Function at 0x1400b9620
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20], xmm6
mov r8d, edx
mov eax, dword [0x141dd7528]
xor edx, edx
div dword [0x141dd752c]
mov qword [rbp - 0x28], rcx
and eax, 0x9fdf2807
cmp eax, 0xe1996525
je 0x1400b9702
mov eax, dword [0x141dd7530]
imul eax, dword [0x141dd7534]
xor eax, 0x4442f61e
add eax, 0xf8b5daa
shr eax, 1
mov ecx, 0x86b5cd31
imul rcx, rax
shr rcx, 0x3d
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rdx, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r11, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
cmp ecx, 0xd6b06cd6
jbe 0x1400b9762
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
jmp 0x1400b9664
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x68], r11
mov qword [rbp - 0x70], r10
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x50], rdx
mov byte [rbp + 0x1f], r8b
movzx eax, r8b
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp - 0x1c], ecx
xor eax, eax
mov dword [rbp + 0xc], 8
mov cl, 1
mov dword [rbp + 0x10], ecx
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14d, 0x9113fabf
xor edx, edx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x60], rdi
test al, al
je 0x1400b97df
nop dword [rax + rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov dword [r15], eax
mov rax, qword [0x141dde6c8]
mov rbx, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd7538]
xor edx, edx
div dword [0x141dd753c]
mov edi, eax
xor edi, 0x1002
or edi, 0x83202c
and edi, 0x4193723f
sub rsp, 0x20
call rbx
add rsp, 0x20
mov dword [r15], eax
mov rax, qword [0x141dde6c8]
cmp edi, 0xa01a8164
ja 0x1400b97f0
test rax, rax
lea rbx, [rbp - 0x10]
je 0x1400b9890
mov eax, dword [0x141dd7558]
sub eax, dword [0x141dd755c]
mov rcx, qword [rbp - 0x38]
inc ecx
mov dword [rbp - 0x20], ecx
or eax, 0x4944b984
and eax, 0xc9fcbf94
cmp eax, 0xb4d44a33
mov r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x68]
lea r10, [0x1400571d0]
lea r11, [0x140055540]
jne 0x1400b9950
jmp 0x1400b99e0
test rax, rax
jne 0x1400b9837
nop word cs:[rax + rax]
mov eax, dword [0x141dd7540]
and eax, dword [0x141dd7544]
or eax, 0xb82611a1
imul eax, eax, 0xb37e22b7
cmp eax, 0x1c70ed26
je 0x1400b9890
mov eax, dword [0x141dd7548]
and eax, dword [0x141dd754c]
imul rax, rax, 0x5c0db9a9
shr rax, 0x3e
imul eax, eax, 0x17858920
cmp eax, 0xb3d10065
mov rsi, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
ja 0x1400b991d
mov eax, dword [0x141dd7550]
xor edx, edx
div dword [0x141dd7554]
mov edi, eax
movaps xmmword [rbp - 0x10], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, rbx
call rsi
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov qword [0x141dde6c8], rax
mov rax, qword [0x141dde6c8]
cmp edi, 0xec011fdb
jne 0x1400b987c
movaps xmmword [rbp - 0x10], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, rbx
call rsi
add rsp, 0x20
mov rax, qword [rbp - 0x10]
mov qword [0x141dde6c8], rax
mov rax, qword [0x141dde6c8]
jmp 0x1400b98d9
mov eax, dword [0x141dd7560]
and eax, dword [0x141dd7564]
imul eax, eax, 0x69191402
or eax, 0x5855356e
imul rcx, rax, 0x74f71633
shr rcx, 0x20
sub eax, ecx
shr eax, 1
mov edx, 1
lock xadd qword [0x141dde6c8], rdx
add eax, ecx
shr eax, 0x1b
mov qword [r8], rdx
mov qword [r9], r15
mov qword [r9 + 8], r10
mov qword [r9 + 0x10], r8
mov qword [r9 + 0x18], r11
cmp eax, 0x1d5cf15b
ja 0x1400b99e0
mov eax, dword [0x141dd7568]
imul eax, dword [0x141dd756c]
imul eax, eax, 0xfe05b63f
xor eax, 0x351b01b7
imul eax, eax, 0x8b01bc94
cmp eax, 0xd5600df1
mov rdx, qword [rbp - 0x60]
lea r8, [0x141dbb8b8]
jae 0x1400b9a10
jmp 0x1400b9bd0
mov eax, 1
lock xadd qword [0x141dde6c8], rax
mov qword [r8], rax
mov qword [r9], r15
mov qword [r9 + 8], r10
mov qword [r9 + 0x10], r8
mov qword [r9 + 0x18], r11
jmp 0x1400b9950
mov eax, dword [0x141dd7570]
mov ecx, dword [0x141dd7574]
add eax, ecx
add eax, 0xaf6f0b9d
mov qword [rdx], r8
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], r9
mov qword [rdx + 0x18], 2
cmp eax, 0x62674c9
jb 0x1400b9bd0
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call fcn.140039290
add rsp, 0x20
cmp qword [rbp - 0x18], 0
sete al
mov ecx, dword [rbp + 0x10]
or cl, al
test cl, 1
jne 0x1400b9b13
mov eax, dword [0x141dd76c8]
mov ecx, dword [0x141dd76cc]
add eax, ecx
add eax, 0x1c3918de
xor eax, 0xcac16f18
cmp eax, 0x920a2075
jbe 0x1400b9ab0
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
mov r8, r12
call r13
add rsp, 0x20
nop word [rax + rax]
mov esi, dword [0x141dd76d0]
and esi, dword [0x141dd76d4]
and esi, 0x546b4f8
add esi, 0xf7539ae2
or esi, 0xf4573b4b
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
mov r8, r12
call r13
add rsp, 0x20
cmp esi, 0x4dd5995a
jb 0x1400b9ab0
nop dword [rax]
mov eax, dword [0x141dd76d8]
or eax, dword [0x141dd76dc]
xor eax, 0x304095
or eax, 0x7a8f9368
imul eax, eax, 0x606733b2
cmp eax, 0x94889ef1
jb 0x1400b9af0
mov rax, qword [rbp - 0x40]
mov rbx, qword [rax]
mov r11, qword [rax + 8]
mov r13, qword [rax + 0x10]
lea rax, [r11 + r13]
mov qword [rbp + 0x10], rax
test r13, r13
mov qword [rbp - 0x78], r11
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x58], r13
je 0x1400b9c00
lea rsi, [r11 + 1]
mov eax, dword [0x141dd7578]
add eax, dword [str.eR__]
or eax, 0xc5fa9a8
add eax, 0x3438b787
or eax, 0xc0e925e
cmp eax, 0x1c18f185
je 0x1400b9b43
movzx edi, byte [r11]
test dil, dil
mov r9d, 0x804a0927
js 0x1400b9c20
nop dword [rax + rax]
mov eax, dword [0x141dd7588]
xor edx, edx
div dword [0x141dd758c]
add eax, 0x1ff1b46
cmp eax, 0x8f244042
ja 0x1400b9b80
nop word [rax + rax]
mov eax, dword [0x141dd7590]
and eax, dword [0x141dd7594]
add eax, 0xa1c3b2fa
and eax, 0x509fc76f
cmp eax, 0x913ad485
ja 0x1400b9ba0
jmp 0x1400b9df0
mov qword [rdx], r8
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], r9
mov qword [rdx + 0x18], 2
jmp 0x1400b9a10
mov ebx, 4
mov edx, 8
xor r12d, r12d
xor esi, esi
xor edi, edi
xor r13d, r13d
jmp 0x1400b9e6b
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b9c30
mov r8d, edi
and r8d, 0x1f
lea rsi, [r11 + 2]
movzx ecx, byte [r11 + 1]
mov eax, r8d
shl eax, 6
and ecx, 0x3f
mov edx, dword [0x141dd7580]
and edx, dword [0x141dd7584]
or edx, 0xd3005485
and edx, 0xd304f485
cmp edx, 0x1eb328d4
je 0x1400b9c4d
cmp dil, 0xdf
jbe 0x1400b9d60
mov eax, dword [0x141dd7598]
or eax, dword [0x141dd759c]
xor eax, 0x9990427f
cmp eax, 0x49537242
jb 0x1400b9c77
lea rsi, [r11 + 3]
movzx eax, byte [r11 + 2]
shl ecx, 6
and eax, 0x3f
mov edx, dword [0x141dd75a0]
sub edx, dword [0x141dd75a4]
or edx, 0xc38806e0
add edx, 0x3474574c
imul rdx, r9
shr rdx, 0x3f
cmp edx, 0x5eed9c5c
ja 0x1400b9c9e
or ecx, eax
cmp dil, 0xf0
jb 0x1400b9d69
nop word cs:[rax + rax]
mov eax, dword [0x141dd75a8]
sub eax, dword [0x141dd75ac]
add eax, 0x3bb7ec8d
or eax, 0x58218606
and eax, 0xdf31a747
cmp eax, 0xd20876cc
je 0x1400b9ce0
lea r9, [r11 + 4]
movzx r10d, byte [rsi]
and r8d, 7
shl r8d, 0x12
shl ecx, 6
and r10d, 0x3f
mov eax, dword [0x141dd75b0]
xor edx, edx
div dword [0x141dd75b4]
mov eax, dword [0x141dd75b8]
xor edx, edx
div dword [0x141dd75bc]
add eax, 0x7e7773dd
imul rax, rax, 0x5a75d9f
shr rax, 0x39
imul eax, eax, 0x3e018b27
cmp eax, 0x34a308fd
je 0x1400b9d27
or ecx, r10d
or ecx, r8d
mov rsi, r9
jmp 0x1400b9d70
or eax, ecx
mov edi, eax
jmp 0x1400b9df0
shl r8d, 0xc
or ecx, r8d
mov edi, ecx
mov eax, dword [0x141dd75c0]
xor edx, edx
div dword [0x141dd75c4]
imul eax, eax, 0x617ff15a
xor eax, 0x4181002
or eax, 0x3867c3dc
cmp eax, 0xd7e710b9
ja 0x1400b9d72
cmp edi, 0xffff
jbe 0x1400b9df0
nop
mov eax, dword [0x141dd75d0]
sub eax, dword [0x141dd75d4]
imul eax, eax, 0xf5e38c9e
xor eax, 0x88011428
or eax, 0x51eea9d7
cmp eax, 0x1f0d26e
jb 0x1400b9da0
lea ecx, [rdi + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and edi, 0x3ff
or edi, 0xdc00
mov eax, 2
mov r12d, edi
mov edi, ecx
jmp 0x1400b9e23
mov eax, dword [0x141dd75c8]
or eax, dword [0x141dd75cc]
imul eax, eax, 0xe4401b4
add eax, 0xc8d63857
shr eax, 1
imul rax, rax, 0x45a58c7d
shr rax, 0x3c
cmp eax, 0x42780eb6
je 0x1400b9df0
xor r12d, r12d
mov eax, 1
mov rcx, qword [rbp + 0x10]
sub rcx, rsi
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
lea rdx, [rcx + rax]
lea rbx, [rcx + rax]
inc rbx
cmp rdx, 3
mov eax, 4
cmovb rbx, rax
mov rax, rbx
shr rax, 0x3e
jne 0x1400ba830
lea rdx, [rbx + rbx]
mov r13w, 1
movzx eax, byte [0x141dde6f8]
sub rsp, 0x20
xor ecx, ecx
call fcn.1400c29b0
add rsp, 0x20
test rax, rax
je 0x1400ba80a
mov rcx, rax
mov eax, dword [0x141dd75e8]
xor edx, edx
div dword [0x141dd75ec]
or eax, 0x37ff8fbb
and eax, 0x37ffefbf
cmp eax, 0x26b09e07
jae 0x1400b9eaf
mov word [rcx], di
mov r10d, 0x90ec5763
mov r11d, 0x82574869
nop dword [rax + rax]
mov eax, dword [0x141dd75f0]
and eax, dword [0x141dd75f4]
xor eax, 0xfa7bd198
imul eax, eax, 0xb7552d06
imul rax, rax, 0x19e5e0ab
shr rax, 0x3b
mov word [rcx], di
cmp eax, 0xc80f49ca
je 0x1400b9ec0
xor eax, eax
test al, al
jne 0x1400ba450
nop word cs:[rax + rax]
mov eax, dword [0x141dd75f8]
xor eax, dword [0x141dd75fc]
add eax, 0xedfbf80c
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rcx
mov qword [rbp], 1
cmp eax, 0x16cf5766
jb 0x1400ba450
mov ebx, 1
test rsi, rsi
je 0x1400ba070
nop word [rax + rax]
mov eax, dword [0x141dd7600]
imul eax, dword [0x141dd7604]
imul rax, r14
shr rax, 0x3e
imul eax, eax, 0xf8b1fd97
cmp eax, 0xb985626e
je 0x1400b9f40
nop word cs:[rax + rax]
mov eax, dword [0x141dd7608]
and eax, dword [0x141dd760c]
cmp eax, 0x14940e77
je 0x1400b9f70
test r12w, r12w
je 0x1400b9f94
xor r9d, r9d
mov edi, r12d
jmp 0x1400ba301
cmp rsi, qword [rbp + 0x10]
je 0x1400ba070
mov eax, dword [0x141dd7610]
xor edx, edx
div dword [0x141dd7614]
nop dword [rax]
mov eax, dword [0x141dd7618]
or eax, dword [0x141dd761c]
add eax, 0x4f428cf7
imul rax, rax, 0x41121e0b
shr rax, 0x3d
and eax, 0xfffffffe
cmp eax, 0x299eda22
ja 0x1400b9fb0
lea rax, [rsi + 1]
mov edx, dword [0x141dd7620]
add edx, dword [0x141dd7624]
shr edx, 1
imul rdx, r10
shr rdx, 0x3d
or edx, 0x7f7d57de
cmp edx, 0xdf0a5238
je 0x1400b9fda
movzx edi, byte [rsi]
test dil, dil
js 0x1400ba120
nop word [rax + rax]
mov edx, dword [0x141dd7640]
imul edx, dword [0x141dd7644]
and edx, 0xf89d15c7
add edx, 0x8b150d96
or edx, 0x638caa1f
cmp edx, 0xa19121d5
jb 0x1400ba010
nop word [rax + rax]
mov edx, dword [0x141dd7648]
add edx, dword [0x141dd764c]
imul edx, edx, 0xbc9e3f39
imul rdx, r11
shr rdx, 0x3f
imul edx, edx, 0x7183a930
cmp edx, 0xe06c26f8
ja 0x1400ba040
mov rsi, rax
jmp 0x1400ba2c3
mov rdx, qword [rbp - 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7680]
sub eax, dword [0x141dd7684]
imul eax, eax, 0xf5d59726
xor eax, 0x11b70ce0
imul eax, eax, 0x2e138e43
cmp eax, 0x19cbbfc6
jb 0x1400ba080
cmp r13w, 1
jne 0x1400ba470
mov eax, dword [0x141dd7698]
and eax, dword [0x141dd769c]
and eax, 0x7b43208e
add eax, 0xda79b612
or eax, 0x56dc4709
cmp eax, 0x560f4930
jb 0x1400ba0af
nop word cs:[rax + rax]
mov eax, dword [0x141dd76a0]
xor eax, dword [0x141dd76a4]
imul eax, eax, 0x41ff4b0e
cmp eax, 0x46434e5f
je 0x1400ba0e0
xor edi, edi
mov esi, 0
mov r13d, 0
mov r8d, 0
cmp rbx, rdx
jne 0x1400ba337
jmp 0x1400ba40b
mov eax, dword [0x141dd7628]
or eax, dword [0x141dd762c]
or eax, 0xc08e4904
add eax, 0xf751aaef
cmp eax, 0xfa46528e
ja 0x1400ba120
mov r8d, edi
and r8d, 0x1f
nop word cs:[rax + rax]
mov eax, dword [0x141dd7630]
xor eax, dword [0x141dd7634]
add eax, 0xaa0bf806
and eax, 0xf635e39e
cmp eax, 0x8502b845
je 0x1400ba150
mov eax, dword [0x141dd7638]
or eax, dword [0x141dd763c]
add eax, 0x67dfe84c
and eax, 0x41230028
cmp eax, 0x751c4b09
ja 0x1400ba16d
movzx eax, byte [rsi + 1]
and eax, 0x3f
cmp dil, 0xdf
jbe 0x1400ba245
movzx r9d, byte [rsi + 2]
shl eax, 6
and r9d, 0x3f
or r9d, eax
cmp dil, 0xf0
jb 0x1400ba255
nop word cs:[rax + rax]
mov eax, dword [0x141dd7650]
sub eax, dword [0x141dd7654]
xor eax, 0xe000e878
imul eax, eax, 0xa21d9736
add eax, 0x913567a2
cmp eax, 0x206b1e4b
jb 0x1400ba1c0
mov eax, dword [0x141dd7658]
xor edx, edx
div dword [0x141dd765c]
imul eax, eax, 0xea003aee
imul rdx, rax, 0x13e75945
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1a
imul eax, eax, 0xec7fddc4
cmp eax, 0x34d0de13
je 0x1400ba1e3
shl r8d, 0x12
movzx edi, byte [rsi + 3]
add rsi, 4
and r8d, 0x1c0000
shl r9d, 6
and edi, 0x3f
or edi, r9d
or edi, r8d
cmp edi, 0xffff
ja 0x1400ba26b
jmp 0x1400ba2c3
add rsi, 2
shl r8d, 6
or r8d, eax
mov edi, r8d
jmp 0x1400ba2c3
add rsi, 3
shl r8d, 0xc
or r9d, r8d
mov edi, r9d
cmp edi, 0xffff
jbe 0x1400ba2c3
mov eax, dword [0x141dd7670]
xor edx, edx
div dword [0x141dd7674]
nop dword [rax]
mov eax, dword [0x141dd7678]
or eax, dword [0x141dd767c]
add eax, 0xde0112d2
or eax, 0x1fb4d023
and eax, 0x5fbff8af
cmp eax, 0x8679d36c
ja 0x1400ba280
lea eax, [rdi + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and edi, 0x3ff
or edi, 0xdc00
mov r9d, edi
mov edi, eax
jmp 0x1400ba301
mov eax, dword [0x141dd7660]
xor edx, edx
div dword [0x141dd7664]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7668]
imul eax, dword [0x141dd766c]
or eax, 0xc021e66
and eax, 0x1d4a5ee6
cmp eax, 0xe7f8efe4
je 0x1400ba2e0
xor r9d, r9d
mov eax, dword [0x141dd7688]
xor edx, edx
div dword [0x141dd768c]
nop
mov eax, dword [0x141dd7690]
sub eax, dword [0x141dd7694]
imul eax, eax, 0xef3be03a
add eax, 0x494a335d
cmp eax, 0xde184e94
ja 0x1400ba310
cmp rbx, qword [rbp - 0x10]
je 0x1400ba398
mov r12d, r9d
mov eax, dword [0x141dd76b8]
sub eax, dword [0x141dd76bc]
or eax, 0x743fefd9
add eax, 0xf74cf32b
cmp eax, 0xeaed9ca7
jae 0x1400ba360
mov word [rcx + rbx*2], di
lea rax, [rbx + 1]
mov qword [rbp], rax
mov eax, dword [0x141dd76c0]
imul eax, dword [0x141dd76c4]
imul edx, eax, 0x8e6255fc
lea rax, [rbx + 1]
mov word [rcx + rbx*2], di
mov qword [rbp], rax
cmp edx, 0x4685a13f
je 0x1400ba360
mov rbx, rax
test rsi, rsi
jne 0x1400b9f40
jmp 0x1400ba070
mov rdx, 0xffffffffffffffff
mov eax, dword [0x141dd76a8]
add eax, dword [0x141dd76ac]
or eax, 0x66453ec6
imul eax, eax, 0xd908a05b
add eax, 0x3ad0e9ff
cmp eax, 0x8fb4aa8b
jb 0x1400ba39f
mov rax, qword [rbp + 0x10]
sub rax, rsi
mov ecx, dword [0x141dd76b0]
add ecx, dword [0x141dd76b4]
xor ecx, 0x2a170524
add ecx, 0x1b61210f
mov r8, rax
add r8, 3
cmovb r8, rdx
shr r8, 2
cmp r9w, 1
sbb r8, 0xffffffffffffffff
cmp ecx, 0x21f9a705
jb 0x1400ba3c9
movzx eax, r13w
add r8, rax
mov r12d, r9d
inc r8
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp - 0x10]
mov rdx, rbx
call fcn.1400f2140
mov r11d, 0x82574869
mov r10d, 0x90ec5763
add rsp, 0x30
mov rcx, qword [rbp - 8]
jmp 0x1400ba337
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rcx
mov qword [rbp], 1
jmp 0x1400b9f00
mov rdi, rdx
mov rcx, qword [rbp - 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov qword [rbp + 0x10], rcx
mov edx, dword [rbp - 0x1c]
mov r8d, dword [rbp + 0xc]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
mov qword [rbp - 0x30], rax
cmp rax, 0xffffffffffffffff
mov r12, qword [rbp - 0x78]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
jne 0x1400ba749
mov eax, dword [0x141dd7708]
add eax, dword [0x141dd770c]
and eax, 0x7180120
cmp eax, 0x9dd5a3b6
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
ja 0x1400ba52f
nop
mov esi, dword [0x141dd7710]
imul esi, dword [0x141dd7714]
imul rax, rsi, 0x43506ef5
shr rax, 0x20
sub esi, eax
shr esi, 1
add esi, eax
shr esi, 0x1d
add esi, 0x40234cfc
and esi, 0x2345d4
sub rsp, 0x20
call rbx
add rsp, 0x20
cmp esi, 0x12088be4
jbe 0x1400ba540
sub rsp, 0x20
call rbx
add rsp, 0x20
jmp 0x1400ba4f0
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd7718]
xor edx, edx
div dword [0x141dd771c]
imul eax, eax, 0xa3ab87e
and eax, 0x5afc58fe
cmp eax, 0x83e8ba9a
je 0x1400ba550
mov edx, dword [rbp - 0x20]
cmp edx, 0xa
jge 0x1400ba724
mov eax, dword [0x141dd7798]
sub eax, dword [0x141dd779c]
imul eax, eax, 0x9db36120
add eax, 0x3d74c094
and eax, 0x1c82c74
cmp eax, 0x13524090
je 0x1400ba57c
cmp ecx, 5
jne 0x1400ba5b0
mov eax, edx
mov qword [rbp - 0x38], rax
jmp 0x1400ba61d
mov eax, dword [0x141dd77d8]
xor eax, dword [0x141dd77dc]
xor eax, 0x5be80b55
mov edx, 0xa975941b
imul rax, rdx
shr rax, 0x3f
add eax, 0xc4099911
cmp eax, 0x3b47b38c
jb 0x1400ba5b0
nop word [rax + rax]
mov eax, dword [0x141dd77e0]
sub eax, dword [0x141dd77e4]
imul eax, eax, 0xd762d70d
or eax, 0x547cad20
add eax, 0x9c11505
cmp eax, 0xd3c44e73
jb 0x1400ba5e0
cmp dword [rbp + 0xc], 0
je 0x1400ba724
mov dword [rbp + 0xc], 0
cmp ecx, 0x57
jne 0x1400ba724
test rdi, rdi
je 0x1400ba6d4
mov eax, dword [0x141dd77b8]
and eax, dword [0x141dd77bc]
and eax, 0xa020e4
add eax, 0x3757e986
cmp eax, 0xf934e93a
ja 0x1400ba685
nop word cs:[rax + rax]
mov eax, dword [0x141dd77c0]
xor edx, edx
div dword [0x141dd77c4]
add eax, 0xe9e73e20
imul rcx, rax, 0x22a39941
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
mov rcx, qword [0x141dde6e0]
cmp eax, 0xea6e81f1
jne 0x1400ba690
mov rax, qword [0x141dde6e0]
jmp 0x1400ba650
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0x10]
call r13
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [str.x]
mov ecx, dword [0x141dd77cc]
add eax, ecx
add eax, 0xcee9ce6d
and eax, 0xe0401dca
xor eax, 0xb432e787
cmp eax, 0x59335d8b
ja 0x1400ba6b0
mov ecx, 0x9abcb88b
nop dword [rax]
mov eax, dword [0x141dd77d0]
xor eax, dword [0x141dd77d4]
add eax, 0x843f3255
xor eax, 0x70c7d7e0
shr eax, 1
imul rax, rcx
shr rax, 0x3c
cmp eax, 0x3f9b9258
jae 0x1400ba6e0
mov dword [rbp + 0x10], 0
xor eax, eax
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test al, al
jne 0x1400b97c0
jmp 0x1400b97df
mov eax, dword [0x141dd77a0]
add eax, dword [0x141dd77a4]
and eax, 0x4060115d
cmp eax, 0x5170133d
mov r8, qword [rbp - 0x28]
jne 0x1400bacd8
jmp 0x1400bad07
mov eax, dword [0x141dd76e0]
xor edx, edx
div dword [0x141dd76e4]
mov rsi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x30]
nop word cs:[rax + rax]
mov eax, dword [0x141dd76e8]
xor eax, dword [0x141dd76ec]
xor eax, 0x3e18435
imul eax, eax, 0x66ac669f
add eax, 0x2837bbad
cmp eax, 0xfb457ca8
ja 0x1400ba770
test rdi, rdi
je 0x1400ba7e2
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd76f0]
sub eax, dword [0x141dd76f4]
add eax, 0xe54374b1
or eax, 0x4a9a1060
and eax, 0x4aba1ae1
cmp eax, 0x24fd7f9b
je 0x1400ba7c0
mov eax, dword [0x141dd76f8]
xor eax, dword [0x141dd76fc]
add eax, 0x94b438ae
and eax, 0x597ca548
imul eax, eax, 0x9c57c927
cmp eax, 0x70d4a1a1
jne 0x1400ba865
jmp 0x1400ba8b0
ud2
ud2
mov eax, dword [0x141dd7700]
imul eax, dword [0x141dd7704]
shr eax, 2
imul rax, rax, 0x50463889
shr rax, 0x39
imul eax, eax, 0xea0faeb1
imul rcx, rax, 0x12df6699
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
mov qword [r14 + 0x10], 0
mov dword [r14], 0
cmp eax, 0x2e112bf
jne 0x1400ba8c1
mov qword [r14 + 0x10], 0
mov dword [r14], 0
jmp 0x1400ba865
mov rax, r14
add rax, 0x1c
mov word [rax + 8], 0
mov qword [rax], 0
movzx eax, byte [rbp + 0x1f]
mov byte [r14 + 0x21], al
xor al, 1
mov byte [r14 + 0x20], al
mov dword [r14 + 0x18], 0
mov rax, qword [rbp - 0x50]
mov dword [rax], 0x18
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov qword [r14 + 8], rax
sub rsp, 0x20
mov rcx, r12
mov rdx, qword [rbp - 0x58]
mov r8, r14
call fcn.140095270
add rsp, 0x20
mov rcx, rdx
test rax, rax
je 0x1400ba9a0
nop word [rax + rax]
mov eax, dword [0x141dd7758]
sub eax, dword [0x141dd775c]
cmp eax, 0x43805306
je 0x1400ba930
mov eax, dword [0x141dd7760]
xor edx, edx
div dword [0x141dd7764]
nop word cs:[rax + rax]
mov eax, dword [0x141dd7768]
add eax, dword [0x141dd776c]
xor eax, 0x1ef21eb5
add eax, 0xeae037f
or eax, 0x9726c2a8
cmp eax, 0xfae07487
ja 0x1400ba960
mov qword [rsi + 8], rcx
mov qword [rsi], 1
mov r14, rbx
jmp 0x1400bab22
mov eax, dword [0x141dd7720]
sub eax, dword [0x141dd7724]
and eax, 0xf1f8fc
imul eax, eax, 0x3298d879
or eax, 0xcbd1f300
cmp eax, 0xfb3eecb7
jb 0x1400ba9a0
mov eax, dword [0x141dd7728]
or eax, dword [0x141dd772c]
add eax, 0x30437160
or eax, 0x6aeb389f
xor eax, 0xff3ac523
cmp eax, 0xb207bc96
jbe 0x1400ba9f4
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rcx
mov qword [rsi], 0
mov eax, 0x920343d3
nop dword [rax]
mov edx, dword [0x141dd7730]
imul edx, dword [0x141dd7734]
imul rdx, rax
shr rdx, 0x3f
or edx, 0x793ee868
imul edx, edx, 0xf410e085
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rcx
mov qword [rsi], 0
cmp edx, 0xfa40da2a
je 0x1400baa00
mov rcx, qword [rbp - 0x18]
nop dword [rax]
mov eax, dword [0x141dd7738]
sub eax, dword [0x141dd773c]
add eax, 0x3642c88c
or eax, 0x3f21e8e3
add eax, 0x80dc79aa
cmp eax, 0xb69c3034
ja 0x1400baa40
test rcx, rcx
je 0x1400bab0d
mov eax, dword [0x141dd7740]
xor edx, edx
div dword [0x141dd7744]
add eax, 0x8601fbb8
imul rcx, rax, 0x79754c89
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
cmp eax, 0xb91afb88
jbe 0x1400baaa0
mov rax, qword [0x141dde6e0]
mov eax, dword [0x141dd7748]
and eax, dword [0x141dd774c]
add eax, 0x20b8a9e2
imul rax, rax, 0x247336a1
shr rax, 0x3b
add eax, 0x1ea8aeea
mov rcx, qword [0x141dde6e0]
cmp eax, 0xbe095455
ja 0x1400baaa0
sub rsp, 0x20
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd7750]
xor eax, dword [0x141dd7754]
add eax, 0x1cc8146c
or eax, 0xb4fde7ff
cmp eax, 0xdfe403ef
jbe 0x1400baaf0
movaps xmm6, xmmword [rbp + 0x20]
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp qword [rbp - 0x18], 0
je 0x1400bac10
mov eax, dword [0x141dd7770]
or eax, dword [0x141dd7774]
xor eax, 0x4d7f33a4
imul rax, rax, 0x1f72c0e7
shr rax, 0x3c
add eax, 0x86700b99
cmp eax, 0x39362197
jb 0x1400bab62
mov rdi, qword [0x141dde6e0]
xor eax, eax
test al, al
je 0x1400bab6b
mov rax, qword [0x141dde6e0]
jmp 0x1400bab55
mov eax, dword [0x141dd7778]
imul eax, dword [0x141dd777c]
or eax, 0x8219210
xor eax, 0x9ada18fb
cmp eax, 0x9ab97342
jae 0x1400baba0
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov esi, dword [0x141dd7780]
or esi, dword [0x141dd7784]
or esi, 0x5da5a245
add esi, 0xd0ff8e91
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r12
call r13
add rsp, 0x20
cmp esi, 0x8a1ec3c0
ja 0x1400baba0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7788]
and eax, dword [0x141dd778c]
xor eax, 0xeab1116e
imul eax, eax, 0x5055cf9c
or eax, 0x1383d693
cmp eax, 0xb21416b2
ja 0x1400babe0
nop word cs:[rax + rax]
mov eax, dword [0x141dd7790]
sub eax, dword [0x141dd7794]
or eax, 0xd20112d1
and eax, 0xd6971bd3
imul eax, eax, 0x67eac886
cmp eax, 0x46108bd8
jb 0x1400bac10
cmp rbx, 0xffffffffffffffff
je 0x1400bab0d
mov eax, dword [0x141dd77e8]
or eax, dword [0x141dd77ec]
imul eax, eax, 0x7cf561
add eax, 0xc8773cb2
cmp eax, 0xe900bbe0
ja 0x1400bac95
mov eax, dword [0x141dd77f0]
mov ecx, dword [0x141dd77f4]
lea esi, [rax + rcx]
add esi, 0x390378b1
and esi, 0xceae6df3
add esi, 0xc189bd7f
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
cmp esi, 0x59d04600
jae 0x1400bacb0
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1400bac5b
mov eax, dword [0x141dd77f8]
sub eax, dword [0x141dd77fc]
xor eax, 0x8261010c
or eax, 0x780efea1
imul eax, eax, 0xf539bd2d
cmp eax, 0x2732b1f8
jb 0x1400bacb0
jmp 0x1400bab0d
mov eax, dword [0x141dd77a8]
xor eax, dword [0x141dd77ac]
imul eax, eax, 0x2a19c559
mov rdx, rcx
shl rdx, 0x20
or rdx, 2
mov qword [r8 + 8], rdx
mov qword [r8], 1
cmp eax, 0xe25c1bec
jne 0x1400bad1f
mov rax, rcx
shl rax, 0x20
or rax, 2
mov qword [r8 + 8], rax
mov qword [r8], 1
jmp 0x1400bacd8
mov r14, 0xffffffffffffffff
test rdi, rdi
mov rbx, qword [rbp - 0x30]
je 0x1400bab22
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov eax, dword [0x141dd77b0]
or eax, dword [0x141dd77b4]
imul rax, rax, 0x52897163
shr rax, 0x3e
or eax, 0xc11f8dc
cmp eax, 0xf2cdcb44
jae 0x1400bad50
jmp 0x1400bab22