Function at 0x140001d18
Capabilities:
Create pipe
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp - 0x1c], 0
lea r15, [0x14002b010]
mov ebx, 0x2096
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x20], 0x2ace
mov dword [rbp - 0x14], 0x2cd7
mov dword [rbp - 0x10], 0x185b
mov dword [rbp - 0x18], 0x23d5
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x1c]
add ecx, 0x262
cmp eax, ecx
je 0x140001efc
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff804
cmp eax, ecx
jl 0x140001e1a
mov ecx, dword [rbp - 0x14]
mov r9, r15
mov edx, dword [rbp - 0xc]
sub ecx, 0x15eb
mov r8d, dword [rbp - 0x18]
add edx, 0x33f
mov eax, dword [rbp - 0xc]
xor r8d, 0x299
add eax, 0xdf1
mov dword [rsp + 0x20], eax
call fcn.1400073c8
mov dword [rbp - 0x20], eax
mov ecx, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x20]
xor ecx, 0x23be
mov r8d, dword [rbp - 0x18]
add edx, 0x13ab
mov r9d, dword [rbp - 0xc]
sub r8d, 0xb7a
mov r10d, dword [rbp - 0x1c]
sub r9d, 0x76a
mov eax, dword [rbp - 0x10]
add r10d, ebx
add eax, 0xd1
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r15
call fcn.1400044f0
mov dword [rbp - 0x18], eax
add dword [rbp - 0x14], 0xfffffdf7
jmp 0x140001efc
mov rax, qword [section..data]
mov ecx, dword [rax + 0xd8]
xor ecx, dword [0x14002b12c]
mov eax, dword [rbp - 0x1c]
add ecx, eax
mov eax, dword [rbp - 0x1c]
cmp eax, ecx
jbe 0x140001efc
mov ecx, dword [0x14002b138]
add ecx, dword [0x14002b094]
cmp dword [0x14002b078], ecx
jae 0x140001efc
mov eax, dword [rbp - 0x18]
mov edx, 0x217c
and eax, edx
xor eax, dword [0x14002b0fc]
cmp dword [0x14002b060], eax
jb 0x140001efc
mov esi, dword [rbp - 0x20]
mov r9d, dword [rbp - 0xc]
mov edi, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x18]
or edi, 0x1caf
mov rax, qword [section..data]
add esi, dword [0x14002b0d8]
mov r14d, dword [rax + 0x74]
mov rax, qword [section..data]
sub r14d, dword [0x14002b068]
mov r8d, dword [rax + 0x114]
sub r8d, edx
mov edx, dword [0x14002b088]
add edx, dword [rax + 0x3c]
mov eax, dword [rbp - 0x1c]
or r9d, edx
mov ebx, dword [rbp - 0x1c]
sub ecx, eax
mov r11d, dword [rbp - 0x14]
mov edx, esi
mov eax, dword [rbp - 0x14]
and r11d, eax
mov eax, dword [rbp - 0x1c]
imul eax, dword [0x14002b0d8]
imul ebx, ecx
mov ecx, r14d
imul r10d, eax, 0x2cd7
mov qword [rsp + 0x38], r10
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [0x14002b088], 0x103b4
jb 0x140001f14
mov dword [0x14002b070], 0x32b
jmp 0x140001f24
imul eax, dword [0x14002b120], 0x23305
mov dword [0x14002b120], eax
add dword [rbp - 0x14], 0x3b9
mov r8, r15
xor dword [rbp - 0x10], 0x3927
add dword [rbp - 0x18], 0xfffffa3d
mov ecx, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x18]
xor ecx, 0x2637
mov r9d, dword [rbp - 0xc]
add edx, 0xa90
mov eax, dword [rbp - 0x1c]
xor eax, 0x1caf
mov dword [rsp + 0x20], eax
call fcn.140011420
mov dword [rbp - 0x1c], eax
add dword [rbp - 0x18], 0xf4b
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
xor ecx, 0x5e2
cmp eax, ecx
jg 0x140002064
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
add ecx, 0x850
cmp eax, ecx
je 0x140002010
add dword [rbp - 0x10], 0xffffffd0
xor dword [rbp - 0x20], 0x3f1b
mov ecx, dword [rbp - 0x14]
mov edx, dword [rbp - 0xc]
sub ecx, 0xd0b
mov r8d, dword [rbp - 0x14]
mov r9d, dword [rbp - 0x10]
sub r8d, 0x43d
add r9d, 0x8fe
mov qword [rsp + 0x20], r15
call fcn.140003f00
mov dword [rbp - 0x20], eax
mov rcx, r15
mov edx, dword [rbp - 0x20]
mov r8d, dword [rbp - 0xc]
mov r9d, dword [rbp - 0x20]
add r8d, 0x445
mov eax, dword [rbp - 0x10]
sub r9d, 0x7e7
mov dword [rsp + 0x20], eax
call fcn.140004a00
cmp dword [0x14002b054], 0x4175
mov dword [rbp - 0x20], eax
jb 0x140002064
call qword [0x14002b0a8]
mov dword [0x14002b0f4], eax
jmp 0x140002064
mov eax, dword [rbp - 0x20]
mov ecx, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x20]
sub ecx, eax
mov eax, dword [rbp - 0x1c]
or edx, ecx
cmp eax, edx
jg 0x140002064
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rax, qword [section..data]
mov edx, dword [0x14002b0b8]
add edx, dword [0x14002b024]
or edx, dword [0x14002b120]
xor dword [0x14002b010], edx
mov ecx, dword [rax + 0xf8]
add ecx, dword [0x14002b050]
mov eax, dword [0x14002b0f0]
and rcx, rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [0x14002b0f4]
call qword [sym.imp.KERNEL32.dll_ExitProcess]