Function at 0x1400b3390
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Connect pipe
Create mailslot
Create pipe
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov r14, rcx
lea rcx, [rax + 0x20]
call fcn.140056904
lea rcx, [rsp + 0x308]
call fcn.1400568f4
xor esi, esi
cmp eax, esi
jne 0x1400b33d9
lea eax, [rsi + 1]
jmp 0x1400b4f62
lea rcx, [rsp + 0x308]
call fcn.140056bd8
lea rcx, [rsp + 0xc0]
call fcn.14005c96c
lea rcx, [rsp + 0x128]
call fcn.14005c96c
lea rcx, [rsp + 0x138]
call fcn.14005c96c
lea rcx, [rsp + 0x140]
call fcn.14005c96c
mov r12d, 2
lea rcx, [rsp + 0x2f8]
lea r15d, [r12 - 1]
mov rbx, rsi
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x98], 6
mov byte [rsp + 0x308], sil
mov byte [rsp + 0x68], sil
mov r13d, r15d
mov dword [rsp + 0xa0], r15d
mov dword [rsp + 0x60], r15d
call fcn.140054c14
mov rdi, qword [rsp + 0x2f8]
lea edx, [r12 + 0x2b]
mov bpl, sil
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x70], 3
lea eax, [rdx - 3]
lea r8d, [r12 + 2]
cmp dx, word [rdi]
jne 0x1400b374c
lea r11d, [r12 + 7]
lea r14d, [r12 + 0x21]
cmp dx, word [rdi + 2]
jne 0x1400b3736
lea rcx, str.__gethostbyname
mov r8d, 0xf
mov rdx, rdi
call fcn.14005615c
cmp al, sil
je 0x1400b354c
add rdi, 0x1e
mov qword [rsp + 0x2f8], rdi
movzx eax, word [rdi]
cmp ax, si
je 0x1400b34ee
cmp r11w, ax
ja 0x1400b34e2
cmp ax, 0xd
jbe 0x1400b34ee
mov edx, 0x20
cmp dx, ax
jne 0x1400b34f6
jmp 0x1400b34f3
mov edx, 0x20
mov bpl, r15b
cmp ax, si
je 0x1400b3713
mov ecx, 0x2a
lea r13d, [rcx - 0x26]
cmp r11w, ax
ja 0x1400b3514
cmp ax, 0xd
jbe 0x1400b353f
cmp dx, ax
je 0x1400b353f
cmp cx, ax
jne 0x1400b3523
or bpl, r12b
jmp 0x1400b352c
cmp r14w, ax
jne 0x1400b352c
or bpl, r13b
add rdi, r12
mov qword [rsp + 0x2f8], rdi
mov ax, word [rdi]
cmp ax, si
jne 0x1400b3508
mov r13d, dword [rsp + 0xa0]
jmp 0x1400b3713
or rdi, 0xffffffffffffffff
lea rdx, [rsp + 0x2f8]
lea rcx, str.__file
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b357f
mov r13d, edi
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0x60], edi
jmp 0x1400b36cd
lea rdx, [rsp + 0x2f8]
lea rcx, str.__shm
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b35a6
mov r13d, 0xfffffffe
jmp 0x1400b3677
lea rdx, [rsp + 0x2f8]
lea rcx, str.__event
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b35cd
mov r13d, 0xfffffffc
jmp 0x1400b3677
lea rdx, [rsp + 0x2f8]
lea rcx, str.__semaphore
mov r8d, edi
call fcn.14005f144
cmp al, sil
jne 0x1400b3605
lea rdx, [rsp + 0x2f8]
lea rcx, str.__sem
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b360d
mov r13d, 0xffffffe0
jmp 0x1400b3677
lea rdx, [rsp + 0x2f8]
lea rcx, str.__mutex
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b3631
mov r13d, 0xffffffc0
jmp 0x1400b3677
lea rdx, [rsp + 0x2f8]
lea rcx, str.__mailslot
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b3655
mov r13d, 0xfffffff8
jmp 0x1400b3677
lea rdx, [rsp + 0x2f8]
lea rcx, str.__pipe
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b3686
mov r13d, 0xfffffff0
mov dword [rsp + 0xa0], r13d
mov dword [rsp + 0x60], r13d
jmp 0x1400b36cd
lea rdx, [rsp + 0x2f8]
lea rcx, str.__exist
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b36ac
mov byte [rsp + 0x308], r15b
jmp 0x1400b36cd
lea rdx, [rsp + 0x2f8]
lea rcx, str.__only
mov r8d, edi
call fcn.14005f144
cmp al, sil
je 0x1400b36d5
mov byte [rsp + 0x68], r15b
mov r11d, 9
jmp 0x1400b3720
mov rcx, qword [rsp + 0x2f8]
mov r11d, 9
movzx eax, word [rcx]
cmp ax, si
je 0x1400b3713
lea edx, [r11 + 0x17]
cmp r11w, ax
ja 0x1400b36fb
cmp ax, 0xd
jbe 0x1400b3713
cmp dx, ax
je 0x1400b3713
add rcx, r12
mov qword [rsp + 0x2f8], rcx
mov ax, word [rcx]
cmp ax, si
jne 0x1400b36ef
lea rcx, [rsp + 0x2f8]
call fcn.140054c14
mov rdi, qword [rsp + 0x2f8]
mov edx, 0x2d
cmp dx, word [rdi]
je 0x1400b349a
mov r14, qword [rsp + 0x2f0]
mov eax, 0x2a
mov byte [rsp + 0x40], bpl
lea r8d, [rax - 0x26]
mov byte [rsp + 0x78], sil
cmp ax, word [rdi]
jne 0x1400b377b
add rdi, r12
lea rcx, [rsp + 0x2f8]
mov byte [rsp + 0x78], r15b
mov qword [rsp + 0x2f8], rdi
call fcn.140054c14
mov rdi, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0xc8], r14
or r14, 0xffffffffffffffff
mov qword [rsp + 0xe0], rax
lea eax, [r14 + 0x3b]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x90], 0x100000
mov dword [rsp + 0x80], 0x80000001
cmp ax, word [rdi]
jne 0x1400b37fc
cmp ax, word [rdi + 2]
jne 0x1400b37fc
lea rax, [0x14011c020]
add rdi, r8
mov byte [rsp + 0x50], r15b
mov qword [rsp + 0xc8], rax
mov rax, qword [0x14011c060]
mov qword [rsp + 0x2f8], rdi
mov qword [rsp + 0xe0], rax
mov rdi, qword [rsp + 0x2f0]
mov eax, 0x3b
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x2f8]
lea r9d, [rax - 0xf]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov dl, sil
mov byte [rsp + 0x51], dl
mov r10d, 0xffdf
mov r11d, 0x57
cmp r13d, 0xfffffffe
jne 0x1400b3899
mov rcx, qword [rsp + 0x2f8]
movzx eax, word [rcx]
and ax, r10w
cmp r11w, ax
jne 0x1400b3868
add rcx, r12
mov byte [rsp + 0x51], r15b
mov qword [rsp + 0x2f8], rcx
movzx eax, word [rcx]
cmp ax, si
je 0x1400b38b3
mov edx, 0x3b
lea r8d, [rdx - 0xf]
add rcx, r12
mov qword [rsp + 0x2f8], rcx
cmp r8w, ax
je 0x1400b38b3
cmp dx, ax
je 0x1400b38b3
mov ax, word [rcx]
cmp ax, si
jne 0x1400b3879
jmp 0x1400b38b3
cmp r13d, 0xfffffffc
je 0x1400b38ab
cmp r13d, 0xffffffe0
je 0x1400b38ab
cmp r13d, 0xffffffc0
jne 0x1400b390d
mov rcx, qword [rsp + 0x2f8]
mov eax, 0x2e
cmp ax, word [rcx]
jne 0x1400b38d1
add rcx, r12
lea rdx, str.Local_
mov qword [rsp + 0x2f8], rcx
jmp 0x1400b38ed
mov eax, 0x23
cmp ax, word [rcx]
jne 0x1400b38e6
add rcx, r12
mov qword [rsp + 0x2f8], rcx
lea rdx, [0x140109bc0]
lea rcx, [rsp + 0x58]
mov r9, r14
mov r8, r14
call fcn.14005cb28
mov dl, byte [rsp + 0x51]
mov r11d, 0x57
mov r10d, 0xffdf
cmp bpl, sil
je 0x1400b3bbe
lea rcx, [rsp + 0xb8]
call fcn.14005c96c
mov eax, 0x3b
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x2f8]
lea r9d, [rax - 0xf]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0xb8]
mov eax, 4
lea rcx, [rsp + 0xb0]
mov r14d, esi
movzx ebx, ax
mov word [rsp + 0x68], ax
or rax, 0xffffffffffffffff
mov r9, rax
mov r8, rax
mov qword [rsp + 0xb0], rsi
call fcn.14005c8a8
lea rcx, [rsp + 0x48]
call fcn.14005c96c
mov rdi, qword [rsp + 0xb0]
mov dword [rsp + 0x98], esi
lea r13, [rsp + 0x98]
mov byte [rsp + 0x308], r15b
mov rbp, rsi
cmp rdi, rsi
je 0x1400b3a08
cmp byte [rdi], sil
je 0x1400b39d2
mov rcx, rdi
call qword [0x14011c428]
mov dword [rsp + 0x98], eax
cmp eax, 0xffffffff
jne 0x1400b3a08
mov dword [rsp + 0x98], esi
mov rcx, rdi
call qword [0x14011c430]
cmp rax, rsi
je 0x1400b3a08
mov rbp, qword [rax + 0x18]
mov bx, word [rax + 0x12]
mov word [rsp + 0x68], bx
cmp qword [rbp], rsi
je 0x1400b3a08
mov al, byte [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov byte [rsp + 0x308], al
jmp 0x1400b3b70
mov eax, 4
test byte [rsp + 0x40], al
je 0x1400b3ac4
lea eax, [r14 + 0x3e]
lea rcx, [rsp + 0x48]
movsxd rdx, eax
call fcn.14005ca6c
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
movsx eax, bx
mov ecx, 0x20
movsxd r11, r14d
cmp eax, ecx
lea r15, [rdi + r11*2]
mov rdx, r13
cmova eax, ecx
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x2f8], r15
movsxd r8, eax
mov qword [rsp + 0xe8], rsi
call fcn.14001bd80
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x2f8]
lea r8, str.0x_08I64X
call fcn.1400cca04
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, qword [rsp + 0x2f8]
lea rdx, [rax + rcx*2]
mov qword [rsp + 0x2f8], rdx
jmp 0x1400b3b4c
movsx ebx, bx
lea eax, [rbx + rbx*2]
lea ecx, [r14 + rax*2]
movsxd rdx, ecx
lea rcx, [rsp + 0x48]
call fcn.14005ca6c
mov rdi, qword [rsp + 0x48]
movsxd r11, r14d
lea rax, [rdi + r11*2]
dec ebx
cmp ebx, esi
lea rdx, [rax + 2]
mov qword [rsp + 0x2f8], rax
mov r15, rax
jl 0x1400b3b41
movzx r8d, byte [r13]
lea rdx, [0x14010a4b8]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x2f8]
inc r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
sub ebx, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x2f8]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x2f8], rax
mov rdx, rax
jns 0x1400b3afc
mov bx, word [rsp + 0x68]
sub rdx, r12
mov word [rdx], si
test byte [rsp + 0x308], r12b
je 0x1400b3b82
cmp qword [rbp], rsi
je 0x1400b3b82
mov eax, 0x20
mov word [rdx], ax
sub rdx, r15
add rdx, r12
sar rdx, 1
add r14d, edx
mov r13, qword [rbp]
cmp r13, rsi
je 0x1400b3b82
add rbp, 8
jmp 0x1400b3a08
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x2f0]
mov r8, rdi
call fcn.14005be18
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0xb0]
call fcn.140054c44
lea rcx, [rsp + 0xb8]
jmp 0x1400b3e36
or r14, 0xffffffffffffffff
mov qword [rsp + 0xd8], rsi
cmp r13d, r14d
jne 0x1400b3eaa
mov rcx, qword [rsp + 0x2f8]
mov ebp, 0x80000000
mov r14d, 7
movzx eax, word [rcx]
mov edx, esi
and ax, r10w
cmp r11w, ax
jne 0x1400b3c0d
add rcx, r12
mov ebp, 0xc0000000
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x2f8], rcx
movzx eax, word [rcx]
mov r8d, 0x45
and ax, r10w
cmp r8w, ax
jne 0x1400b3c33
add rcx, r12
mov dword [rsp + 0x70], 3
mov qword [rsp + 0x2f8], rcx
mov eax, 0x2d
cmp ax, word [rcx]
jne 0x1400b3c4e
add rcx, r12
mov r14d, esi
mov edx, r15d
mov qword [rsp + 0x2f8], rcx
movzx eax, word [rcx]
movsxd rdx, edx
cmp ax, si
je 0x1400b3cc8
mov r9d, 0x3b
lea r8d, [r9 - 0xf]
lea r13d, [r9 - 0x37]
add rcx, r12
mov qword [rsp + 0x2f8], rcx
cmp r8w, ax
je 0x1400b3cc0
cmp r9w, ax
je 0x1400b3cc0
and ax, r10w
cmp rdx, rsi
je 0x1400b3cb8
mov r8d, 0x52
cmp r8w, ax
jne 0x1400b3c98
or r14d, r15d
jmp 0x1400b3cb2
cmp r11w, ax
jne 0x1400b3ca3
or r14d, r12d
jmp 0x1400b3cb2
mov r8d, 0x44
cmp r8w, ax
jne 0x1400b3cb2
or r14d, r13d
mov r8d, 0x2c
mov ax, word [rcx]
cmp ax, si
jne 0x1400b3c67
mov r13d, dword [rsp + 0xa0]
lea rcx, [rsp + 0x90]
call fcn.14005c96c
mov eax, 0x3b
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x2f8]
lea r9d, [rax - 0xf]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rcx, qword [rsp + 0x90]
call fcn.14001a310
mov rdi, rax
cmp word [rax], si
jne 0x1400b3d37
lea rcx, [rsp + 0x90]
call fcn.140054c44
cmp byte [rsp + 0x308], sil
jne 0x1400b4cca
mov rsi, 0xffffffff80070057
jmp 0x1400b4f21
cmp dword [rsp + 0x70], 3
jne 0x1400b3dce
cmp r14d, esi
je 0x1400b3dce
mov eax, 0x5c
cmp ax, word [rdi]
jne 0x1400b3daa
cmp ax, word [rdi + 2]
jne 0x1400b3daa
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0xa8]
xor r9d, r9d
mov r8d, ebp
mov rdx, rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400037d4
mov rcx, qword [rsp + 0xa8]
cmp rcx, rsi
je 0x1400b3e05
cmp rcx, 0xffffffffffffffff
je 0x1400b3dce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b3dce
mov rcx, rdi
call fcn.1400e0b38
movabs rcx, 0x100000010
and rax, rcx
movabs rcx, 0x100000000
cmp rax, rcx
jne 0x1400b3e05
mov ebx, dword [rsp + 0x70]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0xa8]
mov r9d, r14d
mov r8d, ebp
mov rdx, rdi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400037d4
mov rbx, rax
cmp byte [rsp + 0x308], sil
je 0x1400b3e21
lea rcx, [rsp + 0x90]
call fcn.140054c44
jmp 0x1400b4cb7
cmp rbx, rsi
jne 0x1400b3e40
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x90]
mov esi, eax
call fcn.140054c44
jmp 0x1400b4f21
lea rcx, [rsp + 0x90]
call fcn.140054c44
mov r15, rsi
mov rbp, qword [rsp + 0xe0]
mov dil, byte [rsp + 0x50]
mov r14, qword [rsp + 0xc8]
cmp rbp, rsi
jne 0x1400b4e65
mov al, dil
mov rcx, r14
neg al
sbb rdx, rdx
and rdx, qword [rsp + 0x2f0]
call fcn.14001989c
mov rbp, qword [r14 + 0x40]
cmp rbp, rsi
jne 0x1400b4e65
cmp rbx, rsi
je 0x1400b3d2b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b3d2b
cmp r13d, 0xfffffffe
jne 0x1400b4410
lea eax, [r13 + 6]
mov r15d, r12d
mov dword [rsp + 0x60], 0x80000000
mov dword [rsp + 0x80], esi
mov rdi, rsi
mov qword [rsp + 0xd0], rsi
mov r14d, eax
mov qword [rsp + 0xb8], rsi
mov r13, rsi
mov qword [rsp + 0x90], rsi
mov rbp, rsi
cmp dl, sil
je 0x1400b3f0a
mov r14d, dword [rsp + 0x98]
mov r15d, eax
mov dword [rsp + 0x60], 0xc0000000
mov dword [rsp + 0x70], eax
lea rcx, [rsp + 0x48]
call fcn.14005c96c
lea rcx, [rsp + 0xb0]
call fcn.14005c96c
mov rbx, qword [rsp + 0x2f0]
mov eax, 0x3b
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x2f8]
lea r9d, [rax - 0xf]
mov rcx, rbx
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x2f8]
cmp word [rdx], si
je 0x1400b3ff6
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x2f8]
call fcn.14006b114
mov rdx, qword [rsp + 0x2f8]
cmp word [rdx], si
je 0x1400b3fec
add rdx, r12
mov eax, 0x3b
lea r8, [rsp + 0xb0]
mov qword [rsp + 0x2f8], rdx
lea r9d, [rax - 0xf]
lea rdx, [rsp + 0x2f8]
mov rcx, rbx
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x2f8]
cmp word [rdx], si
je 0x1400b3fec
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x2f8]
call fcn.14006b114
mov rdx, qword [rsp + 0x2f8]
mov rbx, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xd0]
jmp 0x1400b3ff9
mov rbx, qword [rsp + 0xb8]
jmp 0x1400b3ff9
mov rbx, rsi
mov rax, qword [rsp + 0x48]
cmp word [rax], si
je 0x1400b43f4
cmp rbx, rsi
jl 0x1400b43f4
cmp rdi, rsi
jl 0x1400b43f4
cmp word [rdx], si
je 0x1400b4085
add rdx, r12
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x2f8], rdx
lea rdx, [rsp + 0x90]
call fcn.1400071a4
mov rcx, qword [rsp + 0x2f8]
cmp eax, esi
mov dword [rsp + 0x80], eax
cmovg rbp, rbx
mov qword [rsp + 0xa8], rbp
cmp word [rcx], si
je 0x1400b407d
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x2f8]
call fcn.1400071a4
mov rbp, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x90]
or qword [rsp + 0xb8], 0xffffffffffffffff
lea rdx, str.pecmd2012.shm.
lea rcx, [rsp + 0x58]
mov r12, rsi
call fcn.14005caa8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov rdx, qword [rsp + 0xb0]
movzx edx, word [rdx]
movzx eax, dx
neg ax
sbb eax, eax
not eax
and eax, 8
neg dx
sbb ecx, ecx
mov dword [rsp + 0x88], eax
xor edx, edx
not ecx
and ecx, 4
add eax, ecx
mov dword [rsp + 0x90], ecx
mov ecx, r14d
cdqe
add rbx, rax
mov qword [rsp + 0x120], rax
lea rax, [rbx + rdi]
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0xa8], rbx
mov r8, rdi
mov qword [rsp + 0x130], rax
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, esi
cmp byte [rsp + 0x308], sil
je 0x1400b414f
lea rcx, [rsp + 0xb0]
call fcn.140054c44
lea rcx, [rsp + 0x48]
call fcn.140054c44
mov r15d, 1
jmp 0x1400b4cb7
cmp rbx, rsi
jne 0x1400b4272
mov rcx, qword [rsp + 0xb0]
cmp word [rcx], si
je 0x1400b41cf
call fcn.14001a310
mov ecx, dword [rsp + 0x70]
mov r8d, dword [rsp + 0x60]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x308]
mov r9d, 7
mov rdx, rax
mov qword [rsp + 0x308], rsi
mov qword [rsp + 0x20], rsi
call fcn.1400037d4
mov qword [rsp + 0xb8], rax
cmp rax, rsi
jne 0x1400b41cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0xb0]
mov esi, eax
call fcn.140054c44
lea rcx, [rsp + 0x48]
jmp 0x1400b3e36
xor edx, edx
lea rcx, [rsp + 0x1f9]
mov byte [rsp + 0x1f8], sil
lea r8d, [rdx + 0x27]
call fcn.1400e16a0
lea rax, [rsp + 0x1f8]
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x148], 0x18
mov dword [rsp + 0x158], esi
call fcn.140057f04
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x28], rdi
mov rdi, qword [rsp + 0xb8]
mov r9, rax
lea rdx, [rsp + 0x148]
shr r9, 0x20
mov r8d, r15d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsp + 0xa8]
cmp rbp, rsi
mov r14d, 1
cmovle rbp, r8
cmp rbx, rsi
je 0x1400b42b6
jmp 0x1400b4282
mov rdi, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xd0]
and r15d, 4
mov qword [rsp + 0x20], r8
mov rax, rcx
or r15d, 8
mov r9d, ecx
sar rax, 0x20
shr r15d, 1
mov rcx, rbx
mov r8d, eax
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
cmp rdi, 0xffffffffffffffff
je 0x1400b42c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12, rsi
jne 0x1400b42eb
cmp rbx, rsi
je 0x1400b41b0
cmp rbx, 0xffffffffffffffff
je 0x1400b41b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b41b0
mov r15, qword [rsp + 0xa8]
mov eax, dword [rsp + 0x88]
sub r15, qword [rsp + 0x120]
cmp r14d, esi
je 0x1400b430f
cmp eax, esi
je 0x1400b430f
mov qword [r12], r15
cdqe
add r12, rax
cmp r14d, esi
je 0x1400b43d0
movsxd rax, dword [rsp + 0x90]
cmp eax, esi
je 0x1400b4337
lea rcx, [r15 + r12]
mov r8, rax
xor edx, edx
call fcn.1400e16a0
cmp r14d, esi
je 0x1400b43d0
cmp dword [rsp + 0x80], esi
jle 0x1400b43d0
cmp rbp, rsi
jle 0x1400b43d0
cmp r12, rsi
je 0x1400b43d0
movabs rcx, 0x100000000
cmp r13, rcx
jb 0x1400b437f
shr rbp, 3
sub rbp, 1
js 0x1400b43d0
lea rcx, [rbp + 1]
mov rdi, r12
mov rax, r13
rep stosq qword [rdi], rax
jmp 0x1400b43d0
cmp r13, 0x10000
jb 0x1400b43a0
shr rbp, 2
sub rbp, 1
js 0x1400b43d0
lea rcx, [rbp + 1]
mov eax, r13d
mov rdi, r12
rep stosd dword [rdi], eax
jmp 0x1400b43d0
cmp r13, 0x100
jb 0x1400b43c2
shr rbp, 1
sub rbp, 1
js 0x1400b43d0
lea rcx, [rbp + 1]
movzx eax, r13w
mov rdi, r12
rep stosw word [rdi], ax
jmp 0x1400b43d0
mov r8, rbp
mov edx, r13d
mov rcx, r12
call fcn.1400e16a0
lea rcx, [rsp + 0xb0]
call fcn.140054c44
lea rcx, [rsp + 0x48]
call fcn.140054c44
mov r13d, dword [rsp + 0xa0]
jmp 0x1400b3e50
lea rcx, [rsp + 0xb0]
call fcn.140054c44
lea rcx, [rsp + 0x48]
call fcn.140054c44
jmp 0x1400b3d2b
cmp r13d, 0xfffffffc
jne 0x1400b45d4
lea rcx, [rsp + 0x60]
call fcn.14005c96c
lea rcx, [rsp + 0x48]
call fcn.14005c96c
lea eax, [r13 + 0x3f]
lea r9d, [r13 + 0x30]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x2f8]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x60]
cmp word [rdx], si
jne 0x1400b446b
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x60]
jmp 0x1400b4406
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x2f8]
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x88], esi
mov dword [rsp + 0x80], esi
call fcn.140007180
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, str.pecmd2012.event.
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov dil, byte [rsp + 0x308]
cmp dil, sil
jne 0x1400b44ec
cmp dword [rsp + 0x70], esi
jne 0x1400b4528
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x80]
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rbx, rax
cmp dil, sil
je 0x1400b451f
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x60]
jmp 0x1400b3e17
cmp rax, rsi
jne 0x1400b45c0
xor edx, edx
lea rcx, [rsp + 0x1a9]
mov byte [rsp + 0x1a8], sil
lea r8d, [rdx + 0x27]
call fcn.1400e16a0
lea rax, [rsp + 0x1a8]
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x190], 0x18
mov dword [rsp + 0x1a0], esi
call fcn.140057f04
cmp dword [rsp + 0x70], esi
mov r9, qword [rsp + 0x58]
mov r8d, esi
setne r8b
cmp dword [rsp + 0x88], esi
mov edx, esi
lea rcx, [rsp + 0x190]
setne dl
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
cmp rax, rsi
jne 0x1400b45c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x48]
mov esi, eax
call fcn.140054c44
lea rcx, [rsp + 0x60]
jmp 0x1400b3e36
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x60]
jmp 0x1400b3e48
cmp r13d, 0xffffffe0
jne 0x1400b47c5
lea rcx, [rsp + 0x70]
call fcn.14005c96c
lea rcx, [rsp + 0x48]
call fcn.14005c96c
lea eax, [r13 + 0x5b]
lea r9d, [r13 + 0x4c]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x2f8]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x70]
cmp word [rdx], si
jne 0x1400b4632
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x70]
jmp 0x1400b4406
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x2f8]
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x90], esi
call fcn.140007180
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
mov ebp, dword [rsp + 0x80]
mov edi, dword [rsp + 0x88]
cmp ebp, r15d
lea rdx, str.pecmd2012.semaphore.
lea rcx, [rsp + 0x58]
cmovl ebp, r15d
cmp edi, ebp
cmovg edi, ebp
call fcn.14005caa8
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov r8, qword [rsp + 0x58]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rbx, rax
cmp byte [rsp + 0x308], sil
je 0x1400b46f5
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x70]
jmp 0x1400b3e17
cmp rax, rsi
jne 0x1400b47b1
xor edx, edx
lea rcx, [rsp + 0x249]
mov byte [rsp + 0x248], sil
lea r8d, [rdx + 0x27]
call fcn.1400e16a0
lea rax, [rsp + 0x248]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x178], 0x18
mov dword [rsp + 0x188], esi
call fcn.140057f04
mov r9, qword [rsp + 0x58]
cmp edi, esi
cmovl edi, esi
mov edx, r15d
lea rcx, [rsp + 0x178]
cmp edi, esi
mov r8d, ebp
cmovg edx, edi
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov qword [rsp + 0xd8], r14
cmp rbx, rsi
jne 0x1400b47a0
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x70]
call fcn.140054c44
mov rsi, r14
jmp 0x1400b4f21
cmp edi, r15d
jge 0x1400b47b1
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x70]
jmp 0x1400b3e48
cmp r13d, 0xffffffc0
jne 0x1400b4964
lea rcx, [rsp + 0x88]
call fcn.14005c96c
lea rcx, [rsp + 0x48]
call fcn.14005c96c
lea eax, [r13 + 0x7b]
lea r9d, [r13 + 0x6c]
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x2f8]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x88]
cmp word [rdx], si
jne 0x1400b482f
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x88]
jmp 0x1400b4406
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2f8]
mov dword [rsp + 0x80], esi
call fcn.140007180
lea rdx, str.pecmd2012.mutex.
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov r8, qword [rsp + 0x58]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rbx, rax
cmp byte [rsp + 0x308], sil
je 0x1400b48a4
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x88]
jmp 0x1400b3e17
cmp rax, rsi
jne 0x1400b494d
xor edx, edx
lea rcx, [rsp + 0x1d1]
mov byte [rsp + 0x1d0], sil
lea r8d, [rdx + 0x27]
call fcn.1400e16a0
lea rax, [rsp + 0x1d0]
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x168], rax
mov dword [rsp + 0x160], 0x18
mov dword [rsp + 0x170], esi
call fcn.140057f04
mov ecx, dword [rsp + 0x80]
mov r8, qword [rsp + 0x58]
cmp ecx, esi
mov edx, esi
cmovl ecx, esi
cmp ecx, esi
lea rcx, [rsp + 0x160]
setg dl
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov qword [rsp + 0xd8], r14
cmp rbx, rsi
jne 0x1400b494d
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x88]
jmp 0x1400b4793
lea rcx, [rsp + 0x48]
call fcn.140054c44
lea rcx, [rsp + 0x88]
jmp 0x1400b3e48
cmp r13d, 0xfffffff8
jne 0x1400b4b6f
lea rcx, [rsp + 0x80]
call fcn.14005c96c
lea eax, [r13 + 0x43]
lea r9d, [r13 + 0x34]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x2f8]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0x80]
cmp word [rdx], si
jne 0x1400b49ba
lea rcx, [rsp + 0x80]
jmp 0x1400b4406
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2f8]
mov dword [rsp + 0x60], esi
call fcn.140007180
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x70]
neg eax
sbb ecx, ecx
and ecx, r14d
mov dword [rsp + 0x70], ecx
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, str..mailslotpecmd2012.mailslot.
lea rcx, [rsp + 0x58]
mov r9, r14
mov r8, r14
call fcn.14005cb28
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
xor edx, edx
lea rcx, [rsp + 0x221]
lea r8d, [rdx + 0x27]
mov byte [rsp + 0x220], sil
call fcn.1400e16a0
lea rax, [rsp + 0x220]
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x108], 0x18
mov dword [rsp + 0x118], esi
call fcn.140057f04
mov bpl, byte [rsp + 0x308]
cmp bpl, sil
jne 0x1400b4ab8
cmp dword [rsp + 0x60], esi
je 0x1400b4ab8
mov r8d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x108]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov rbx, rax
cmp rax, r14
jne 0x1400b4a9c
mov rbx, rsi
cmp rbx, rsi
jne 0x1400b4b50
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x80]
jmp 0x1400b3e34
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x108]
mov r8d, r15d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov edi, eax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp bpl, sil
jne 0x1400b4b5d
cmp rbx, r14
jne 0x1400b4a9c
cmp dword [rsp + 0x70], 0xffffffff
je 0x1400b4b12
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, dword [rsp + 0x70]
jae 0x1400b4a99
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x108]
mov r8d, r15d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
jmp 0x1400b4af8
lea rcx, [rsp + 0x80]
jmp 0x1400b3e48
lea rcx, [rsp + 0x80]
call fcn.140054c44
jmp 0x1400b4cb0
cmp r13d, 0xfffffff0
jne 0x1400b4dbd
lea rcx, [rsp + 0xa0]
call fcn.14005c96c
lea rcx, [rsp + 0xa8]
call fcn.14005c96c
lea eax, [r13 + 0x4b]
lea r9d, [r13 + 0x3c]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x2f8]
mov rcx, rdi
mov word [rsp + 0x20], ax
call fcn.14004e610
mov rdx, qword [rsp + 0xa0]
cmp word [rdx], si
jne 0x1400b4bdf
lea rcx, [rsp + 0xa8]
call fcn.140054c44
lea rcx, [rsp + 0xa0]
jmp 0x1400b4406
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2f8]
call fcn.140007180
lea rdx, str..pipepecmd2012.pipe.
lea rcx, [rsp + 0x58]
mov r9, r14
mov r8, r14
call fcn.14005cb28
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x58]
call fcn.14005caa8
mov edi, dword [rsp + 0x80]
mov rbx, r14
mov r14b, byte [rsp + 0x308]
lea rcx, [rsp + 0xa8]
cmp r14b, sil
cmovne edi, esi
call fcn.140054c44
lea rcx, [rsp + 0xa0]
call fcn.140054c44
mov ebp, dword [rsp + 0x88]
mov eax, 4
test al, dil
jne 0x1400b4cdd
mov rcx, qword [rsp + 0x58]
mov eax, edi
mov r8d, esi
and eax, 3
mov edx, ebp
cmp al, 3
sete r8b
call fcn.140057f34
mov rbx, rax
cmp r14b, sil
je 0x1400b4cdd
or r14, 0xffffffffffffffff
cmp rbx, r14
cmove rbx, rsi
cmp rbx, rsi
je 0x1400b4cca
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b4f21
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
cmove eax, r15d
mov esi, eax
jmp 0x1400b4f21
xor edx, edx
lea rcx, [rsp + 0x271]
mov byte [rsp + 0x270], sil
lea r8d, [rdx + 0x27]
call fcn.1400e16a0
lea rax, [rsp + 0x270]
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xe8], 0x18
mov dword [rsp + 0xf8], esi
call fcn.140057f04
test r12b, dil
jne 0x1400b4d96
cmp rbx, 0xffffffffffffffff
jne 0x1400b3e4d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0xe8]
lea edx, [rbx + 4]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov r9d, 0xff
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
test r15b, dil
je 0x1400b4d8a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp eax, esi
jne 0x1400b4d8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rbx, 0xffffffffffffffff
je 0x1400b4d9c
mov r13d, 0xffffffef
cmp rbx, 0xffffffffffffffff
jne 0x1400b4d9f
mov rbx, rsi
cmp r13d, 0xfffffff0
je 0x1400b3e4d
cmp rbx, rsi
jne 0x1400b3e4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400b4cd6
mov rax, qword [rsp + 0x2f8]
cmp word [rax], si
je 0x1400b4e3d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x2f8]
call fcn.14006b114
mov rdx, qword [rsp + 0x2f8]
cmp word [rdx], si
je 0x1400b4e38
add rdx, r12
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x2f8], rdx
lea rdx, [rsp + 0x60]
call fcn.14006b2e8
mov rdx, qword [rsp + 0x2f8]
cmp word [rdx], si
je 0x1400b4e33
add rdx, r12
lea rcx, [rsp + 0x2f8]
mov qword [rsp + 0x2f8], rdx
lea rdx, [rsp + 0x98]
call fcn.14006b2e8
mov r13d, dword [rsp + 0x60]
mov r12, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x98]
mov edx, r13d
mov ecx, r12d
call qword [0x14011c398]
cmp rax, rsi
mov rbx, rax
jg 0x1400b3e4d
mov rsi, r15
jmp 0x1400b4f21
cmp dil, sil
jne 0x1400b4e7a
cmp byte [rsp + 0x78], sil
jne 0x1400b4e7a
mov rdi, qword [rbp + 0x210]
jmp 0x1400b4e7d
mov rdi, r14
cmp byte [rsp + 0x68], sil
je 0x1400b4ee9
lea rdx, [0x14010a410]
lea rcx, [rsp + 0x308]
call fcn.1400671f0
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x308]
call fcn.14005caa8
lea rdx, [0x14010a400]
lea rcx, [rsp + 0x308]
call fcn.14005caa8
mov r9, qword [rsp + 0x300]
mov rdx, qword [rsp + 0x308]
xor r8d, r8d
mov rcx, r14
call fcn.1400a19e8
lea rcx, [rsp + 0x308]
call fcn.140054c44
mov eax, dword [rsp + 0x98]
mov qword [rsp + 0x38], r15
lea r8, [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov r9, rbx
mov rdx, rdi
mov rcx, rbp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r12
call fcn.14005d3c8
mov rsi, qword [rsp + 0xd8]
lea rcx, [rsp + 0x58]
call fcn.140054c44
lea rcx, [rsp + 0x140]
call fcn.140054c44
lea rcx, [rsp + 0x138]
call fcn.140054c44
lea rcx, [rsp + 0x128]
call fcn.140054c44
lea rcx, [rsp + 0xc0]
call fcn.140054c44
mov rax, rsi
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret