Function at 0x18000dce0
Capabilities:
Create pipe
Encode data using xor
Get file size

Disassembly:
push rbx
push rbp
push rsi
push r13
push r15
sub rsp, 0x40
mov esi, dword [rsp + 0x90]
lea edx, [rcx - 0x172]
mov r15d, r9d
mov dword [rsp + 0x90], edx
xor r15d, 0x4c0
lea r13d, [r9 - 0x9d5]
mov ebp, r9d
xor esi, 0x49c
xor ebp, 0x351
mov rbx, r8
lea eax, [r15 - 0xcac]
cmp esi, eax
jge 0x18000dea7
imul eax, dword [0x180026070], 0x13bff2
mov dword [0x180026070], eax
mov rax, qword [section..data]
add dword [rax + 0x34], 0xffe4adc1
cmp dword [r8 + 0x60], 0x14078
jne 0x18000dd74
mov rax, qword [section..data]
mov ecx, dword [r8 + 0x88]
sub ecx, dword [rax + 0x110]
or dword [r8 + 0x2c], ecx
jmp 0x18000dd8f
mov ecx, dword [r8 + 0x110]
add ecx, 0x99364
add ecx, dword [r8 + 0x100]
xor dword [r8 + 0xec], ecx
mov eax, dword [r8 + 0x98]
cmp dword [0x1800260f0], eax
je 0x18000ddb9
mov rcx, qword [section..data]
mov eax, dword [r8 + 0x110]
xor eax, dword [rcx]
add eax, 0x31f08
add dword [rcx + 0xdc], eax
mov eax, dword [r8 + 0x60]
sub eax, dword [r8 + 0x94]
sub eax, 0x1594c6a
mov dword [r8 + 0x88], eax
mov eax, dword [0x180026010]
sub eax, dword [0x1800260ec]
mov rcx, qword [section..data]
xor eax, 0xfffcf1c4
add dword [rcx + 0xec], eax
mov eax, dword [r8 + 0x94]
xor eax, dword [r8 + 0x100]
mov ecx, dword [r8 + 0x2c]
sub eax, 0x18d597
add dword [r8 + 0xec], eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x88]
add eax, 0xffebc5ba
add ecx, eax
xor dword [0x1800260fc], ecx
cmp dword [0x1800260a4], 0x7020
jae 0x18000de45
mov eax, dword [rdx + 0x88]
add eax, dword [r8 + 0x100]
mov dword [r8 + 0x74], eax
jmp 0x18000de65
mov eax, dword [rdx + 0xe0]
add eax, dword [r8 + 0xdc]
xor eax, dword [r8 + 0xec]
xor eax, 0xfbc04
mov dword [r8 + 0xec], eax
mov rcx, qword [section..data]
mov eax, dword [r8 + 0xa8]
cmp dword [rcx + 0x9c], eax
jbe 0x18000de98
mov eax, dword [r8 + 0x98]
sub eax, dword [0x180026038]
sub eax, 0x8fc8
add dword [rcx + 0xa8], eax
jmp 0x18000e07c
xor dword [rcx + 0xec], 0xa78bc
jmp 0x18000e07c
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x108]
xor eax, 0xe7b
or eax, dword [r8 + 0x28]
cmp dword [r8 + 0xd8], eax
ja 0x18000e07c
mov eax, dword [rcx + 0x48]
xor eax, dword [r8 + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], r14
cmp ebp, eax
jbe 0x18000df45
mov r14d, r13d
mov edi, ebp
or r14d, esi
cmp ebp, r14d
jne 0x18000df45
nop
mov edx, dword [rbx + 0x110]
imul ecx, dword [0x180026058], 0x5f0
sub edx, esi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rbx + 8]
mov rcx, rsi
mov eax, dword [rbx + 0xfc]
or rcx, rax
xor edx, dword [rbx + 0x104]
and ecx, 0x1104
xor edx, 0x105a
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add edi, 3
cmp edi, r14d
je 0x18000def0
mov rcx, qword [section..data]
mov edx, dword [rsp + 0x90]
mov eax, dword [rbx + 0x54]
xor eax, dword [0x180026068]
and eax, dword [rcx + 0x108]
mov edi, dword [rbx + 0x50]
cmp edi, eax
jne 0x18000e06f
mov qword [rsp + 0x78], r12
mov r14d, r15d
xor r14d, esi
mov r12d, r15d
and r12d, 0xe7b
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + 0x74]
mov r8d, r15d
mov r10d, dword [rbx + 0x94]
and eax, edx
or eax, dword [rbx + 0xe0]
sub r10d, esi
sub r8d, dword [rbx + 0xd8]
xor ebp, eax
mov r11d, dword [rbx + 0x28]
mov r9d, dword [rbx + 0x78]
or r11d, 0x1a0b
mov edx, dword [rbx + 0x98]
xor r11d, ebp
mov ecx, dword [rcx + 0x108]
xor r9d, 0x129c
mov qword [rsp + 0x38], r10
sub edx, ebp
mov dword [rsp + 0x30], r11d
mov eax, r13d
mov dword [rsp + 0x28], r14d
and rcx, rax
mov dword [rsp + 0x20], r8d
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edx, dword [0x180026118]
mov r8d, ebp
mov ecx, dword [rbx + 0x48]
or r8d, 0x165c
or edx, r13d
xor r8d, 0x1a1d
xor edx, ebp
or ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenThread]
imul ecx, dword [rbx + 0x108], 0x912
mov edx, ebp
mov r9d, dword [rbx]
and edx, 0xc36
mov r8d, dword [rbx + 0x54]
or r9d, r15d
xor r8d, dword [rbx + 0x28]
add edx, 0x177b
sub ecx, r15d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [section..data]
add edi, 2
mov eax, dword [rbx + 0x54]
xor eax, dword [0x180026068]
mov edx, dword [rsp + 0x90]
and eax, dword [rcx + 0x108]
cmp edi, eax
je 0x18000df80
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov eax, dword [rsp + 0x90]
add eax, 0x80d
add rsp, 0x40
pop r15
pop r13
pop rsi
pop rbp
pop rbx
ret