Function at 0x1400efc00
Capabilities:
Connect pipe
Create pipe

Disassembly:
push r13
push r14
sub rsp, 0x508
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x14020e418]
xor r13d, r13d
test rcx, rcx
lea r14d, [r13 + 1]
je 0x1400efc67
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 4
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov qword [rsp + 0x520], rbx
call fcn.1400d8ac0
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x78], r14d
call fcn.1400ed0b0
test rax, rax
mov qword [rsp + 0x70], rax
je 0x1400f0835
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x4f8], r12
or r12, 0xffffffffffffffff
call fcn.140177280
mov rdx, qword [0x14020e420]
test rdx, rdx
je 0x1400efcd0
lea rcx, [rsp + 0x2c0]
call fcn.14017d850
jmp 0x1400efd39
lea rcx, [rsp + 0xb0]
call fcn.140177280
lea rdx, str..PIPEEverything_Service
lea rcx, [rsp + 0xb0]
call fcn.140177fb0
call fcn.1400ce420
test rax, rax
je 0x1400efd17
call fcn.1400ce420
lea rdx, str.___s_
lea rcx, [rsp + 0xb0]
mov r8, rax
call fcn.140178bf0
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x2c0]
call fcn.14017d850
lea rcx, [rsp + 0xb0]
call fcn.14017d580
mov rdx, qword [rsp + 0x2c8]
lea rcx, str.createnamedpipe__S_n
call fcn.1400b3fb0
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b3fb0
mov rcx, qword [0x14020e410]
call fcn.1400d8b10
test eax, eax
jne 0x1400f0815
mov qword [rsp + 0x528], rbp
mov qword [rsp + 0x530], rsi
mov qword [rsp + 0x500], rdi
mov qword [rsp + 0x4f0], r15
mov r15d, 0x3e8
nop
nop
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x14020e3e0]
test r11, r11
mov rbp, r11
je 0x1400f0188
mov rax, qword [r11]
mov rcx, qword [0x14020e3e8]
test rax, rax
mov qword [0x14020e3e0], rax
cmove rcx, r13
mov qword [0x14020e3e8], rcx
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rbp + 8]
lea rcx, str.device_event__08x_n
call fcn.1400b3fb0
mov r11d, dword [rbp + 8]
sub r11d, 0x8001
je 0x1400f0148
sub r11d, r14d
je 0x1400f007e
sub r11d, r14d
je 0x1400f0050
sub r11d, r14d
je 0x1400eff65
cmp r11d, 2
jne 0x1400f0157
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0157
lea r8d, [r11 + 0xe]
lea rdx, [0x1401b0e50]
add rcx, 0x20
call fcn.1400db340
test eax, eax
je 0x1400efe81
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_n
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
call fcn.1400edd40
jmp 0x1400f0157
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e60]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db340
test eax, eax
je 0x1400efeb9
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_FAILED_n
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
call fcn.1400edf00
jmp 0x1400f0157
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e80]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db340
test eax, eax
je 0x1400efef1
lea rcx, str.GUID_IO_VOLUME_LOCK_n
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
call fcn.1400edd40
jmp 0x1400f0157
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e90]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db340
test eax, eax
je 0x1400eff29
lea rcx, str.GUID_IO_VOLUME_LOCK_FAILED_n
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
call fcn.1400edf00
jmp 0x1400f0157
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0ea0]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db340
test eax, eax
je 0x1400f0157
lea rcx, str.GUID_IO_VOLUME_UNLOCK_n
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
call fcn.1400edf00
jmp 0x1400f0157
mov rsi, qword [rbp + 0x10]
cmp dword [rsi + 4], 6
jne 0x1400f0157
mov rdx, qword [rsi + 0x10]
lea rcx, str.monitor_unregister_device_notification_by_handle__p_n
call fcn.1400b3fb0
mov r11, qword [0x14020e3f0]
test r11, r11
je 0x1400f0157
nop
nop
nop
nop
mov edx, dword [r11 + 0xa8]
mov ecx, r13d
test edx, edx
je 0x1400effd4
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x78], r8
je 0x1400f0014
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400effc0
mov edx, dword [r11 + 0xb8]
mov ecx, r13d
test edx, edx
je 0x1400f0007
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x80], r8
je 0x1400f002f
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400efff0
mov r11, qword [r11]
test r11, r11
jne 0x1400effa0
jmp 0x1400f0157
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x1400f0157
call fcn.1400d8e00
mov qword [rdi + 0x78], r13
jmp 0x1400f0157
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x1400f0157
call fcn.1400d8e00
mov qword [rdi + 0x80], r13
jmp 0x1400f0157
mov rax, qword [rbp + 0x10]
lea rcx, str.dbch_devicetype__d__dbch_size__d_n
mov r8d, dword [rax]
mov edx, dword [rax + 4]
call fcn.1400b3fb0
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0157
call fcn.1400edd40
jmp 0x1400f0157
mov rdi, qword [rbp + 0x10]
cmp dword [rdi + 4], 6
jne 0x1400f0157
mov rdx, qword [rdi + 0x10]
lea rcx, str.restart_monitor_by_handle__p_n
call fcn.1400b3fb0
mov r11, qword [0x14020e3f0]
test r11, r11
je 0x1400f0157
nop
mov r8d, dword [r11 + 0xa8]
mov ecx, r13d
test r8d, r8d
je 0x1400f00e5
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x78], r9
je 0x1400f0122
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400f00d0
mov r8d, dword [r11 + 0xb8]
mov ecx, r13d
test r8d, r8d
je 0x1400f0118
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x80], r9
je 0x1400f0135
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400f0100
mov r11, qword [r11]
test r11, r11
jne 0x1400f00b0
jmp 0x1400f0157
mov rcx, qword [0x14020e408]
mov dword [rdx + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400f0157
mov rcx, qword [0x14020e408]
mov dword [rdx + 0x58], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400f0157
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0157
call fcn.1400edd40
mov rcx, qword [rbp + 0x10]
call fcn.1400cf780
mov rcx, rbp
call fcn.1400cf780
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x14020e3e0]
test r11, r11
mov rbp, r11
jne 0x1400efdd0
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [rsp + 0x2b0]
cmp r11d, 0x40
jae 0x1400f01bc
mov rax, qword [0x14020e408]
mov qword [rsp + r11*8 + 0xb0], rax
add dword [rsp + 0x2b0], r14d
jmp 0x1400f01c4
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
jne 0x1400f041b
cmp dword [0x14020e204], 6
jb 0x1400f0213
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
lea r8d, [r12 + 9]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov edx, 0x40000003
mov r9d, 0xff
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
jmp 0x1400f024b
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
cmp r12, 0xffffffffffffffff
je 0x1400f0578
lea rcx, str.connect..._n
call fcn.1400b3fb0
lea rdx, [rsp + 0x88]
mov rcx, r12
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0x9c], r13d
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400f033f
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9330
mov qword [rdi + 0x50], r12
call fcn.1400d8ac0
mov qword [rdi + 0x28], rax
call fcn.1400d8ac0
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f02f3
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f02fe
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f031d
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
jmp 0x1400f041b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1400f0409
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9330
mov qword [rdi + 0x50], r12
call fcn.1400d8ac0
mov qword [rdi + 0x28], rax
call fcn.1400d8ac0
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f03b9
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f03c4
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f03e3
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400f01c4
cmp eax, 0x218
je 0x1400f041b
cmp eax, 0x3e5
jne 0x1400f0547
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400f0504
lea rcx, str.connected_n
call fcn.1400b3fb0
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9330
mov qword [rdi + 0x50], r12
call fcn.1400d8ac0
mov qword [rdi + 0x28], rax
call fcn.1400d8ac0
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f04b4
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f04bf
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f04de
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400f01c4
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f0533
mov rax, qword [rsp + 0xa0]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f053b
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
je 0x1400f01c4
jmp 0x1400f059a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.connect_named_pipe_failed__d_n
mov edx, eax
call fcn.1400b3fb0
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
or r12, 0xffffffffffffffff
jmp 0x1400f059a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_createnamedpipe__d_n
mov edx, eax
call fcn.1400b3fb0
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
mov rdi, qword [0x14020e3f0]
test rdi, rdi
je 0x1400f0765
nop
nop
mov edx, dword [rdi + 0x58]
mov rbx, qword [rdi]
lea rcx, str.update_client__d_n
call fcn.1400b3fb0
mov rcx, rdi
call fcn.1400ed1f0
mov rcx, rdi
call fcn.1400ef090
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400ef220
cmp dword [rdi + 0x5c], r13d
je 0x1400f0608
mov edx, dword [rdi + 0x58]
lea rcx, str._d:_disconnected._n
call fcn.1400b3fb0
mov rcx, rdi
call fcn.1400ef850
mov edx, dword [rsp + 0x2b0]
jmp 0x1400f0755
cmp qword [rdi + 0x80], r13
je 0x1400f065e
cmp dword [rdi + 0x90], r13d
je 0x1400f065e
mov edx, dword [rdi + 0x58]
lea rcx, str.client__d_write_pending_n
call fcn.1400b3fb0
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f0654
mov rax, qword [rdi + 0x48]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0665
mov dword [rsp + 0x2b4], r14d
jmp 0x1400f0665
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f068b
mov rax, qword [rdi + 0x28]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0693
mov dword [rsp + 0x2b4], r14d
cmp dword [rdi + 0xa8], r13d
mov r9d, r13d
jbe 0x1400f06f4
mov r8, r13
mov rax, qword [rdi + 0xa0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x80], 2
jne 0x1400f06e4
cmp edx, 0x40
jae 0x1400f06dc
mov rax, qword [rax + 0x70]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f06e4
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xa8]
jb 0x1400f06a2
cmp dword [rdi + 0xb8], r13d
mov r9d, r13d
jbe 0x1400f0755
mov r8, r13
mov rax, qword [rdi + 0xb0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x88], 2
jne 0x1400f0745
cmp edx, 0x40
jae 0x1400f073d
mov rax, qword [rax + 0x78]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0745
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xb8]
jb 0x1400f0703
test rbx, rbx
mov rdi, rbx
jne 0x1400f05b0
mov ebx, dword [rsp + 0x40]
cmp dword [rsp + 0x2b4], r13d
lea rcx, str.sleep__d__d_n
cmovne ebx, r14d
mov r8d, ebx
call fcn.1400b3fb0
mov ecx, dword [rsp + 0x2b0]
or r9d, 0xffffffff
test ebx, ebx
lea rdx, [rsp + 0xb0]
cmovne r9d, r15d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [0x14020e408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b3fb0
mov rcx, qword [0x14020e410]
call fcn.1400d8b10
test eax, eax
je 0x1400efdb0
cmp r12, 0xffffffffffffffff
mov r15, qword [rsp + 0x4f0]
mov rdi, qword [rsp + 0x500]
mov rsi, qword [rsp + 0x530]
mov rbp, qword [rsp + 0x528]
je 0x1400f0815
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x2c0]
call fcn.14017d580
mov r12, qword [rsp + 0x4f8]
mov rcx, qword [0x14020e418]
test rcx, rcx
je 0x1400f0878
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x14020e3f0]
test rcx, rcx
je 0x1400f0894
mov rbx, qword [rcx]
call fcn.1400ef850
test rbx, rbx
mov rcx, rbx
jne 0x1400f0884
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14020e418]
mov rbx, qword [rsp + 0x520]
test rcx, rcx
je 0x1400f08ea
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1401a8fb0
add rsp, 0x508
pop r14
pop r13
ret