Function at 0x1400963f0
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xb0], xmm6
mov qword [rbp + 0xa8], 0xfffffffffffffffe
mov qword [rbp + 0x68], rcx
mov byte [rbp + 0xa5], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp + 0x64], ecx
xor edi, edi
mov r15d, 8
mov sil, 1
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
xor eax, eax
mov qword [rbp - 8], rax
nop
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rbp + 0x58], eax
jmp 0x14009646b
mov rax, qword [rbp + 0x20]
xchg qword [0x1401649a0], rax
mov rax, qword [0x1401649a0]
test rax, rax
jne 0x1400964c0
movaps xmmword [rbp + 0x20], xmm6
xor ecx, ecx
lea rdx, [rbp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov r9d, 2
call r12
test eax, eax
jns 0x140096460
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], rbx
mov byte [rbp + 0xa7], dil
mov byte [rbp + 0xa6], 1
call fcn.140097ca0
jmp 0x140096464
mov eax, 1
lock xadd qword [0x1401649a0], rax
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x58]
mov qword [rbp], rax
lea rax, [0x14000e690]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, [fcn.14000b420]
mov qword [rbp + 0x18], rax
lea rax, str..pipe__rust_anonymous_pipe1__.
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 2
mov qword [rbp + 0x40], 0
mov rax, rbp
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], 2
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x78], rbx
mov byte [rbp + 0xa7], dil
mov byte [rbp + 0xa6], 1
lea rcx, [rbp - 0x38]
lea rdx, [rbp + 0x20]
call fcn.140008ce0
test r14, r14
sete al
or sil, al
test sil, 1
jne 0x140096564
mov edx, 1
mov rcx, rbx
call fcn.1400084c0
mov r8, qword [rbp - 0x38]
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp - 0x28]
lea rcx, [r8 + rax]
mov qword [rbp + 0x70], rcx
test rax, rax
mov qword [rbp + 0x88], r8
mov dword [rbp + 0x5c], r15d
mov qword [rbp - 0x10], rax
je 0x1400965b0
movzx ecx, byte [r8]
movzx edi, cl
test dil, dil
js 0x1400965d0
lea r15, [r8 + 1]
jmp case.0x14004fee8.1186
xor r12d, r12d
xor r14d, r14d
xor edi, edi
xor r15d, r15d
xor r13d, r13d
jmp 0x140096656
mov eax, edi
and eax, 0x1f
movzx edx, byte [r8 + 1]
and edx, 0x3f
cmp dil, 0xdf
jbe 0x140096621
movzx edi, byte [r8 + 2]
shl edx, 6
and edi, 0x3f
or edi, edx
cmp cl, 0xf0
jb case.0x140062720.1082
lea r15, [r8 + 4]
movzx ecx, byte [r8 + 3]
and eax, 7
shl eax, 0x12
shl edi, 6
and ecx, 0x3f
or ecx, edi
or ecx, eax
mov edi, ecx
cmp edi, 0xffff
jbe case.0x14004fee8.1186
jmp case.0x140062720.1087
lea r15, [r8 + 2]
shl eax, 6
or eax, edx
mov edi, eax
mov eax, 1
xor r12d, r12d
mov r13, qword [rbp + 0x70]
sub r13, r15
add r13, 3
mov rcx, 0xffffffffffffffff
mov ecx, 0xffffffff
cmovb r13, rcx
shr r13, 2
add r13, rax
mov r14w, 1
cmp r13, 4
mov eax, 3
cmovb r13, rax
movabs rax, 0x3fffffffffffffff
cmp r13, rax
jae case.0x14007a536.1019
inc r13
lea rbx, [r13*2]
movzx eax, byte [0x140164a38]
mov edx, 2
mov rcx, rbx
call fcn.140008430
test rax, rax
je 0x140096b13
mov rcx, rax
mov rax, qword [rbp - 8]
inc eax
mov dword [rbp + 0x60], eax
mov word [rcx], di
mov ebx, 1
mov qword [rbp + 0x98], rcx
jmp 0x1400966d0
mov rsi, r13
mov r12d, eax
mov word [rcx + rbx*2], di
inc rbx
mov r13, rsi
test r15, r15
je 0x140096740
test r12w, r12w
je 0x140096720
xor eax, eax
mov edi, r12d
cmp rbx, r13
jne 0x1400966c0
mov rsi, qword [rbp + 0x70]
sub rsi, r15
add rsi, 3
mov rcx, 0xffffffffffffffff
cmovb rsi, rcx
shr rsi, 2
cmp ax, 1
sbb rsi, 0xffffffffffffffff
cmp r14w, 1
sbb rsi, 0xffffffffffffffff
mov r12d, eax
jmp 0x140096764
cmp r15, qword [rbp + 0x70]
je 0x140096740
movzx edx, byte [r15]
movzx edi, dl
test dil, dil
js 0x140096806
inc r15
xor eax, eax
jmp 0x1400966e0
cmp r14w, 1
jne 0x1400968a0
xor r15d, r15d
xor r14d, r14d
mov edi, 0
add byte [rsi], bh
cmp rbx, r13
cmp ebx, ebp
jne 0x1400967f0
invalid
inc rsi
add rsi, rbx
jb 0x140096b01
lea rax, [r13*2]
cmp rax, rsi
cmova rsi, rax
cmp rsi, 5
jae 0x14009678a
mov esi, 4
xor edx, edx
mov rcx, rsi
mov ecx, esi
int1
shr rcx, 0x3e
sete dl
xchg esp, eax
ret 0x8d4c
add al, 0x36
add rdx, rdx
add edx, edx
mov rcx, qword [rbp + 0x98]
add byte [rax], al
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], 2
mov dword [rbp + 0x28], 2
mov qword [rbp + 0x30], rax
mov rcx, rbp
lea r9, [rbp + 0x20]
and al, ch
add al, dl
invalid
dec dword [rax - 0x7d]
jge 0x1400967c4
add byte [rax - 0x75], cl
mov rcx, qword [rbp + 8]
invalid
invalid
je 0x1400967fa
movabs rax, 0x8000000000000001
cmp rcx, rax
jne case.0x14007a536.1017
invalid
add eax, dword [rax]
invalid
mov rsi, r13
mov rcx, qword [rbp + 0x98]
jmp 0x1400966c6
mov rsi, r13
xor edi, edi
jmp 0x1400966c6
int3
invalid
invalid
invalid
mov qword [rbp + 0x98], rcx
jmp 0x1400966c6
invalid
invalid
mov eax, edi
and eax, 0x1f
movzx r8d, byte [r15 + 1]
and r8d, 0x3f
loopne 0x140096853
cmp dil, 0xdf
jbe case.0x14004fee8.1214
invalid
movzx edi, byte [r15 + 2]
shl r8d, 6
shl eax, 6
and edi, 0x3f
or edi, r8d
or edi, eax
cmp dl, 0xf0
cli
invalid
jb 0x14009686b
movzx edx, byte [r15 + 3]
add r15, 4
mov dword [rbx + rax*4], 0xe0c107e0
adc al, cl
out 6, eax
and edx, 0x3f
or edx, edi
or edx, eax
mov edi, edx
cmp edi, 0xffff
invalid
invalid
inc dword [rax]
add byte [rdi + 0x2b], dh
xor eax, eax
jmp 0x1400966e0
invalid
invalid
add r15, 2
shl eax, 6
or eax, r8d
mov edi, eax
invalid
xor eax, eax
jmp 0x1400966e0
add r15, 3
shl eax, 0xc
loopne 0x14009687e
or edi, eax
cmp edi, 0xffff
jbe case.0x14004fee8.1209
lea edx, [rdi + 0xff0000]
shr edx, 0xa
or al, byte [rcx + 0xd800ca]
add byte [rcx + 0x3ffe7], al
add byte [rcx + 0xdc00cf], al
add byte [rcx - 0x16287608], cl
invalid
invalid
invalid
invalid
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, qword [rbp + 0x98]
mov edx, dword [rbp + 0x64]
mov r15d, dword [rbp + 0x5c]
mov r8d, r15d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140096a16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rbp + 0x20], rcx
mov dword [rbp + 0x20], ecx
mov edx, dword [rbp + 0x60]
cmp edx, 9
cli
or dword [rdi], ecx
invalid
cdq
add byte [rax], al
add byte [rax], al
invalid
cmp eax, 5
jne case.0x140062720.1096
mov eax, edx
mov qword [rbp - 8], rax
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
and eax, 0x51b82
jmp 0x140096934
test r15d, r15d
mov r12, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov esp, dword [sym.imp.bcrypt.dll_BCryptGenRandom]
invalid
invalid
invalid
je case.0x140062720.1085
xor r15d, r15d
cmp eax, 0x57
jne case.0x140062720.1085
lea rcx, [rbp + 0x20]
call fcn.1400829c0
invalid
mov edx, 2
mov rcx, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x98]
call fcn.1400084c0
jb 0x140096967
idiv edi
mov dil, 1
xor esi, esi
mov rbx, qword [rbp + 0x88]
add byte [rax], al
mov r14, qword [rbp + 0x90]
add byte [rax], al
jmp 0x140096450
lea r15, [r8 + 3]
shl eax, 0xc
or edi, eax
cmp edi, 0xffff
add byte [rdi], cl
invalid
mov cl, 0xfc
invalid
invalid
lea ecx, [rdi + 0xff0000]
shr ecx, 0xa
jmp 0x140d2ea91
fadd dword [rax]
add byte [rcx + 0x3ffe7], al
add byte [rcx + 0xdc00cf], al
or edi, 0xdc00
mov eax, 2
add byte [rax], al
mov r12d, edi
mov edi, ecx
jmp 0x140096634
mov rax, qword [rbp + 0x68]
mov qword [rax + 8], rcx
or byte [rax - 0x39], cl
mov dword [rax], 1
add byte [rdx + 2], bh
add al, byte [rax]
add byte [rax], al
mov rcx, qword [rbp + 0x98]
mov ecx, dword [rbp + 0x98]
cwde
add byte [rax], al
add al, ch
sti
sbb dh, bh
idiv edi
mov rsi, 0xffffffffffffffff
invalid
invalid
invalid
dec dword [rax - 0x75]
mov ebp, 0x88
mov byte [rax], al
add byte [rax], al
mov r14, qword [rbp + 0x90]
nop
add byte [rax], al
add byte [rax], al
test r14, r14
je 0x1400969ec
mov edx, 1
mov rcx, rdi
stc
call fcn.1400084c0
invalid
cmp rbx, 0xffffffffffffffff
je case.0x140066427.1065
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
invalid
invalid
movaps xmm6, xmmword [rbp + 0xb0]
add rsp, 0x148
add byte [rax], al
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edx, 2
mov rcx, qword [rbp + 0x98]
cwde
add byte [rax], al
add al, ch
cdq
sbb dh, bh
idiv edi
mov dword [rbp + 0x20], 0
add byte [rax], al
mov dword [rbp + 0x40], 0
mov word [rbp + 0x44], 0
add byte [rdi], cl
mov dh, 0x85
movsd dword [rdi], dword [rsi]
add byte [rax], al
add byte [rax + 0x1344145], cl
mov byte [rbp + 0x40], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor r15b, r8b
add byte [r8], r11b
sbb byte [rax], al
add byte [rax], al
mov qword [rbp + 8], 0
or byte [rax], al
add byte [rax], al
add bh, al
adc byte [r9], r8b
adc byte [rcx], al
add byte [rax], al
add byte [rax - 0x77], cl
call 0x1684ef3b6
mov dword [rbp + 0x28], eax
mov r14, qword [rbp + 0x90]
mov ch, 0x90
add byte [rax], al
add byte [rcx + rcx*4 - 0x4b], cl
mov ch, 0x80
add byte [rax], al
add byte [rax - 0x75], cl
mov ebp, 0x88
add byte [rax], al
add byte [rax - 0x77], cl
jge 0x140096aff
mov qword [rbp - 0x20], rbx
mov byte [rbp + 0xa7], 1
test dword [rdi + 0x1000000], esp
add byte [rax], al
add byte [rcx], al
mov byte [rbp + 0xa6], 0
test dword [rsi], esp
add byte [rax], al
add byte [rax], al
lea r8, [rbp + 0x20]
lea eax, [rbp + 0x20]
and byte [rax - 0x77], cl
stc
mov rdx, qword [rbp - 0x10]
mov edx, dword [rbp - 0x10]
invalid
call fcn.14008a460
dec dword [rax - 0x7b]
test eax, eax
je 0x140096ace
mov rax, qword [rbp + 0x68]
mov qword [rax + 8], rdx
mov qword [rax], 1
mov rsi, rbx
test r14, r14
jne case.0x140066427.1081
test dword [rsi], edx
invalid
invalid
invalid
jmp 0x1400969ec
mov rax, qword [rbp + 0x68]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
adc byte [rax - 0x39], cl
add byte [rax], al
add byte [rax], al
add byte [rbp - 0x7b], cl
test byte [rdi], 0x84
adc edi, edi
invalid
invalid
mov edx, 1
mov rcx, rdi
call fcn.1400084c0
idiv edi
jmp case.0x140066427.1065
test rcx, rcx
jne 0x140096b08
call fcn.1400085a0
jmp 0x140096b75
mov rdx, qword [rbp + 0x10]
call fcn.1400e41c0
jmp 0x140096b75
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x80], rax
add byte [rax], al
mov rax, qword [rbp + 0x88]
add byte [rax], al
mov qword [rbp + 0x78], rax
mov byte [rbp + 0xa7], 1
test dword [rdi + 0x1000000], esp
mov byte [rbp + 0xa6], 1
test dword [rsi + 0x1000000], esp
mov ecx, 2
add al, byte [rax]
add byte [rax], al
mov rdx, rbx
call fcn.1400e41c0
jmp 0x140096b75
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x78], rax
mov byte [rbp + 0xa7], 1
add byte [rax], al
add byte [rcx], al
mov byte [rbp + 0xa6], 1
call fcn.1400085a0
ud2