Function at 0x640030
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x110
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], rdx
mov byte [rbp + 0x140], r8b
mov qword [rbp + 0x148], r9
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov dword [rbp + 0xe4], 0
lea rcx, [rbp + 0x60]
mov edx, 0x68
xor r8, r8
call fcn.0040bbc0
lea rcx, [rbp + 0xe8]
mov edx, 0x18
xor r8, r8
call fcn.0040bbc0
mov dword [rbp + 0x60], 0x68
mov dword [rbp + 0x9c], 1
movzx rax, byte [rbp + 0x140]
test al, 2
je 0x6400fd
mov dword [rbp + 0x3c], 5
jmp 0x640104
mov dword [rbp + 0x3c], 0
movzx rax, word [rbp + 0x3c]
mov word [rbp + 0xa0], ax
movzx rax, byte [rbp + 0x140]
test al, 1
je 0x6401c2
cmp qword [rbp + 0x148], 0
jne 0x640139
cmp qword [rbp + 0x150], 0
je 0x6401c2
lea rcx, [rbp + 0xc8]
mov edx, 0x18
xor r8, r8
call fcn.0040bbc0
mov dword [rbp + 0xc8], 0x18
mov dword [rbp + 0xd8], 0xffffffff
lea rcx, [rbp + 0x48]
lea rdx, [rbp + 0x40]
lea r8, [rbp + 0xc8]
xor r9, r9
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x640354
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x50]
lea r8, [rbp + 0xc8]
xor r9, r9
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x640354
lea rax, [rbp + 0x9c]
or dword [rax], 0x100
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb8], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0xc0], rax
mov rcx, rbp
lea rdx, [rbp + 0xe8]
lea r8, [rbp + 0x60]
call fcn.0063fe40
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
je 0x640330
cmp qword [rbp + 0x158], 0
je 0x640206
mov rdi, qword [rbp + 0x158]
lea rsi, [rbp + 0xe8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx rax, byte [rbp + 0x140]
test al, 1
je 0x640330
nop
cmp qword [rbp + 0x148], 0
jne 0x640230
cmp qword [rbp + 0x150], 0
je 0x6402eb
mov rcx, qword [0x004af0e0]
mov dl, 1
mov r8, qword [rbp + 0x58]
call fcn.004e6d00
mov qword [rbp + 0x100], rax
mov rcx, qword [0x004af0e0]
mov dl, 1
mov r8, qword [rbp + 0x48]
call fcn.004e6d00
mov qword [rbp + 0x108], rax
nop
mov rcx, rbp
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x150]
call fcn.0063ff30
mov rcx, rbp
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x148]
call fcn.0063ff30
mov rcx, qword [rbp + 0xe8]
mov edx, 0xa
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x640263
mov rcx, rbp
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x150]
call fcn.0063ff30
mov rcx, rbp
mov rdx, qword [rbp + 0x108]
mov r8, qword [rbp + 0x148]
call fcn.0063ff30
nop
mov rcx, qword [rbp + 0x108]
call fcn.0040ccc0
mov rcx, qword [rbp + 0x100]
call fcn.0040ccc0
jmp 0x6402fa
mov rcx, qword [rbp + 0xe8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
cmp qword [rbp + 0x160], 0
je 0x640317
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0x160]
call sub.kernel32.dll_GetExitCodeProcess
nop
mov rcx, qword [rbp + 0xf0]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0xe8]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x40]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x58]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rbp + 0x50]
call sub.kernel32.dll_CloseHandle
mov eax, dword [rbp + 0xe4]
lea rsp, [rbp + 0x110]
pop rsi
pop rdi
pop rbp
ret