Function at 0x140009cf0
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov r12d, edx
mov r14, rcx
mov rax, qword [0x140051088]
xor rax, rsp
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x78], 0
movzx eax, word [0x140041224]
mov word [rsp + 0x94], ax
mov eax, dword [0x140041220]
mov dword [rsp + 0x90], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x88]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140009fa6
mov rcx, qword [rsp + 0x88]
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x20], rbp
xor ebx, ebx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140009fae
mov rdi, qword [rsp + 0x80]
mov edx, 1
mov rcx, rdi
call fcn.14002c370
test rax, rax
je 0x140009fa6
mov rsi, rax
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x20], rbp
mov edx, 1
mov r8, rax
mov r9d, edi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000a02c
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x90]
xor edi, edi
mov dl, 1
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rcx, qword [rsi]
mov rbp, qword [sym.imp.ADVAPI32.dll_GetLengthSid]
call rbp
mov ebx, eax
mov rcx, qword [rsp + 0x78]
call rbp
add ebx, eax
add ebx, 0x1b
and ebx, 0xfffffffc
mov edx, 1
mov rcx, rbx
call fcn.14002c370
test rax, rax
je 0x14000a03c
mov r15, rax
mov rcx, rax
mov edx, ebx
mov r8d, 2
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x14000a032
mov r9, qword [rsi]
mov rcx, r15
mov edx, 2
mov r8d, 0x10000000
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x14000a032
mov r9, qword [rsp + 0x78]
mov rcx, r15
mov edx, 2
mov r8d, 0xc0000000
call qword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x14000a032
mov ecx, 1
mov edx, 0x28
call fcn.14002c370
test rax, rax
je 0x14000a032
mov rbx, rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x14000a034
mov rcx, rbx
mov edx, 1
mov r8, r15
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x14000a034
mov dword [rsp + 0x60], 0x18
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x68], rbx
mov ecx, 1
mov edx, 0x10
call fcn.14002c370
mov rsi, rax
mov byte [rax + 8], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 0x4000
mov dword [rsp + 0x20], 0x4000
mov rcx, r14
mov edx, 0x40000003
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x14000a007
jmp 0x140009fe9
xor edi, edi
xor esi, esi
xor ebx, ebx
jmp 0x140009fb2
xor edi, edi
xor esi, esi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140009fc2
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test rbx, rbx
je 0x140009fcf
mov rcx, rbx
call fcn.14002c850
test rdi, rdi
je 0x140009fdc
mov rcx, rdi
call fcn.14002c850
test rsi, rsi
je 0x140009fe9
mov rcx, rsi
call fcn.14002c850
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140009ff8
call fcn.14002c850
test rsi, rsi
je 0x14000a005
mov rcx, rsi
call fcn.14002c850
xor esi, esi
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140021820
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edi, edi
xor ebx, ebx
jmp 0x140009fb2
xor ebx, ebx
mov rdi, r15
jmp 0x140009fb2
xor ebx, ebx
jmp 0x140009fb2