Function at 0x18f88b11dc
Capabilities:
Contain obfuscated stackstrings
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rsi, rcx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18f88e5408]
lea rcx, [0x18f88e5400]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r12d, r12d
test eax, eax
jne 0x18f88b151f
mov rbx, qword [rsi + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov ecx, 0x4448
mov dword [rsp + 0x20], 0x441a4448
mov dword [rsp + 0x24], 0x442c442d
mov dword [rsp + 0x28], 0x443a4421
mov dword [rsp + 0x2c], 0x442b442d
mov dword [rsp + 0x30], 0x4472443c
mov dword [rsp + 0x34], 0x440b4468
mov dword [rsp + 0x38], 0x442d443a
mov dword [rbp - 0x7d], 0x443c4429
mov dword [rbp - 0x79], 0x4418442d
mov dword [rbp - 0x75], 0x44384421
mov dword [rbp - 0x71], 0x4468442d
mov dword [rbp - 0x6d], 0x4429442e
mov dword [rbp - 0x69], 0x44244421
mov dword [rbp - 0x65], 0x442c442d
mov dword [rbp - 0x61], 0x440f4468
mov dword [rbp - 0x5d], 0x440d4404
mov dword [rbp - 0x59], 0x446d4475
mov dword [rbp - 0x55], 0x4442442c
mov word [rbp - 0x51], cx
mov eax, ecx
xor ax, word [0x18f88dd7f8]
mov word [rbp - 0x4f], ax
mov eax, ecx
xor ax, word [0x18f88dd7fa]
mov word [rbp - 0x4d], ax
mov eax, ecx
xor ax, word [0x18f88dd7fc]
mov word [rbp - 0x4b], ax
mov eax, ecx
xor ax, word [0x18f88dd7fe]
mov word [rbp - 0x49], ax
mov eax, ecx
xor ax, word [str.Redirect:_SetStdHandle_failed_GLE_d_n]
mov word [rbp - 0x47], ax
mov eax, ecx
xor ax, word [0x18f88dd802]
mov word [rbp - 0x45], ax
mov eax, ecx
xor ax, word [0x18f88dd804]
mov word [rbp - 0x43], ax
mov eax, ecx
xor ax, word [0x18f88dd806]
mov word [rbp - 0x41], ax
mov eax, ecx
xor ax, word [0x18f88dd808]
mov word [rbp - 0x3f], ax
mov eax, ecx
xor ax, word [0x18f88dd80a]
mov word [rbp - 0x3d], ax
mov eax, ecx
xor ax, word [0x18f88dd80c]
mov word [rbp - 0x3b], ax
mov eax, ecx
xor ax, word [0x18f88dd80e]
mov word [rbp - 0x39], ax
mov eax, ecx
xor ax, word [0x18f88dd810]
mov word [rbp - 0x37], ax
mov eax, ecx
xor ax, word [0x18f88dd812]
mov word [rbp - 0x35], ax
mov eax, ecx
xor ax, word [0x18f88dd814]
mov word [rbp - 0x33], ax
mov eax, ecx
xor ax, word [0x18f88dd816]
mov word [rbp - 0x31], ax
mov eax, ecx
xor ax, word [0x18f88dd818]
mov word [rbp - 0x2f], ax
mov eax, ecx
xor ax, word [0x18f88dd81a]
mov word [rbp - 0x2d], ax
mov eax, ecx
xor ax, word [0x18f88dd81c]
mov word [rbp - 0x2b], ax
mov eax, ecx
xor ax, word [0x18f88dd81e]
mov word [rbp - 0x29], ax
mov eax, ecx
xor ax, word [0x18f88dd820]
mov word [rbp - 0x27], ax
mov eax, ecx
xor ax, word [0x18f88dd822]
mov word [rbp - 0x25], ax
mov eax, ecx
xor ax, word [0x18f88dd824]
mov word [rbp - 0x23], ax
mov eax, ecx
xor ax, word [0x18f88dd826]
mov word [rbp - 0x21], ax
mov eax, ecx
xor ax, word [0x18f88dd828]
mov word [rbp - 0x1f], ax
mov eax, ecx
xor ax, word [0x18f88dd82a]
mov word [rbp - 0x1d], ax
mov eax, ecx
xor ax, word [0x18f88dd82c]
mov word [rbp - 0x1b], ax
mov eax, ecx
xor ax, word [0x18f88dd82e]
mov word [rbp - 0x19], ax
mov eax, ecx
xor ax, word [0x18f88dd830]
mov word [rbp - 0x17], ax
mov eax, ecx
xor ax, word [0x18f88dd832]
mov word [rbp - 0x15], ax
mov eax, ecx
xor ax, word [0x18f88dd834]
mov word [rbp - 0x13], ax
mov eax, ecx
xor ax, word [0x18f88dd836]
mov word [rbp - 0x11], ax
mov eax, ecx
xor ax, word [0x18f88dd838]
mov word [rbp - 0xf], ax
mov eax, ecx
xor ax, word [0x18f88dd83a]
mov word [rbp - 0xd], ax
mov eax, ecx
xor ax, word [0x18f88dd83c]
mov word [rbp - 0xb], ax
xor eax, eax
mov word [rbp - 9], ax
mov eax, r12d
xor word [rsp + rax*2 + 0x22], cx
inc rax
cmp rax, 0x47
jae 0x18f88b14b3
movzx ecx, word [rsp + 0x20]
jmp 0x18f88b149e
mov word [rbp - 9], r12w
lea rdx, [rsp + 0x22]
lea rcx, [rbp + 0x1f]
call fcn.18f88bba18
nop
lea r8, [rbp + 7]
mov rdx, rax
mov ecx, dword [rsi]
call rbx
nop
lea rcx, [rbp + 0x1f]
call fcn.18f88baf4c
nop
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18f88b1be1
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18f88b1bdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b1c11
jmp 0x18f88b1bdc
mov ebx, 0xfffffff5
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, 0xfffffff4
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdx, qword [0x18f88e5408]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x18f88b1882
mov rbx, qword [rsi + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov dword [rsp + 0x20], 0x71005e
mov dword [rsp + 0x24], 0x750070
mov dword [rsp + 0x28], 0x71007e
mov dword [rsp + 0x2c], 0x80006f
mov dword [rsp + 0x30], 0x2c0046
mov dword [rsp + 0x34], 0x71005f
mov dword [rsp + 0x38], 0x5f0080
mov dword [rbp - 0x7d], 0x700080
mov dword [rbp - 0x79], 0x6d0054
mov dword [rbp - 0x75], 0x70007a
mov dword [rbp - 0x71], 0x710078
mov dword [rbp - 0x6d], 0x72002c
mov dword [rbp - 0x69], 0x75006d
mov dword [rbp - 0x65], 0x710078
mov dword [rbp - 0x61], 0x2c0070
mov dword [rbp - 0x5d], 0x580053
mov dword [rbp - 0x59], 0x490051
mov dword [rbp - 0x55], 0x700031
mov dword [rbp - 0x51], 0xc0016
mov ecx, 0xc
movzx eax, word [0x18f88dd84c]
add ax, cx
mov word [rbp - 0x4d], ax
movzx eax, word [0x18f88dd84e]
add ax, cx
mov word [rbp - 0x4b], ax
movzx eax, word [0x18f88dd850]
add ax, cx
mov word [rbp - 0x49], ax
movzx eax, word [0x18f88dd852]
add ax, cx
mov word [rbp - 0x47], ax
movzx eax, word [0x18f88dd854]
add ax, cx
mov word [rbp - 0x45], ax
movzx eax, word [0x18f88dd856]
add ax, cx
mov word [rbp - 0x43], ax
movzx eax, word [0x18f88dd858]
add ax, cx
mov word [rbp - 0x41], ax
movzx eax, word [0x18f88dd85a]
add ax, cx
mov word [rbp - 0x3f], ax
movzx eax, word [0x18f88dd85c]
add ax, cx
mov word [rbp - 0x3d], ax
movzx eax, word [0x18f88dd85e]
add ax, cx
mov word [rbp - 0x3b], ax
movzx eax, word [str.Load_.NET_2:_mscoree.dll_not_found_n]
add ax, cx
mov word [rbp - 0x39], ax
movzx eax, word [0x18f88dd862]
add ax, cx
mov word [rbp - 0x37], ax
movzx eax, word [0x18f88dd864]
add ax, cx
mov word [rbp - 0x35], ax
movzx eax, word [0x18f88dd866]
add ax, cx
mov word [rbp - 0x33], ax
movzx eax, word [0x18f88dd868]
add ax, cx
mov word [rbp - 0x31], ax
movzx eax, word [0x18f88dd86a]
add ax, cx
mov word [rbp - 0x2f], ax
movzx eax, word [0x18f88dd86c]
add ax, cx
mov word [rbp - 0x2d], ax
movzx eax, word [0x18f88dd86e]
add ax, cx
mov word [rbp - 0x2b], ax
movzx eax, word [0x18f88dd870]
add ax, cx
mov word [rbp - 0x29], ax
movzx eax, word [0x18f88dd872]
add ax, cx
mov word [rbp - 0x27], ax
movzx eax, word [0x18f88dd874]
add ax, cx
mov word [rbp - 0x25], ax
movzx eax, word [0x18f88dd876]
add ax, cx
mov word [rbp - 0x23], ax
movzx eax, word [0x18f88dd878]
add ax, cx
mov word [rbp - 0x21], ax
movzx eax, word [0x18f88dd87a]
add ax, cx
mov word [rbp - 0x1f], ax
movzx eax, word [0x18f88dd87c]
add ax, cx
mov word [rbp - 0x1d], ax
movzx eax, word [0x18f88dd87e]
add ax, cx
mov word [rbp - 0x1b], ax
movzx eax, word [0x18f88dd880]
add ax, cx
mov word [rbp - 0x19], ax
movzx eax, word [0x18f88dd882]
add ax, cx
mov word [rbp - 0x17], ax
movzx eax, word [0x18f88dd884]
add ax, cx
mov word [rbp - 0x15], ax
movzx eax, word [0x18f88dd886]
add ax, cx
mov word [rbp - 0x13], ax
movzx eax, word [0x18f88dd888]
add ax, cx
mov word [rbp - 0x11], ax
movzx eax, word [0x18f88dd88a]
add ax, cx
mov word [rbp - 0xf], ax
movzx eax, word [0x18f88dd88c]
add ax, cx
mov word [rbp - 0xd], ax
movzx eax, word [0x18f88dd88e]
add ax, cx
mov word [rbp - 0xb], ax
movzx eax, word [0x18f88dd890]
add ax, cx
mov word [rbp - 9], ax
movzx eax, word [0x18f88dd892]
add ax, cx
mov word [rbp - 7], ax
movzx eax, word [0x18f88dd894]
add ax, cx
mov word [rbp - 5], ax
mov word [rbp - 3], r12w
mov rax, r12
mov ecx, 0xfff4
add word [rsp + rax*2 + 0x20], cx
inc rax
cmp rax, 0x4b
jb 0x18f88b1808
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x1f]
call fcn.18f88bba18
nop
lea r8, [rbp + 7]
mov rdx, rax
mov ecx, dword [rsi]
call rbx
nop
lea rcx, [rbp + 0x1f]
call fcn.18f88baf4c
nop
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18f88b1be1
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18f88b1bdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b1c17
jmp 0x18f88b1bdc
mov rdx, qword [0x18f88e5408]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x18f88b1be5
mov r14, qword [rsi + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
mov edi, 0x857c
mov dword [rsp + 0x20], 0x852e857c
mov dword [rsp + 0x24], 0x851a8518
mov dword [rsp + 0x28], 0x85f28516
mov dword [rsp + 0x2c], 0x85e185e4
mov dword [rsp + 0x30], 0x85be85f7
lea ebx, [rdi + 0x42]
lea edx, [rdi + 0x29]
mov dword [rsp + 0x34], 0x85d585a5
mov dword [rsp + 0x38], 0x85fc85e2
mov dword [rbp - 0x7d], 0x85fe85da
mov dword [rbp - 0x79], 0x85c485ef
lea r11d, [rdi + 0x48]
mov dword [rbp - 0x75], 0x85e085ec
mov dword [rbp - 0x71], 0x85fc85eb
mov dword [rbp - 0x6d], 0x85b285f4
lea r8d, [rdi + 0x36]
mov dword [rbp - 0x69], 0x85f585f5
mov dword [rbp - 0x65], 0x85fa85fc
mov dword [rbp - 0x61], 0x85fc85f2
lea r10d, [rdi + 0x3d]
mov dword [rbp - 0x5d], 0x85dd85b9
mov dword [rbp - 0x59], 0x85d985d7
mov dword [rbp - 0x55], 0x85bb85a0
lea r9d, [rdi + 0x3f]
mov dword [rbp - 0x51], 0x85aa85fb
lea ecx, [rdi + 0x2e]
lea eax, [rdi + 0x25]
mov word [rbp - 0x4d], ax
lea eax, [rdi + 0x26]
xor ax, word [0x18f88dd84c]
mov word [rbp - 0x4b], ax
lea eax, [rdi + 0x27]
xor ax, word [0x18f88dd84e]
mov word [rbp - 0x49], ax
lea eax, [rdi + 0x28]
xor ax, word [0x18f88dd850]
mov word [rbp - 0x47], ax
xor dx, word [0x18f88dd852]
mov word [rbp - 0x45], dx
lea eax, [rdi + 0x2a]
xor ax, word [0x18f88dd854]
mov word [rbp - 0x43], ax
lea eax, [rdi + 0x2b]
xor ax, word [0x18f88dd856]
mov word [rbp - 0x41], ax
lea eax, [rdi + 0x2c]
xor ax, word [0x18f88dd858]
mov word [rbp - 0x3f], ax
lea eax, [rdi + 0x2d]
xor ax, word [0x18f88dd85a]
mov word [rbp - 0x3d], ax
xor cx, word [0x18f88dd85c]
mov word [rbp - 0x3b], cx
lea eax, [rdi + 0x2f]
xor ax, word [0x18f88dd85e]
mov word [rbp - 0x39], ax
lea eax, [rdi + 0x30]
xor ax, word [str.Load_.NET_2:_mscoree.dll_not_found_n]
mov word [rbp - 0x37], ax
lea eax, [rdi + 0x31]
xor ax, word [0x18f88dd862]
mov word [rbp - 0x35], ax
lea eax, [rdi + 0x32]
xor ax, word [0x18f88dd864]
mov word [rbp - 0x33], ax
lea eax, [rdi + 0x33]
xor ax, word [0x18f88dd866]
mov word [rbp - 0x31], ax
lea eax, [rdi + 0x34]
xor ax, word [0x18f88dd868]
mov word [rbp - 0x2f], ax
lea eax, [rdi + 0x35]
xor ax, word [0x18f88dd86a]
mov word [rbp - 0x2d], ax
xor r8w, word [0x18f88dd86c]
mov word [rbp - 0x2b], r8w
lea eax, [rdi + 0x37]
xor ax, word [0x18f88dd86e]
mov word [rbp - 0x29], ax
lea eax, [rdi + 0x38]
xor ax, word [0x18f88dd870]
mov word [rbp - 0x27], ax
lea eax, [rdi + 0x39]
xor ax, word [0x18f88dd872]
mov word [rbp - 0x25], ax
lea eax, [rdi + 0x3a]
xor ax, word [0x18f88dd874]
mov word [rbp - 0x23], ax
lea eax, [rdi + 0x3b]
xor ax, word [0x18f88dd876]
mov word [rbp - 0x21], ax
lea eax, [rdi + 0x3c]
xor ax, word [0x18f88dd878]
mov word [rbp - 0x1f], ax
xor r10w, word [0x18f88dd87a]
mov word [rbp - 0x1d], r10w
lea eax, [rdi + 0x3e]
xor ax, word [0x18f88dd87c]
mov word [rbp - 0x1b], ax
xor r9w, word [0x18f88dd87e]
mov word [rbp - 0x19], r9w
lea eax, [rdi + 0x40]
xor ax, word [0x18f88dd880]
mov word [rbp - 0x17], ax
lea eax, [rdi + 0x41]
xor ax, word [0x18f88dd882]
mov word [rbp - 0x15], ax
xor bx, word [0x18f88dd884]
mov word [rbp - 0x13], bx
lea eax, [rdi + 0x43]
xor ax, word [0x18f88dd886]
mov word [rbp - 0x11], ax
lea eax, [rdi + 0x44]
xor ax, word [0x18f88dd888]
mov word [rbp - 0xf], ax
lea eax, [rdi + 0x45]
xor ax, word [0x18f88dd88a]
mov word [rbp - 0xd], ax
lea eax, [rdi + 0x46]
xor ax, word [0x18f88dd88c]
mov word [rbp - 0xb], ax
lea eax, [rdi + 0x47]
xor ax, word [0x18f88dd88e]
mov word [rbp - 9], ax
xor r11w, word [0x18f88dd890]
mov word [rbp - 7], r11w
lea eax, [rdi + 0x49]
xor ax, word [0x18f88dd892]
mov word [rbp - 5], ax
lea eax, [rdi + 0x4a]
xor ax, word [0x18f88dd894]
mov word [rbp - 3], ax
xor eax, eax
mov word [rbp - 1], ax
mov rax, r12
add di, ax
xor word [rsp + rax*2 + 0x22], di
inc rax
cmp rax, 0x4b
jae 0x18f88b1b7d
movzx edi, word [rsp + 0x20]
jmp 0x18f88b1b65
mov word [rbp - 1], r12w
mov r8d, r15d
lea rdx, [rsp + 0x22]
lea rcx, [rbp + 0x1f]
call fcn.18f88bba18
nop
lea r8, [rbp + 7]
mov rdx, rax
mov ecx, dword [rsi]
call r14
nop
lea rcx, [rbp + 0x1f]
call fcn.18f88baf4c
nop
mov rcx, qword [rbp + 7]
test rcx, rcx
je 0x18f88b1be1
mov rdx, qword [rbp + 0x17]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18f88b1bdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18f88b1c0b
call fcn.18f88bd1e0
xor eax, eax
jmp 0x18f88b1bea
mov eax, 1
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18f88c3388
int3
call fcn.18f88c3388
int3
call fcn.18f88c3388
int3