Function at 0x4018e0
Capabilities:
Connect pipe
Create pipe
Read file on windows
Write file on windows

Disassembly:
push rbp
mov eax, 0x2ad0
call fcn.004032b0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2a60], ecx
mov qword [rbp + 0x2a68], rdx
call dbg.__main
lea rax, str.________________________________________________________________n__________________________________________________________n______________________________________________________n_____________________________________________n________________________________________n____________________________________________n_n
mov qword [rbp + 0x2a30], rax
mov rax, qword [rbp + 0x2a30]
mov rdx, rax
lea rcx, [0x00405272]
call sym.printf
mov dword [rbp + 0x2a3c], 1
jmp 0x401a86
mov eax, dword [rbp + 0x2a3c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
lea rdx, [0x00405275]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x4019e2
mov eax, dword [rbp + 0x2a3c]
add eax, 1
cmp dword [rbp + 0x2a60], eax
jle 0x4019b0
mov eax, dword [rbp + 0x2a3c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x9dc], eax
jmp 0x401a7f
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x20
mov edx, 1
lea rcx, str.____Option__p_requires_a_value._n
call sym.fwrite
mov eax, 1
jmp 0x401d6e
mov eax, dword [rbp + 0x2a3c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
lea rdx, [0x00405299]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x401a7f
mov eax, dword [rbp + 0x2a3c]
add eax, 1
cmp dword [rbp + 0x2a60], eax
jle 0x401a4d
mov eax, dword [rbp + 0x2a3c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x2a40], rax
jmp 0x401a7f
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x21
mov edx, 1
lea rcx, str.____Option__d_requires_a_value.._n
call sym.fwrite
mov eax, 1
jmp 0x401d6e
add dword [rbp + 0x2a3c], 1
mov eax, dword [rbp + 0x2a3c]
cmp eax, dword [rbp + 0x2a60]
jl 0x40193b
mov rdx, qword [rbp + 0x2a40]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x7d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov eax, dword [rbp + 0x9dc]
mov edx, eax
lea rcx, str._n_n_i__PID_to_monitor__t:__lu_n
call sym.printf
mov rax, qword [rbp + 0x2a40]
mov rdx, rax
lea rcx, str._i__DLL_path__t_t:__s_n_n
call sym.printf
mov edx, dword [rbp + 0x9dc]
lea rax, [rbp + 0x7d0]
mov rcx, rax
call sym.InjectDLL
test eax, eax
jne 0x401b28
lea rcx, str.____Error_:_Failed_to_inject_DLL_n
call sym.puts
mov eax, 1
jmp 0x401d6e
lea rcx, str._i__Waiting_for_events_..._n
call sym.puts
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x800
mov dword [rsp + 0x20], 0x800
mov r9d, 0xff
mov r8d, 0
mov edx, 3
lea rcx, str..pipeCrimsonEDRPipe
mov rax, qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call rax
mov qword [rbp + 0x2a28], rax
cmp qword [rbp + 0x2a28], 0xffffffffffffffff
jne 0x401bb0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rdx, str.CreateNamedPipe
lea rcx, str._____s_failed_with_error:__ld_n
call sym.printf
mov eax, 1
jmp 0x401d6e
mov rax, qword [rbp + 0x2a28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call rax
mov dword [rbp + 0x2a24], eax
cmp dword [rbp + 0x2a24], 0
je 0x401cb2
jmp 0x401c7b
mov eax, dword [rbp - 0x34]
mov eax, eax
mov byte [rbp + rax - 0x30], 0
cmp dword [rbp + 0x2a4c], 0x7ff
jg 0x401c65
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.ExtractIDFromJSON
mov dword [rbp + 0x2a20], eax
cmp dword [rbp + 0x2a20], 0xffffffff
je 0x401c7b
mov ecx, dword [rbp + 0x2a4c]
lea rdx, [rbp + 0xa20]
mov eax, dword [rbp + 0x2a20]
mov r8d, ecx
mov ecx, eax
call sym.isIDPresent
test eax, eax
jne 0x401c7b
mov eax, dword [rbp + 0x2a4c]
lea edx, [rax + 1]
mov dword [rbp + 0x2a4c], edx
cdqe
mov edx, dword [rbp + 0x2a20]
mov dword [rbp + rax*4 + 0xa20], edx
lea rax, [rbp - 0x30]
mov rdx, rax
lea rcx, str.____Alert_:__n_s_n_n_n
call sym.printf
jmp 0x401c7b
lea rcx, str.ID_storage_limit_reached.
call sym.puts
mov eax, 0
jmp 0x401d6e
lea rcx, [rbp - 0x34]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x2a28]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x7ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
jne 0x401be0
jmp 0x401cd1
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rdx, str.ConnectNamedPipe
lea rcx, str._____s_failed_with_error:__ld_n
call sym.printf
mov rax, qword [rbp + 0x2a28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp + 0x9e0]
lea rax, [rbp - 0x30]
mov r8d, 0x32
mov rcx, rax
call sym.ExtractProcessStatusFromJSON
test eax, eax
jne 0x401b34
lea rax, [rbp + 0x9e0]
lea rdx, str.Killed
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x401b34
lea rcx, str._n
call sym.puts
lea rcx, str.___Please_enter_a_new_PID_to_monitor_:
call sym.printf
lea rax, [rbp + 0x9dc]
mov rdx, rax
lea rcx, [0x00405431]
call sym.scanf
cmp eax, 1
je 0x401d68
lea rcx, str.____Error_:_Invalid_input_n
call sym.puts
nop
jmp 0x401b34
nop
jmp 0x401acf
add rsp, 0x2ad0
pop rbp
ret