Function at 0x1400efbd0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push r13
push r14
sub rsp, 0x508
mov rax, qword [0x14020cc58]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x14020e418]
xor r13d, r13d
test rcx, rcx
lea r14d, [r13 + 1]
je 0x1400efc37
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 4
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov qword [rsp + 0x520], rbx
call fcn.1400d8a90
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x78], r14d
call fcn.1400ed080
test rax, rax
mov qword [rsp + 0x70], rax
je 0x1400f0805
lea rcx, [rsp + 0x2c0]
mov qword [rsp + 0x4f8], r12
or r12, 0xffffffffffffffff
call fcn.14017d460
mov rdx, qword [0x14020e420]
test rdx, rdx
je 0x1400efca0
lea rcx, [rsp + 0x2c0]
call fcn.14017d760
jmp 0x1400efd09
lea rcx, [rsp + 0xb0]
call fcn.14017d460
lea rdx, str..PIPEEverything_Service
lea rcx, [rsp + 0xb0]
call fcn.140177ed0
call fcn.1400ce420
test rax, rax
je 0x1400efce7
call fcn.1400ce420
lea rdx, str.___s_
lea rcx, [rsp + 0xb0]
mov r8, rax
call fcn.140178b10
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x2c0]
call fcn.14017d760
lea rcx, [rsp + 0xb0]
call fcn.1400012c0
mov rdx, qword [rsp + 0x2c8]
lea rcx, str.createnamedpipe__S_n
call fcn.1400b3fe0
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b3fe0
mov rcx, qword [0x14020e410]
call fcn.1400d8ae0
test eax, eax
jne 0x1400f07e5
mov qword [rsp + 0x528], rbp
mov qword [rsp + 0x530], rsi
mov qword [rsp + 0x500], rdi
mov qword [rsp + 0x4f0], r15
mov r15d, 0x3e8
nop
nop
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x14020e3e0]
test r11, r11
mov rbp, r11
je 0x1400f0158
mov rax, qword [r11]
mov rcx, qword [0x14020e3e8]
test rax, rax
mov qword [0x14020e3e0], rax
cmove rcx, r13
mov qword [0x14020e3e8], rcx
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [rbp + 8]
lea rcx, str.device_event__08x_n
call fcn.1400b3fe0
mov r11d, dword [rbp + 8]
sub r11d, 0x8001
je 0x1400f0118
sub r11d, r14d
je 0x1400f004e
sub r11d, r14d
je 0x1400f0020
sub r11d, r14d
je 0x1400eff35
cmp r11d, 2
jne 0x1400f0127
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0127
lea r8d, [r11 + 0xe]
lea rdx, [0x1401b0e50]
add rcx, 0x20
call fcn.1400db310
test eax, eax
je 0x1400efe51
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_n
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
call fcn.1400edd10
jmp 0x1400f0127
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e60]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db310
test eax, eax
je 0x1400efe89
lea rcx, str.GUID_IO_VOLUME_DISMOUNT_FAILED_n
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
call fcn.1400eded0
jmp 0x1400f0127
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e80]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db310
test eax, eax
je 0x1400efec1
lea rcx, str.GUID_IO_VOLUME_LOCK_n
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
call fcn.1400edd10
jmp 0x1400f0127
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0e90]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db310
test eax, eax
je 0x1400efef9
lea rcx, str.GUID_IO_VOLUME_LOCK_FAILED_n
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
call fcn.1400eded0
jmp 0x1400f0127
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401b0ea0]
mov r8d, reloc.WS2_32.dll_recv
add rcx, 0x20
call fcn.1400db310
test eax, eax
je 0x1400f0127
lea rcx, str.GUID_IO_VOLUME_UNLOCK_n
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
call fcn.1400eded0
jmp 0x1400f0127
mov rsi, qword [rbp + 0x10]
cmp dword [rsi + 4], 6
jne 0x1400f0127
mov rdx, qword [rsi + 0x10]
lea rcx, str.monitor_unregister_device_notification_by_handle__p_n
call fcn.1400b3fe0
mov r11, qword [0x14020e3f0]
test r11, r11
je 0x1400f0127
nop
nop
nop
nop
mov edx, dword [r11 + 0xa8]
mov ecx, r13d
test edx, edx
je 0x1400effa4
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x78], r8
je 0x1400effe4
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400eff90
mov edx, dword [r11 + 0xb8]
mov ecx, r13d
test edx, edx
je 0x1400effd7
mov r8, qword [rsi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdi, qword [rax]
cmp qword [rdi + 0x80], r8
je 0x1400effff
add ecx, r14d
add rax, 8
cmp ecx, edx
jb 0x1400effc0
mov r11, qword [r11]
test r11, r11
jne 0x1400eff70
jmp 0x1400f0127
mov rcx, qword [rdi + 0x78]
test rcx, rcx
je 0x1400f0127
call fcn.1400d8dd0
mov qword [rdi + 0x78], r13
jmp 0x1400f0127
mov rcx, qword [rdi + 0x80]
test rcx, rcx
je 0x1400f0127
call fcn.1400d8dd0
mov qword [rdi + 0x80], r13
jmp 0x1400f0127
mov rax, qword [rbp + 0x10]
lea rcx, str.dbch_devicetype__d__dbch_size__d_n
mov r8d, dword [rax]
mov edx, dword [rax + 4]
call fcn.1400b3fe0
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0127
call fcn.1400edd10
jmp 0x1400f0127
mov rdi, qword [rbp + 0x10]
cmp dword [rdi + 4], 6
jne 0x1400f0127
mov rdx, qword [rdi + 0x10]
lea rcx, str.restart_monitor_by_handle__p_n
call fcn.1400b3fe0
mov r11, qword [0x14020e3f0]
test r11, r11
je 0x1400f0127
nop
mov r8d, dword [r11 + 0xa8]
mov ecx, r13d
test r8d, r8d
je 0x1400f00b5
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xa0]
nop
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x78], r9
je 0x1400f00f2
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400f00a0
mov r8d, dword [r11 + 0xb8]
mov ecx, r13d
test r8d, r8d
je 0x1400f00e8
mov r9, qword [rdi + 0x18]
mov rax, qword [r11 + 0xb0]
nop
mov rdx, qword [rax]
cmp qword [rdx + 0x80], r9
je 0x1400f0105
add ecx, r14d
add rax, 8
cmp ecx, r8d
jb 0x1400f00d0
mov r11, qword [r11]
test r11, r11
jne 0x1400f0080
jmp 0x1400f0127
mov rcx, qword [0x14020e408]
mov dword [rdx + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400f0127
mov rcx, qword [0x14020e408]
mov dword [rdx + 0x58], r13d
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400f0127
mov rcx, qword [rbp + 0x10]
cmp dword [rcx + 4], 6
jne 0x1400f0127
call fcn.1400edd10
mov rcx, qword [rbp + 0x10]
call fcn.1400cf780
mov rcx, rbp
call fcn.1400cf780
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11, qword [0x14020e3e0]
test r11, r11
mov rbp, r11
jne 0x1400efda0
lea rcx, [0x14020e3b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [rsp + 0x2b0]
cmp r11d, 0x40
jae 0x1400f018c
mov rax, qword [0x14020e408]
mov qword [rsp + r11*8 + 0xb0], rax
add dword [rsp + 0x2b0], r14d
jmp 0x1400f0194
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
jne 0x1400f03eb
cmp dword [0x14020e204], 6
jb 0x1400f01e3
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
lea r8d, [r12 + 9]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov edx, 0x40000003
mov r9d, 0xff
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
jmp 0x1400f021b
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x68]
mov r9d, 0xff
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov edx, 0x40000003
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
cmp r12, 0xffffffffffffffff
je 0x1400f0548
lea rcx, str.connect..._n
call fcn.1400b3fe0
lea rdx, [rsp + 0x88]
mov rcx, r12
mov dword [rsp + 0x98], r13d
mov dword [rsp + 0x9c], r13d
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x1400f030f
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9240
mov qword [rdi + 0x50], r12
call fcn.1400d8a90
mov qword [rdi + 0x28], rax
call fcn.1400d8a90
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f02c3
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f02ce
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f02ed
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
jmp 0x1400f03eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1400f03d9
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9240
mov qword [rdi + 0x50], r12
call fcn.1400d8a90
mov qword [rdi + 0x28], rax
call fcn.1400d8a90
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f0389
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f0394
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f03b3
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400f0194
cmp eax, 0x218
je 0x1400f03eb
cmp eax, 0x3e5
jne 0x1400f0517
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400f04d4
lea rcx, str.connected_n
call fcn.1400b3fe0
mov ecx, 0x110
call fcn.1400cf700
xor edx, edx
mov r8d, 0x110
mov rcx, rax
mov rdi, rax
call fcn.1401a9240
mov qword [rdi + 0x50], r12
call fcn.1400d8a90
mov qword [rdi + 0x28], rax
call fcn.1400d8a90
mov ecx, dword [0x14020e404]
mov dword [rdi + 0x58], ecx
add ecx, r14d
cmp qword [0x14020e3f0], r13
mov dword [0x14020e404], ecx
mov qword [rdi + 0x48], rax
mov qword [rdi + 0x98], 0xffffffffffffffff
je 0x1400f0484
mov rax, qword [0x14020e3f8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
jmp 0x1400f048f
mov qword [0x14020e3f0], rdi
mov qword [rdi + 8], r13
mov rcx, qword [rdi + 0x70]
add dword [0x14020e400], r14d
mov qword [0x14020e3f8], rdi
test rcx, rcx
mov qword [rdi], r13
je 0x1400f04ae
call fcn.1400cf780
mov ecx, 4
call fcn.1400cf700
mov dword [rdi + 0x60], 4
mov dword [rdi + 0x78], r13d
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x68], rax
or r12, 0xffffffffffffffff
jmp 0x1400f0194
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f0503
mov rax, qword [rsp + 0xa0]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f050b
mov dword [rsp + 0x2b4], r14d
cmp r12, 0xffffffffffffffff
je 0x1400f0194
jmp 0x1400f056a
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.connect_named_pipe_failed__d_n
mov edx, eax
call fcn.1400b3fe0
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
or r12, 0xffffffffffffffff
jmp 0x1400f056a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.failed_to_createnamedpipe__d_n
mov edx, eax
call fcn.1400b3fe0
mov edx, dword [rsp + 0x2b0]
mov ebx, r14d
mov dword [rsp + 0x40], ebx
mov rdi, qword [0x14020e3f0]
test rdi, rdi
je 0x1400f0735
nop
nop
mov edx, dword [rdi + 0x58]
mov rbx, qword [rdi]
lea rcx, str.update_client__d_n
call fcn.1400b3fe0
mov rcx, rdi
call fcn.1400ed1c0
mov rcx, rdi
call fcn.1400ef060
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400ef1f0
cmp dword [rdi + 0x5c], r13d
je 0x1400f05d8
mov edx, dword [rdi + 0x58]
lea rcx, str._d:_disconnected._n
call fcn.1400b3fe0
mov rcx, rdi
call fcn.1400ef820
mov edx, dword [rsp + 0x2b0]
jmp 0x1400f0725
cmp qword [rdi + 0x80], r13
je 0x1400f062e
cmp dword [rdi + 0x90], r13d
je 0x1400f062e
mov edx, dword [rdi + 0x58]
lea rcx, str.client__d_write_pending_n
call fcn.1400b3fe0
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f0624
mov rax, qword [rdi + 0x48]
mov qword [rsp + rdx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0635
mov dword [rsp + 0x2b4], r14d
jmp 0x1400f0635
mov edx, dword [rsp + 0x2b0]
cmp edx, 0x40
jae 0x1400f065b
mov rax, qword [rdi + 0x28]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0663
mov dword [rsp + 0x2b4], r14d
cmp dword [rdi + 0xa8], r13d
mov r9d, r13d
jbe 0x1400f06c4
mov r8, r13
mov rax, qword [rdi + 0xa0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x80], 2
jne 0x1400f06b4
cmp edx, 0x40
jae 0x1400f06ac
mov rax, qword [rax + 0x70]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f06b4
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xa8]
jb 0x1400f0672
cmp dword [rdi + 0xb8], r13d
mov r9d, r13d
jbe 0x1400f0725
mov r8, r13
mov rax, qword [rdi + 0xb0]
mov rax, qword [r8 + rax]
cmp dword [rax + 0x88], 2
jne 0x1400f0715
cmp edx, 0x40
jae 0x1400f070d
mov rax, qword [rax + 0x78]
mov ecx, edx
mov qword [rsp + rcx*8 + 0xb0], rax
mov edx, dword [rsp + 0x2b0]
add edx, r14d
mov dword [rsp + 0x2b0], edx
jmp 0x1400f0715
mov dword [rsp + 0x2b4], r14d
add r9d, r14d
add r8, 8
cmp r9d, dword [rdi + 0xb8]
jb 0x1400f06d3
test rbx, rbx
mov rdi, rbx
jne 0x1400f0580
mov ebx, dword [rsp + 0x40]
cmp dword [rsp + 0x2b4], r13d
lea rcx, str.sleep__d__d_n
cmovne ebx, r14d
mov r8d, ebx
call fcn.1400b3fe0
mov ecx, dword [rsp + 0x2b0]
or r9d, 0xffffffff
test ebx, ebx
lea rdx, [rsp + 0xb0]
cmovne r9d, r15d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [0x14020e408]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rcx, str.awake_n
mov ebx, r13d
mov dword [rsp + 0x2b0], r13d
mov dword [rsp + 0x2b4], r13d
mov dword [rsp + 0x40], ebx
call fcn.1400b3fe0
mov rcx, qword [0x14020e410]
call fcn.1400d8ae0
test eax, eax
je 0x1400efd80
cmp r12, 0xffffffffffffffff
mov r15, qword [rsp + 0x4f0]
mov rdi, qword [rsp + 0x500]
mov rsi, qword [rsp + 0x530]
mov rbp, qword [rsp + 0x528]
je 0x1400f07e5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x2c0]
call fcn.1400012c0
mov r12, qword [rsp + 0x4f8]
mov rcx, qword [0x14020e418]
test rcx, rcx
je 0x1400f0848
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], 3
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x14020e3f0]
test rcx, rcx
je 0x1400f0864
mov rbx, qword [rcx]
call fcn.1400ef820
test rbx, rbx
mov rcx, rbx
jne 0x1400f0854
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14020e418]
mov rbx, qword [rsp + 0x520]
test rcx, rcx
je 0x1400f08ba
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], gethostbyname
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x60], 0xbb8
mov dword [rsp + 0x50], r14d
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.1401a8ec0
add rsp, 0x508
pop r14
pop r13
ret