Function at 0x1800168f0
Capabilities:
Create pipe
Encode data using xor
Set current directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov eax, dword [rsp + 0xd8]
lea r13d, [rdx + 0xaf2]
mov r8d, dword [rsp + 0xb8]
mov r9d, dword [rsp + 0xc8]
mov r12d, dword [rsp + 0xc0]
lea r10d, [rax - 0x32ec]
add r12d, 0xffffcfad
lea ecx, [r8 - 0x698]
mov dword [rsp + 0xd8], ecx
lea r14d, [r8 - 0x757]
mov ecx, dword [rsp + 0xe0]
lea ebp, [rax + 0x5f7]
lea r15d, [rax - 0x16a]
lea eax, [r14 - 0x99]
lea r11d, [r9 - 0x378a]
lea r8d, [rcx - 0x49e]
lea edx, [rcx - 0x378a]
mov dword [rsp + 0xc8], r8d
lea ecx, [r9 + 0x27b]
cmp ecx, eax
jle 0x180016d50
mov rsi, qword [rsp + 0xd0]
lea eax, [r15 + 0x4a8]
cmp edx, eax
jge 0x180016a01
mov dword [rsi + 0x508], 0x1196d
sub ebp, 0x890
mov dword [rsi + 0x50c], 0x1546c
mov dword [rsi + 0x518], 2
mov rax, qword [rsi + 0x230]
add rax, 0x38e3
or qword [rsi + 0x108], rax
mov rax, qword [rsi + 0x170]
xor rax, 0x3a6b
sub qword [rsi + 0x30], rax
mov dword [rsi + 0x51c], 5
mov r10d, dword [rsp + 0xc8]
lea edi, [rdx + 0x32ec]
lea eax, [rbp + 0x139]
add r10d, 0x129
mov dword [rsp + 0x58], eax
lea r8d, [r13 - 0x6c8]
mov dword [rsp + 0x50], edi
lea ebx, [r14 + 0x49e]
mov dword [rsp + 0x48], r10d
lea r9d, [r13 - 0x66]
mov dword [rsp + 0x40], r8d
lea edx, [rbp - 0xda]
add r11d, 0x3c32
lea ecx, [r15 - 0x8f]
mov dword [rsp + 0x38], r11d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.180001c24
xor r11d, r11d
lea ebx, [r11 + 1]
cmp dword [rsi + 0x4d4], r11d
jle 0x180016cf8
mov edi, 0xd8f
mov ebp, 0x8000001f
mov r14d, 0x3c33
add qword [rsi + 0x198], 0xffffffffffffc9c1
mov r10, qword [rsi + 0x510]
mov r8, qword [rsi + 0x190]
mov edx, dword [r10 + 0x280]
mov ecx, dword [r8 + 0x4f8]
xor edx, 0x7d9
movsxd rax, edx
xor rcx, rdi
cmp rax, rcx
jae 0x180016ae9
lea r9, [rsi + 0xc8]
add edx, ebx
mov qword [rsi + 0x2b0], r9
mov ecx, dword [r8 + 0x4f8]
xor rcx, rdi
movsxd rax, edx
cmp rax, rcx
jb 0x180016ace
cmp qword [rsi + 0xd8], 0x3655
jae 0x180016b0f
mov rcx, qword [rsi + 0x498]
lea rax, [r10 + 0x170]
imul rcx, rax
mov qword [rsi + 0x498], rcx
xor r9d, r9d
cmp dword [rsi + 0x4d8], r9d
jle 0x180016c32
mov r8, qword [rsi + 0x338]
movsxd rax, dword [rsi + 0x504]
movsxd rdx, dword [rsi + 0x500]
mov ecx, dword [r8 + rax*4]
xor dword [r8 + rdx*4], ecx
mov ecx, dword [rsi + 0x51c]
and ecx, ebp
jge 0x180016b4d
sub ecx, ebx
or ecx, 0xffffffe0
add ecx, ebx
mov rdx, qword [rsi + 0x338]
movsxd rax, dword [rsi + 0x500]
mov r8d, dword [rdx + rax*4]
test ecx, ecx
je 0x180016b66
ror r8d, cl
movsxd rax, dword [rsi + 0x504]
add dword [rdx + rax*4], r8d
xor qword [rsi + 0x30], 0xfffffffffffff8e7
mov rax, qword [rsi + 0x108]
mov rdx, qword [rsi + 0xe8]
add rax, 0x3a05
or qword [rsi + 0x2a0], rax
imul ecx, dword [rdx + 0x280], 0xe3617cc4
cmp rcx, qword [rsi + 0x230]
jae 0x180016bbe
imul rax, qword [rsi + 0xa0], 0x3415
mov rcx, qword [rdx + 0x48]
imul rcx, rax
mov qword [rdx + 0x48], rcx
mov eax, dword [rsi + 0x500]
add eax, ebx
cdq
idiv dword [rsi + 0x348]
mov dword [rsi + 0x500], edx
imul edx, dword [rsi + 0x168], 0x69d9db7a
cmp edx, r14d
jge 0x180016c0d
mov r8, qword [rsi + 0x328]
mov eax, r14d
mov rcx, qword [rsi + 0xb0]
add r8, 0x3182
sub eax, edx
mov edx, eax
or rcx, r8
sub rdx, rbx
jne 0x180016bfe
mov qword [rsi + 0xb0], rcx
mov eax, dword [rsi + 0x504]
add r9d, ebx
add eax, ebx
cdq
idiv dword [rsi + 0x348]
mov dword [rsi + 0x504], edx
cmp r9d, dword [rsi + 0x4d8]
jl 0x180016b1f
mov rax, qword [rsi + 0x78]
add qword [rsi + 0x170], rax
mov qword [rsi + 0x28], 0x4af
dec rax
mov qword [rsi + 0x78], rax
movsxd rcx, dword [rsi + 0x504]
mov rax, qword [rsi + 0x338]
movsxd r8, dword [rsi + 0x500]
mov rdx, qword [rsi + 0x330]
mov ecx, dword [rax + rcx*4]
add dword [rdx + r8*4], ecx
mov rcx, qword [rsi + 0x360]
mov rax, qword [rsi + 0x30]
add rcx, 0xffffffffffffce74
mov qword [rsi + 0x380], rcx
cmp qword [rsi + 0xd8], rax
jb 0x180016c9f
lea rax, [rcx + 0x3415]
mov qword [rsi + 0x340], rax
mov ecx, dword [rsi + 0x518]
and ecx, ebp
jge 0x180016cb0
sub ecx, ebx
or ecx, 0xffffffe0
add ecx, ebx
mov rax, qword [rsi + 0x338]
test ecx, ecx
je 0x180016ccb
movsxd rdx, dword [rsi + 0x500]
mov r8d, dword [rax + rdx*4]
ror r8d, cl
jmp 0x180016cd6
movsxd rcx, dword [rsi + 0x500]
mov r8d, dword [rax + rcx*4]
movsxd rcx, dword [rsi + 0x504]
add r11d, ebx
mov rax, qword [rsi + 0x330]
add dword [rax + rcx*4], r8d
cmp r11d, dword [rsi + 0x4d4]
jl 0x180016a8f
mov r8, qword [rsi + 0x128]
mov r9d, 0x109
mov edx, 0x362a
mov eax, dword [r8 + 0x328]
add eax, r9d
cmp eax, edx
jbe 0x180016d37
add edx, ebx
mov qword [rsi + 0xa0], 0x9538a73
mov ecx, dword [r8 + 0x328]
add ecx, r9d
movsxd rax, edx
cmp rax, rcx
jb 0x180016d18
mov rax, qword [rsi + 0x360]
or rax, 0x318c
sub qword [rsi + 0x170], rax
jmp 0x180016e32
mov rbx, qword [rsp + 0xd0]
movsxd rbp, r10d
mov rcx, qword [rbx + 0x78]
add rcx, qword [rbx + 0x380]
movsxd rdi, dword [rbx + 0x328]
add rcx, rbp
cmp rdi, rcx
ja 0x180016e32
imul r14d, r11d
lea eax, [rdx - 0x362a]
mov esi, r12d
movsxd r15, eax
imul esi, r10d
mov ecx, dword [rbx + 0x180]
add ecx, r13d
or ecx, r8d
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movsxd rdx, dword [rsp + 0xd8]
mov r10d, dword [rbx + 0x2a8]
mov r9, rdx
mov r8d, dword [rsp + 0xb0]
xor r10d, 0x2f79
mov ecx, dword [rbx + 0x360]
add r8d, 0xffffcc5d
add r8d, dword [rbx + 0x270]
or r9, 0x3c12
imul eax, edx, 0x33a3
sub ecx, r12d
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r14d
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
sub qword [rbx + 0x2d0], r15
add edi, 2
mov eax, dword [rbx + 0x2d0]
mov rcx, qword [rbx + 0x78]
add eax, esi
add rcx, qword [rbx + 0x380]
add dword [rsp + 0xd8], eax
add rcx, rbp
mov r8d, dword [rsp + 0xc8]
movsxd rax, edi
cmp rax, rcx
jbe 0x180016d8d
mov eax, dword [rsp + 0xd8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
add eax, 0x7ba
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret