Function at 0x14005ecf0
Capabilities:
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc0], xmm6
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov qword [rbp + 0x70], rcx
mov byte [rbp + 0xb5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
mov r12d, 8
mov sil, 1
xorps xmm6, xmm6
lea rbx, [rbp + 0x20]
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor edi, edi
xor eax, eax
mov qword [rbp - 8], rax
nop word cs:[rax + rax]
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [rbp + 0x5c], eax
mov rax, qword [0x140098200]
test rax, rax
jne 0x14005eda6
nop word cs:[rax + rax]
movaps xmmword [rbp + 0x20], xmm6
mov edx, 0x10
mov rcx, rbx
call r13
mov rax, qword [rbp + 0x20]
mov qword [0x140098200], rax
mov rax, qword [0x140098200]
test rax, rax
je 0x14005ed80
mov eax, 1
lock xadd qword [0x140098200], rax
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x5c]
mov qword [rbp], rax
lea rax, [fcn.140074890]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, [fcn.1400749b0]
mov qword [rbp + 0x18], rax
lea rax, str.0Y_b_
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 2
mov qword [rbp + 0x40], 0
mov rax, rbp
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 2
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x78], r14
mov byte [rbp + 0xb7], dil
mov byte [rbp + 0xb6], 1
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.1400702c0
test r14, r14
sete al
or sil, al
test sil, 1
jne 0x14005ee4d
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.1400098c0
mov rsi, r13
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
mov r10, qword [rbp - 0x28]
lea rax, [r9 + r10]
mov qword [rbp + 0xa8], rax
test r10, r10
mov qword [rbp + 0x68], r8
mov qword [rbp + 0x90], r9
mov dword [rbp + 0x60], r12d
mov qword [rbp - 0x10], r10
je 0x14005eea0
movzx ecx, byte [r9]
movzx r13d, cl
test r13b, r13b
js 0x14005eed0
lea r15, [r9 + 1]
jmp 0x14005ef34
mov eax, 4
mov qword [rbp + 0x88], rax
mov ebx, 8
xor r12d, r12d
xor r15d, r15d
xor r13d, r13d
xor r14d, r14d
jmp 0x14005ef93
mov eax, r13d
and eax, 0x1f
movzx edx, byte [r9 + 1]
and edx, 0x3f
cmp r13b, 0xdf
jbe 0x14005ef28
movzx r13d, byte [r9 + 2]
shl edx, 6
and r13d, 0x3f
or r13d, edx
cmp cl, 0xf0
jb 0x14005f2f4
lea r15, [r9 + 4]
movzx ecx, byte [r9 + 3]
and eax, 7
shl eax, 0x12
shl r13d, 6
and ecx, 0x3f
or ecx, r13d
or ecx, eax
mov r13d, ecx
cmp r13d, 0xffff
jbe 0x14005ef34
jmp 0x14005f30b
lea r15, [r9 + 2]
shl eax, 6
or eax, edx
mov r13d, eax
mov eax, 1
xor r12d, r12d
mov rcx, qword [rbp + 0xa8]
sub rcx, r15
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
add rcx, rax
cmp rcx, 4
mov edx, 3
cmovae rdx, rcx
lea rbx, [rdx*2 + 2]
movabs rax, 0x3ffffffffffffffe
cmp rcx, rax
ja 0x14005f4a1
inc rdx
mov qword [rbp + 0x88], rdx
mov r14w, 1
movzx eax, byte [0x140098141]
mov edi, 2
mov edx, 2
mov rcx, rbx
call fcn.1400098b0
test rax, rax
je 0x14005f4a3
mov rcx, rax
mov rax, qword [rbp - 8]
inc eax
mov dword [rbp + 0x9c], eax
mov word [rcx], r13w
mov ebx, 1
mov rdx, qword [rbp + 0x88]
jmp 0x14005eff3
mov rdi, rdx
mov eax, r12d
mov word [rcx + rbx*2], ax
inc rbx
mov rdx, rdi
mov r12d, r13d
test r15, r15
mov r13, rsi
je 0x14005f0a0
test r12w, r12w
je 0x14005f060
xor r13d, r13d
cmp rbx, rdx
jne 0x14005efe0
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa8]
sub rax, r15
add rax, 3
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
shr rax, 2
movzx ecx, r14w
cmp r13w, 1
sbb rax, 0xffffffffffffffff
add rax, rcx
lea rcx, [rax + 1]
add rcx, rbx
mov qword [rbp + 0x88], rdx
jae 0x14005f0db
jmp 0x14005f498
cmp r15, qword [rbp + 0xa8]
je 0x14005f0a0
mov r9, rcx
movzx ecx, byte [r15]
movzx r12d, cl
test r12b, r12b
js 0x14005f16c
inc r15
mov rcx, r9
xor r13d, r13d
cmp rbx, rdx
jne 0x14005efe0
jmp 0x14005f00d
cmp r14w, 1
jne 0x14005f240
xor r15d, r15d
xor eax, eax
cmp rbx, rdx
jne 0x14005f130
mov qword [rbp + 0xa0], rcx
xor r14d, r14d
mov r13d, r12d
xor r12d, r12d
xor eax, eax
lea rcx, [rax + 1]
add rcx, rbx
mov qword [rbp + 0x88], rdx
jb 0x14005f498
lea rdi, [rax + rbx]
inc rdi
lea rcx, [rdx + rdx]
cmp rcx, rdi
cmova rdi, rcx
mov r9, rdx
xor edx, edx
mov rax, rdi
shr rax, 0x3e
sete al
cmp rdi, 5
mov r8d, 4
cmovb rdi, r8
test r9, r9
je 0x14005f13e
mov r8, qword [rbp + 0xa0]
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x30], rcx
mov ecx, 2
jmp 0x14005f140
mov rdi, rdx
mov r13d, r12d
xor r14d, r14d
jmp 0x14005efe6
xor ecx, ecx
lea r8, [rdi + rdi]
mov dl, al
add edx, edx
mov qword [rbp + 0x28], rcx
mov rcx, rbp
lea r9, [rbp + 0x20]
call fcn.140053200
cmp qword [rbp], 0
jne case.0x140057ce4.208
mov rcx, qword [rbp + 8]
jmp 0x14005efe3
mov r8, rdx
mov eax, r12d
and eax, 0x1f
movzx edx, byte [r15 + 1]
and edx, 0x3f
cmp r12b, 0xdf
jbe 0x14005f1ca
movzx r12d, byte [r15 + 2]
shl edx, 6
and r12d, 0x3f
or r12d, edx
cmp cl, 0xf0
jb 0x14005f1ed
movzx ecx, byte [r15 + 3]
add r15, 4
and eax, 7
shl eax, 0x12
shl r12d, 6
and ecx, 0x3f
or ecx, r12d
or ecx, eax
mov r12d, ecx
mov rdx, r8
mov rcx, r9
cmp r12d, 0xffff
jbe 0x14005f005
jmp 0x14005f20a
add r15, 2
shl eax, 6
or eax, edx
mov r12d, eax
mov rdx, r8
mov rcx, r9
xor r13d, r13d
cmp rbx, rdx
jne 0x14005efe0
jmp 0x14005f00d
add r15, 3
shl eax, 0xc
or r12d, eax
mov rdx, r8
mov rcx, r9
cmp r12d, 0xffff
jbe 0x14005f005
lea eax, [r12 + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and r12d, 0x3ff
or r12d, 0xdc00
mov r13d, r12d
mov r12d, eax
cmp rbx, rdx
jne 0x14005efe0
jmp 0x14005f00d
mov rsi, rdx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rdi, rcx
mov edx, dword [rbp + 0x64]
mov r12d, dword [rbp + 0x60]
mov r8d, r12d
mov r9d, 1
call qword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
mov r14, qword [rbp + 0x68]
jne 0x14005f3a6
call qword [sym.imp.kernel32.dll_GetLastError]
cmp dword [rbp + 0x9c], 9
mov r15, qword [rbp + 0x90]
mov rdx, rsi
jg 0x14005f339
mov rcx, rdi
cmp eax, 5
jne 0x14005f2c0
mov eax, dword [rbp + 0x9c]
mov qword [rbp - 8], rax
jmp 0x14005f2cd
test r12d, r12d
je 0x14005f339
xor r12d, r12d
cmp eax, 0x57
jne 0x14005f339
mov dil, 1
xor esi, esi
test rdx, rdx
lea rbx, [rbp + 0x20]
je 0x14005ed60
add rdx, rdx
mov r8d, 2
call fcn.1400098c0
xor esi, esi
jmp 0x14005ed60
lea r15, [r9 + 3]
shl eax, 0xc
or r13d, eax
cmp r13d, 0xffff
jbe 0x14005ef34
lea ecx, [r13 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov eax, 2
mov r12d, r13d
mov r13d, ecx
jmp 0x14005ef3c
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp + 0x70]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rdx, rdx
je 0x14005f366
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.1400098c0
test r14, r14
je 0x14005f37c
mov r8d, 1
mov rcx, r15
mov rdx, r14
call fcn.1400098c0
cmp rbx, 0xffffffffffffffff
je 0x14005f38b
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
test rsi, rsi
mov r15, qword [rbp + 0x90]
je 0x14005f3c6
mov rdx, rsi
add rdx, rsi
mov r8d, 2
mov rcx, rdi
call fcn.1400098c0
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x40], 0
mov word [rbp + 0x44], 0
movzx eax, byte [rbp + 0xb5]
mov byte [rbp + 0x41], al
xor al, 1
mov byte [rbp + 0x40], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp], 0x18
mov qword [rbp + 8], 0
mov dword [rbp + 0x10], 1
mov rax, rbp
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x78], r14
mov qword [rbp - 0x20], rbx
mov byte [rbp + 0xb7], 1
mov byte [rbp + 0xb6], 0
lea r8, [rbp + 0x20]
mov rcx, r15
mov rdx, qword [rbp - 0x10]
call fcn.14005dbc0
test rax, rax
je 0x14005f45c
mov rax, qword [rbp + 0x70]
mov qword [rax + 8], rdx
mov qword [rax], 1
test r14, r14
jne 0x14005f36b
jmp 0x14005f37c
mov rax, qword [rbp + 0x70]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
mov qword [rax], 0
test r14, r14
je 0x14005f38b
mov r8d, 1
xor ecx, ecx
xor edi, edi
mov rax, qword [rbp + 0x90]