Function at 0x140002b7c
Capabilities:
Connect pipe
Encode data using xor
Read file on windows
Read pipe
Terminate process
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov eax, 0x142a
xor ebx, ebx
mov dword [rbp - 0x20], eax
mov r9d, 0x1aeb
mov dword [rbp - 0xc], 0x2a68
mov dword [rbp - 0x1c], eax
mov dword [rbp - 8], 0x3130
mov dword [rbp - 0x18], 0x18ec
mov dword [rbp - 4], ebx
mov dword [rbp - 0x10], 0x14d4
mov dword [rbp - 0x14], r9d
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add ecx, 0x163e
cmp eax, ecx
jl 0x1400030a9
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
xor ecx, 0x3337
cmp eax, ecx
jle 0x140002e8a
add dword [rbp - 0x1c], 0xb4d
lea rdi, [0x140de4010]
add dword [rbp - 0x14], 0xfffffaf7
add dword [rbp - 0x20], 0xbe7
mov edx, dword [rbp - 0x10]
mov r8d, dword [rbp - 8]
add edx, 0x1b1b
mov r9d, dword [rbp - 0x10]
mov ecx, dword [rbp - 8]
add r9d, 0x51e
mov eax, dword [rbp - 0x14]
sub ecx, 0x6c8
add eax, 0x66b
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rdi
call fcn.140003438
mov dword [rbp - 8], eax
xor dword [rbp - 8], 0x3b3b
mov ecx, dword [rbp - 0x18]
mov edx, dword [rbp - 0x14]
add ecx, 0x117c
mov r8d, dword [rbp - 0x1c]
xor edx, 0x3f8a
mov r10d, dword [rbp - 0x1c]
xor r8d, 0x33b2
mov r9d, dword [rbp - 4]
xor r10d, 0x3098
mov eax, dword [rbp - 0xc]
add r9d, 0x1540
add eax, 0x25d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
mov r9, rdi
mov dword [rsp + 0x20], r10d
call fcn.14000f29c
mov dword [rbp - 0x1c], eax
add dword [rbp - 0x18], 0x106
xor dword [rbp - 0x10], 0xc38
add dword [rbp - 0x1c], 0xffffef88
mov eax, dword [0x140de405c]
cmp dword [0x140de4074], eax
je 0x140002ce1
mov eax, dword [0x140de4070]
mov ecx, dword [0x140de4108]
add eax, 0xfff46ca5
sub ecx, dword [0x140de4034]
add ecx, eax
mov dword [0x140de4070], ecx
add dword [rbp - 0x14], 0x30a
mov ecx, dword [rbp - 0xc]
mov edx, dword [rbp - 0x20]
xor ecx, 0xd8b
mov r8d, dword [rbp - 8]
sub edx, 0xb3d
mov r9d, dword [rbp - 0xc]
sub r8d, 0x1ccb
xor r9d, 0x339a
mov qword [rsp + 0x20], rdi
call fcn.140001ea4
mov dword [rbp - 8], eax
xor dword [rbp - 0x14], 0x207
xor dword [rbp - 0x10], 0x11e
add dword [rbp - 0x20], 0xfffff8db
mov ecx, dword [0x140de4074]
mov eax, dword [0x140de40b0]
inc eax
imul ecx, eax
mov rax, qword [0x140de40b8]
mov dword [0x140de4074], ecx
mov ecx, dword [rax + rbx]
add rbx, 4
mov eax, dword [0x140de40a8]
or dword [0x140de40fc], eax
mov rax, qword [section..data]
movzx edx, cl
movsxd rcx, dword [0x140de4078]
movzx r8d, byte [rax + 0x60]
mov rax, qword [0x140de40c0]
imul r8d, edx
mov byte [rcx + rax], r8b
mov eax, 0x1a7ffb
inc dword [0x140de4078]
mov rdx, qword [section..data]
mov ecx, dword [0x140de4120]
xor ecx, dword [0x140de40d0]
sub eax, ecx
add dword [0x140de4074], eax
mov eax, dword [0x140de4094]
sub eax, dword [0x140de4120]
sub eax, 0x9303
or dword [0x140de405c], eax
mov eax, dword [rdx + 0x24]
add eax, dword [0x140de407c]
xor eax, 0x1cda25
add dword [0x140de40b4], eax
mov ecx, dword [rdx + 0xdc]
add ecx, dword [rdx + 0x1c]
mov eax, dword [rdx + 0x110]
xor ecx, 0xbce0f233
imul eax, ecx
mov dword [rdx + 0x110], eax
mov eax, 0x138823
sub eax, dword [0x140de4018]
add dword [0x140de4108], eax
mov eax, 0x1b12aa
sub eax, dword [0x140de4094]
sub eax, dword [0x140de4054]
add dword [0x140de40d0], eax
cmp rbx, 0xbd960
jl 0x140002d32
add dword [rbp - 4], 0x18ec
mov r8, rdi
mov ecx, dword [rbp - 0x20]
mov edx, dword [rbp - 8]
xor ecx, 0xd0e
mov r9d, dword [rbp - 0x20]
xor edx, 0x3bae
mov r10d, dword [rbp - 0x18]
sub r9d, 0x418
mov eax, dword [rbp - 8]
sub r10d, 0x4b2
sub eax, 0x1f5
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.14000d7c4
mov dword [rbp - 4], eax
add dword [rbp - 0x20], 0xfffffbe8
add dword [rbp - 8], 0xfffffe0b
jmp 0x1400030a9
mov eax, dword [rbp - 0x18]
imul eax, dword [0x140de4084]
imul ecx, eax, 0x2fef
mov eax, dword [rbp - 0x20]
cmp eax, ecx
jbe 0x140002f97
mov eax, dword [0x140de4104]
xor eax, 0x2cc5
cmp dword [0x140de40e8], eax
jne 0x140002f97
mov ecx, dword [rbp - 0x18]
mov edi, 0x1c4d
mov edx, dword [rbp - 0x14]
mov r8d, dword [rbp - 0x14]
mov eax, dword [0x140de4054]
and ecx, dword [0x140de4124]
or r8d, dword [0x140de4118]
mov r11d, dword [0x140de4088]
or r8d, r9d
mov r9d, dword [rbp - 0x14]
and r11, rax
mov eax, dword [rbp - 0xc]
imul r9d, dword [0x140de40fc]
imul edx, ecx
mov rcx, r11
imul r9d, eax
mov rax, qword [section..data]
mov r10d, dword [rax + 0x64]
mov eax, dword [rbp - 4]
or r10d, edi
imul eax, r10d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rbp - 0x20]
movsxd rdx, dword [rbp - 4]
mov r8d, dword [rbp - 0x18]
xor rdx, rdi
mov r9d, dword [rbp - 0x18]
mov ebx, dword [rbp - 0xc]
mov eax, dword [0x140de40d0]
imul r8d, dword [0x140de4090]
xor r9, rax
mov rax, qword [section..data]
imul ebx, dword [rax + 0xc0]
mov eax, dword [rbp - 0xc]
mov r11d, dword [0x140de40b0]
sub r11d, eax
mov eax, dword [rbp - 0x20]
and eax, dword [0x140de4100]
add r11d, edi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CallNamedPipeA]
mov edx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add edx, eax
mov eax, dword [rbp - 0x14]
xor eax, edx
xor dword [0x140de4018], eax
mov ebx, dword [rbp - 0x20]
jmp 0x140003089
mov eax, dword [rbp - 0x10]
mov ecx, dword [0x140de40e8]
sub ecx, eax
mov eax, dword [rbp - 0x10]
sub ecx, eax
movsxd rax, dword [rbp - 0x10]
movsxd rdx, dword [rbp - 0xc]
mov dword [0x140de40e8], ecx
xor rdx, rax
mov ecx, dword [0x140de4124]
add ecx, 0xffffba2f
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [rbp - 0x10]
mov ecx, dword [0x140de4094]
sub ecx, dword [0x140de402c]
add eax, ecx
cmp dword [0x140de402c], eax
je 0x140003086
mov eax, dword [0x140de4108]
mov ecx, dword [0x140de40b0]
xor ecx, 0x2a68
or ecx, dword [0x140de4054]
imul eax, ecx
mov ecx, dword [0x140de40e0]
xor ecx, dword [0x140de4120]
mov dword [0x140de4108], eax
mov eax, dword [rbp - 0x14]
imul eax, ecx
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x1c]
add eax, dword [0x140de4110]
add eax, dword [0x140de4094]
mov dword [rbp - 0x1c], eax
mov ecx, dword [rbp - 0x20]
mov rax, qword [section..data]
imul ecx, dword [rax + 0xd0]
mov eax, dword [0x140de4090]
imul ecx, dword [0x140de40b0]
add dword [0x140de40dc], ecx
mov ecx, dword [0x140de410c]
xor rcx, rax
mov eax, dword [0x140de402c]
xor rcx, rax
mov eax, dword [rbp - 0x18]
mov rdx, qword [0x140de4038]
xor rdx, rax
and edx, 0x27e3
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
add ebx, 4
mov rax, qword [section..data]
mov ecx, dword [rax + 0xa0]
mov eax, dword [rbp - 0x10]
sub ecx, dword [0x140de4050]
sub ecx, eax
cmp ebx, ecx
jne 0x140002f9f
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x3e42
cmp eax, ecx
jle 0x140003125
add dword [rbp - 0x20], 0x51e
add dword [rbp - 0x18], 0xfffffa38
xor dword [rbp - 0x18], 0x1c8
xor dword [rbp - 0x1c], 0x3625
xor dword [rbp - 0x18], 0x24d2
xor dword [rbp - 0x20], 0xdd8
cmp dword [0x140de40ec], 0x5f51
jb 0x140003109
mov rax, qword [section..data]
call qword [rax + 0x88]
mov rcx, qword [section..data]
mov dword [rcx + 0xd4], eax
xor dword [rbp - 4], 0x3703
xor dword [rbp - 0xc], 0x587
add dword [rbp - 4], 0xfffff5ff
add dword [rbp - 0x1c], 0xfffffb86
mov ecx, dword [0x140de40e4]
call qword [sym.imp.KERNEL32.dll_ExitProcess]