Function at 0x140026f58
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x140075078]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, rdx
mov r13, rcx
lea rcx, [0x1400822c6]
call fcn.14004ea38
xor r15d, r15d
movzx r14d, r15b
mov edi, r15d
or r12, 0xffffffffffffffff
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r15w
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.140003c60
nop
lea rcx, str.___ipc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea r9, str.___ipc
xor r8d, r8d
mov rdx, qword [rbp - 0x51]
call fcn.140028990
mov rbx, rax
cmp rax, r12
je 0x14002742c
add rbx, 7
lea rcx, str.___proc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea r9, str.___proc
mov r8, rbx
mov rdx, qword [rbp - 0x51]
call fcn.140028990
mov rsi, rax
cmp rax, r12
je 0x14002742c
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea rcx, [0x14005a458]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rax
lea rdx, [0x14005a458]
lea rcx, [rbp - 1]
call fcn.140003c60
nop
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
mov rax, qword [rbp - 0x51]
cmp rax, rbx
jb 0x1400274a5
mov r8, rsi
sub r8, rbx
sub rax, rbx
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rax, qword [rbp - 0x61]
lea rdx, [rax + rbx*2]
lea rcx, [rbp - 0x21]
call fcn.140003c60
nop
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov r8, qword [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140003e30
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x140027129
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027124
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e6b4
add rsi, 8
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r15w
mov rax, qword [rbp - 0x51]
cmp rax, rsi
jb 0x1400274ab
sub rax, rsi
or rbx, 0xffffffffffffffff
cmp rax, rbx
cmovb rbx, rax
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rax, qword [rbp - 0x61]
lea rax, [rax + rsi*2]
mov qword [rbp - 0x69], rax
cmp rbx, 7
ja 0x140027194
mov qword [rbp - 0x31], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memmove
xor esi, esi
mov word [rbp + rbx - 0x41], si
mov r15, qword [rbp - 0x41]
jmp 0x1400271f1
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140027499
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400272f5
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
call fcn.140002050
mov r15, rax
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], rsi
add rbx, rbx
mov r8, rbx
mov rdx, qword [rbp - 0x69]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
mov word [r15 + rbx], si
mov qword [rbp - 0x41], r15
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, r15
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov r15d, 1
test rax, rax
je 0x140027323
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rcx, qword [rbp - 1]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x7d0
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov r9d, r15d
mov edx, 0x40080003
lea r8d, [r15 + 7]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140027323
lea rdx, [0x14005d488]
lea ecx, [r15 + 0xf]
call fcn.14004f300
mov rdi, rax
mov qword [rbp - 0x69], rax
test rax, rax
je 0x140027320
mov qword [rax], r13
mov qword [rax + 8], r12
test rax, rax
je 0x140027323
mov dword [rbp - 0x69], esi
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x140026d90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13], rax
test rax, rax
je 0x140027323
or r12, 0xffffffffffffffff
mov rcx, r13
call fcn.14002fc08
test al, al
cmovne r14d, r15d
jmp 0x140027323
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14002749f
jmp 0x1400271c1
mov rdi, rsi
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x140027366
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140027361
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e6b4
mov qword [rbp - 0x31], rsi
mov r15d, 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x41], si
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x1400273bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400273b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400273b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e6b4
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], r15
mov word [rbp - 1], si
test r14b, r14b
je 0x1400273fc
mov qword [rbp - 0x21], rbx
mov rax, qword [r13]
mov qword [rbp - 0x19], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x21]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x1400273f9
cmp eax, 1
mov r14b, sil
jne 0x1400273fc
mov r14b, 1
cmp r12, 0xffffffffffffffff
je 0x14002740b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140027419
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14002742c
mov edx, 0x10
mov rcx, rdi
call fcn.14004e6b4
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x14002746f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002746a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002746a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e6b4
mov al, r14b
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14004eb00
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140002320
nop
call fcn.1400015c0
int3
call fcn.140040598
int3
call fcn.140040598
int3