Function at 0x14009b620
Capabilities:
Create pipe
Create thread

Disassembly:
push rsi
push r15
sub rsp, 0x98
cmp qword [rcx + 0x28650], 0xffffffffffffffff
mov r15, rdx
mov rsi, rcx
je 0x14009b648
xor al, al
add rsp, 0x98
pop r15
pop rsi
ret
mov qword [rsp + 0xb8], rbx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
xor r13d, r13d
mov qword [rsp + 0x80], r14
lea edx, [r13 + 1]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea edx, [r13 + 1]
xor r8d, r8d
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x40], SafeArrayCopy
lea rdi, [rsi + 0x285a8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 1
lea rbx, [rsi + 0x18]
xor r12d, r12d
lea ebp, [r13 + 0xa]
mov r14, rdi
nop
lea rax, [rsp + 0x40]
mov r9d, ebp
mov qword [rsp + 0x38], rax
mov edx, 0x40000003
mov dword [rsp + 0x30], 0x3e8
mov r8d, 6
mov dword [rsp + 0x28], 0x6000
mov rcx, r15
mov dword [rsp + 0x20], 0x6000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x14009b7c8
mov edx, 1
xor r9d, r9d
mov r8d, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [r14 - 8], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r14], rax
add r13, 2
mov rax, qword [r14 - 8]
inc r12
mov qword [rbx], rax
mov rax, qword [r14]
add r14, 0x10
mov qword [rbx + 0x20], rax
add rbx, 0x4090
cmp r12, rbp
jb 0x14009b6d0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + r13*8 + 0x285a0], rax
mov r9, rsi
mov qword [rsi + 0x28648], rax
lea r8, [0x14009bed0]
lea rax, [rsp + 0xb0]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1402967ac
mov qword [rsi + 0x28650], rax
test rax, rax
je 0x14009b7c8
mov al, 1
jmp 0x14009b8b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi + 0x28648]
cmp rcx, 0xffffffffffffffff
je 0x14009b7e1
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x28650]
cmp rcx, 0xffffffffffffffff
je 0x14009b806
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x28650]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 0x28648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x28648], 0xffffffffffffffff
lea rbx, [rsi + 0x40]
mov qword [rsi + 0x28640], 0xffffffffffffffff
nop dword [rax]
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x14009b84f
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0xffffffffffffffff
mov rcx, qword [rdi - 8]
cmp rcx, 0xffffffffffffffff
je 0x14009b867
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi - 8], 0xffffffffffffffff
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x14009b87d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0xffffffffffffffff
mov qword [rbx - 0x28], 0xffffffffffffffff
add rdi, 0x10
mov qword [rbx - 8], 0xffffffffffffffff
mov dword [rbx + 0x4014], 0
add rbx, 0x4090
sub rbp, 1
jne 0x14009b830
mov rcx, rsi
call fcn.14009baa0
xor al, al
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x80]
add rsp, 0x98
pop r15
pop rsi
ret