241010
or dword [rbx + 0xa8], eax
mov dword [rbx + 0x98], ecx
mov eax, dword [0x140105060]
sub ecx, eax
xor ecx, 0xffffffd3
sub eax, ecx
mov rcx, qword [section..data]
mov dword [0x140105060], eax
mov eax, dword [rbx + 0xf4]
xor eax, dword [rbx + 0x98]
sub eax, 6
add dword [rcx + 0x94], eax
mov eax, dword [rbx + 0xa8]
mov rdx, qword [section..data]
sub eax, 0x9d405
xor dword [0x140105088], eax
mov eax, dword [0x140105048]
add eax, 0xfffe05e3
mov ecx, dword [rdx + 4]
add ecx, eax
mov dword [0x140105048], ecx
mov eax, dword [rbx + 0x60]
xor dword [0x1401050b8], eax
mov eax, dword [rbx + 0x60]
sub dword [0x140105128], eax
mov eax, dword [rdx + 0x28]
mov edx, r9d
or dword [0x1401050d0], eax
movsxd rcx, dword [0x14010508c]
mov rax, qword [0x1401050d8]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [0x14010508c]
movsxd rcx, dword [rbx + 0x7c]
mov rax, qword [rbx + 0xc8]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x7c]
mov eax, dword [0x140105048]
mov ecx, dword [rbx + 0x94]
add eax, 0x28fb0b4e
add ecx, dword [0x1401050d0]
add ecx, eax
mov dword [0x140105048], ecx
cmp r10, 0x44430
jl 0x14000d790
lea eax, [r11 + 0x8ce]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdi, qword [rsp + 0x90]
mov qword [rsp + 0x80], r14
mov r14d, ebx
mov eax, dword [rdi + 0x98]
sub eax, 0x217c
cmp ebx, eax
jne 0x14000d9d9
mov qword [rsp + 0x70], r12
lea r12d, [rbx + rsi]
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x40], r15
mov r13d, ebp
and ebp, 0x1e50
movsxd r15, ebx
or r15, 0x2a4a
mov rax, qword [section..data]
mov dword [rax + 0x74], r12d
mov rcx, qword [section..data]
mov eax, dword [rdi + 0x64]
mov r9d, dword [rdi + 0xa8]
mov r10d, dword [0x14010501c]
mov edx, dword [rcx + 0x74]
xor r10, r13
mov r8d, dword [rcx + 0x104]
or edx, ebx
and r8, rax
mov qword [rsp + 0x30], r10
mov eax, dword [0x1401050a8]
sub edx, ebx
xor r9, rax
mov qword [rsp + 0x28], r8
mov eax, dword [rdi + 0x74]
mov r8d, ebp
sub eax, dword [rcx + 0x94]
add eax, dword [rdi + 0x100]
mov dword [rsp + 0x20], edx
mov rdx, r15
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov ecx, dword [0x1401050b8]
add ecx, ebx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov eax, dword [rdi + 0x98]
add r14d, 4
sub eax, 0x217c
cmp r14d, eax
je 0x14000d922
mov r15, qword [rsp + 0x40]
lea eax, [rsi + 0x8ce]
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea eax, [rsi + 0x8ce]
jmp 0x14000d9c8
lea eax, [rsi + 0x8ce]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret