Function at 0x14015c976
Capabilities:
Check if file exists
Connect pipe
Create pipe
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x150
movaps xmmword [rsp + 0x140], xmm6
mov rsi, rcx
mov rax, qword [0x14033f038]
xor rax, rsp
mov qword [rsp + 0x138], rax
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
mov qword [rcx + 0x18], rax
movabs rdx, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x130], rdx
movaps xmm6, xmmword [0x140301d60]
movaps xmmword [rsp + 0x120], xmm6
lea rcx, [rsp + 0xa0]
mov qword [rcx], rdx
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14015d5d4
mov rdi, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x20], rdi
lea rdx, str..pipeLOCALmojo._lu._lu._I64u
lea rdi, [rsp + 0x120]
mov rcx, rdi
mov r8d, eax
mov r9d, ebx
call fcn.140085450
cmp byte [rdi + 0x17], 0
jns 0x14015ca56
mov rdi, qword [rsp + 0x120]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov eax, 0x1000
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0x1388
mov rcx, rdi
mov edx, 0x40080003
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rsp + 0x118], rbx
test rax, rax
je 0x14015cad5
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsp + 0x118]
inc rax
cmp rax, 2
jae 0x14015d1dc
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14015cacd
mov qword [rsp + 0x118], rdi
call fcn.1400412c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdi, [rsp + 0xa0]
lea rdx, [rsp + 0x118]
mov rcx, rdi
call fcn.14008696e
mov eax, dword [rdi]
mov dword [rsp + 0x78], eax
mov dword [rdi], 0
mov r14, qword [rdi + 8]
mov qword [rdi + 8], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14015cb14
call fcn.1400412c0
cmp qword [rsp + 0x80], r14
je 0x14015cb56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsp + 0x80]
inc rax
cmp rax, 2
jae 0x14015d219
cmp r15, 2
jb 0x14015cb4e
mov qword [rsp + 0x80], r14
call fcn.1400412c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa8]
inc rax
cmp rax, 2
jae 0x14015d3fc
mov rax, qword [rsp + 0x80]
inc rax
cmp rax, 1
ja 0x14015cbb9
lea rdx, str.....mojopubliccppplatformplatform_channel.cc
lea r9, [0x1403026a4]
lea rdi, [rsp + 0x110]
mov rcx, rdi
mov r8d, 0x5f
call fcn.1402264d0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015cbb9
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140211850.0]
mov rax, qword [0x14030f3f8]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [0x14030f3e8]
movaps xmmword [rsp + 0xf0], xmm0
cmp byte [rsp + 0x137], 0
jns 0x14015cbeb
mov rcx, qword [rsp + 0x120]
jmp 0x14015cbf3
lea rcx, [rsp + 0x120]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100000
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0xf0]
mov edx, 0xc0000000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xe8], rbx
test rax, rax
je 0x14015cc53
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x14015cc4b
mov qword [rsp + 0xe8], rdi
call fcn.1400412c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [rsp + 0xa0]
lea rdx, [rsp + 0xe8]
mov rcx, rbx
call fcn.14008696e
mov eax, dword [rbx]
mov dword [rsp + 0x68], eax
mov dword [rbx], 0
mov rdi, qword [rbx + 8]
mov qword [rbx + 8], 0
test rdi, rdi
je 0x14015d043
cmp rdi, 0xffffffffffffffff
je 0x14015cc97
call fcn.1400412c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14015d04a
mov qword [rsp + 0x70], rdi
call fcn.1400412c0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa8]
inc rax
cmp rax, 2
jae 0x14015d42d
xor eax, eax
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xdc], eax
mov dword [rsp + 0xd8], eax
lea r15, [rdi + 1]
cmp r15, 1
ja 0x14015cdfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x14015cdfd
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
jne 0x14015cd35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe4], eax
jmp 0x14015cdfd
lea rbx, [rsp + 0xc0]
movaps xmmword [rbx], xmm6
mov rcx, rbx
xor edx, edx
mov r8d, 1
call fcn.140069ac0
xorps xmm0, xmm0
lea r14, [rsp + 0xa0]
movaps xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
mov rax, qword [rbx]
mov qword [r14 + 0x18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x80]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14015cdb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14015cdb3
cmp byte [rsp + 0x137], 0
jns 0x14015d051
mov rcx, qword [rsp + 0x120]
jmp 0x14015d059
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xe0], eax
mov rax, qword [rsp + 0xc0]
inc rax
cmp rax, 2
jb 0x14015cdfd
call fcn.1400412c0
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d32d
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
inc rdi
cmp rdi, 1
ja 0x14015ce43
lea rdx, str.....mojopubliccppplatformplatform_channel.cc
lea r9, [0x1403026a4]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov r8d, 0x97
call fcn.1402264d0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015ce43
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140211850.0]
lea rcx, [rsp + 0xe4]
call fcn.14004a330
lea rcx, [rsp + 0xe0]
call fcn.14004a330
lea rcx, [rsp + 0xdc]
call fcn.14004a330
lea rcx, [rsp + 0xd8]
call fcn.14004a330
lea rcx, [rsp + 0x120]
call fcn.14004a330
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14015d5d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x14015d372
cmp byte [rsp + 0x137], 0
jns 0x14015cec4
mov rcx, qword [rsp + 0x120]
call fcn.14016eccc
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400752cc
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rdi
call fcn.14009017e
mov eax, dword [rbx]
mov dword [rsi], eax
mov dword [rbx], 0
mov r14, qword [rbx + 8]
mov qword [rbx + 8], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14015cf0e
call fcn.1400412c0
cmp qword [rsi + 8], r14
je 0x14015cf44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 8]
inc rax
cmp rax, 2
jae 0x14015d256
cmp r15, 2
jb 0x14015cf3c
mov qword [rsi + 8], r14
call fcn.1400412c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa8]
inc rax
cmp rax, 2
jae 0x14015d45e
lea rdi, [rsp + 0x48]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.1400752cc
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rdi
call fcn.14009017e
mov eax, dword [rbx]
mov dword [rsi + 0x10], eax
mov dword [rbx], 0
mov r14, qword [rbx + 8]
mov qword [rbx + 8], 0
lea r15, [r14 + 1]
cmp r15, 2
jb 0x14015cfa4
call fcn.1400412c0
cmp qword [rsi + 0x18], r14
je 0x14015cfda
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14015d28b
cmp r15, 2
jb 0x14015cfd2
mov qword [rsi + 0x18], r14
call fcn.1400412c0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0xa8]
inc rax
cmp rax, 2
jae 0x14015d48f
mov rax, qword [rsp + 0x70]
inc rax
cmp rax, 2
jae 0x14015d4c0
mov rax, qword [rsp + 0x80]
inc rax
cmp rax, 2
jae 0x14015d4ee
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140171860
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x150
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor edi, edi
jmp 0x14015ccbf
xor edi, edi
jmp 0x14015ccb7
lea rcx, [rsp + 0x120]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x40100000
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0xf0]
mov edx, 0xc0000000
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x88], r14
test rax, rax
je 0x14015d0ba
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp rbx, 0xffffffffffffffff
je 0x14015d0b2
mov qword [rsp + 0x88], rbx
call fcn.1400412c0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rbx, [rsp + 0x90]
lea rdx, [rsp + 0x88]
mov rcx, rbx
call fcn.14008696e
mov eax, dword [rbx]
mov dword [rsp + 0x68], eax
mov dword [rbx], 0
mov r14, qword [rbx + 8]
mov qword [rbx + 8], 0
lea r12, [r14 + 1]
cmp r12, 2
jb 0x14015d0f9
call fcn.1400412c0
cmp rdi, r14
je 0x14015d12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp r15, 2
jae 0x14015d33e
cmp r12, 2
jb 0x14015d123
mov qword [rsp + 0x70], r14
call fcn.1400412c0
mov rdi, r14
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x98]
inc rax
cmp rax, 2
jae 0x14015d530
lea rax, [rdi + 1]
cmp rax, 2
jae 0x14015d2c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x14015cdc0
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Mojo.PlatformChannel.PipeBusyMitigation
mov r9d, 5
mov edx, 1
mov r8d, 4
call fcn.1400cea30
mov rcx, qword [rax]
mov r8, qword [rcx + 0x28]
lea rcx, [0x1400ab550]
cmp r8, rcx
jne 0x14015d5da
mov rcx, qword [rax + 0x18]
xor edx, edx
mov r8d, 1
call fcn.1400a0920
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xdc]
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
test eax, eax
jne 0x14015cdc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xd8], eax
jmp 0x14015cdc0
call fcn.1400412c0
mov r14, qword [rsp + 0x118]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d3b8
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, r14
call qword [case.0x140211850.0]
mov qword [rsp + 0x118], 0
jmp 0x14015cab6
call fcn.1400412c0
mov rbx, qword [rsp + 0x80]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d3c9
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
mov qword [rsp + 0x80], 0
jmp 0x14015cb3b
call fcn.1400412c0
mov rbx, qword [rsi + 8]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d3da
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
mov qword [rsi + 8], 0
jmp 0x14015cf2d
call fcn.1400412c0
mov rbx, qword [rsi + 0x18]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d3eb
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
mov qword [rsi + 0x18], 0
jmp 0x14015cfc3
mov rcx, qword [rsp + 0xc0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14015d5ed
mov dword [rsp + 0x20], 1
lea rcx, str.Microsoft.Mojo.PlatformChannel.PipeBusyMitigation
mov r9d, 5
mov edx, 1
mov r8d, 4
call fcn.1400cea30
mov rcx, qword [rax]
mov r8, qword [rcx + 0x28]
lea rcx, [0x1400ab550]
cmp r8, rcx
jne 0x14015d5f0
mov rcx, qword [rax + 0x18]
mov edx, 3
mov r8d, 1
call fcn.1400a0920
jmp 0x14015cdc0
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015cdee
call fcn.1400412c0
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d51f
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
mov qword [rsp + 0x70], 0
xor edi, edi
jmp 0x14015d110
lea rdx, str.....mojopubliccppplatformplatform_channel.cc
lea r9, [0x1403026a4]
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov r8d, 0xa3
call fcn.1402264d0
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015cead
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x140211850.0]
jmp 0x14015cead
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d1f9
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d236
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d26f
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d2a4
call fcn.1400412c0
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d55d
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
jmp 0x14015cb6b
call fcn.1400412c0
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d56e
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
jmp 0x14015ccd4
call fcn.1400412c0
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d57f
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
jmp 0x14015cf59
call fcn.1400412c0
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d590
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
jmp 0x14015cfef
call fcn.1400412c0
mov rdi, qword [rsp + 0x70]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d5a1
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
jmp 0x14015d001
call fcn.1400412c0
mov rdi, qword [rsp + 0x80]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d5b2
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rdi
call qword [case.0x140211850.0]
jmp 0x14015d016
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d353
call fcn.1400412c0
mov rbx, qword [rsp + 0x98]
mov rcx, qword [0x14035abe0]
test rcx, rcx
je 0x14015d5c3
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rbx
call qword [case.0x140211850.0]
jmp 0x14015d140
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d419
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d44a
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d47b
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d4ac
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d4da
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d50b
call fcn.1400bf420
mov rcx, qword [0x14035abe0]
jmp 0x14015d549
int3
int3
mov rcx, rax
xor edx, edx
mov rax, r8
call qword [case.0x140211850.0]
jmp 0x14015d1ac
int3
mov rcx, rax
mov edx, 3
mov rax, r8
call qword [case.0x140211850.0]
jmp 0x14015cdc0