Function at 0x14000a320
Capabilities:
Create pipe
Write file on windows

Disassembly:
sub rsp, 0x88
test byte [0x140187fe8], 1
jne 0x14000a5bc
lock bts qword [0x140187fe8], 0x1f
setb al
test al, al
je 0x14000a367
test byte [0x140187fe8], 1
jne 0x14000a5bc
xor edx, edx
lea rcx, [0x140187fe8]
add rsp, 0x88
jmp sym.4yUlCM3HuVsHzW5CaCX.exe_PhfWaitForEvent
mov qword [rsp + 0x80], rbx
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov qword [rsp + 0x78], rdi
xor r8d, r8d
mov byte [rsp + 0x20], 0
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
xor edi, edi
test eax, eax
js 0x14000a417
mov r8, qword [rsp + 0x98]
lea rdx, [0x14000a260]
xor ecx, ecx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateThread
mov rbx, rax
test rax, rax
je 0x14000a409
mov rcx, rax
call fcn.14000a110
test al, al
je 0x14000a3f0
mov r9d, 0x10
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x50]
mov edx, 0x15
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14000a3f0
movzx eax, word [rsp + 0x58]
mov word [0x140187ff8], ax
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor r9d, r9d
mov byte [rsp + 0x20], dil
xor r8d, r8d
lea rcx, [rsp + 0x98]
mov edx, 0x1f0003
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x14000a4b8
mov r8, qword [rsp + 0x98]
lea rdx, [0x14000a290]
xor ecx, ecx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateThread
mov rbx, rax
test rax, rax
je 0x14000a4aa
mov rcx, rax
call fcn.14000a110
test al, al
je 0x14000a491
mov r9d, 0x10
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x50]
mov edx, 0x15
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14000a491
movzx eax, word [rsp + 0x58]
mov word [0x140188000], ax
mov rcx, qword [rsp + 0x98]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSetEvent]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntdll.dll_NtClose]
xor r9d, r9d
lea rdx, [rsp + 0xa8]
xor r8d, r8d
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14000a5a3
mov r8, qword [rsp + 0xa0]
lea rdx, [0x14000a2d0]
xor ecx, ecx
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateThread
mov rbx, rax
test rax, rax
je 0x14000a587
mov rcx, rax
mov dword [rsp + 0x90], edi
call fcn.14000a110
test al, al
je 0x14000a53f
mov r9d, 0x10
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x50]
mov edx, 0x15
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14000a53f
movzx eax, word [rsp + 0x58]
mov word [0x140187ffc], ax
mov rcx, qword [rsp + 0xa8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov dword [rsp + 0x30], 4
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [0x140187fe8]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhfSetEvent
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x88
ret