Function at 0x18000b300
Capabilities:
Get common file path
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x50], 0
jmp 0x18000b322
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x70]
call fcn.18000ce50
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
jae 0x18000b50c
movsxd rax, dword [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.18000cda0
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18000d100
cmp dword [0x18007bda4], 0x146808be
jne 0x18000b507
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadSelectorEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.PLzOrWQSRhIdNnuszwPXtTDeJS
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.UmmscwpFFmlaxwDosPtvHKbxjQUoN
xor edx, edx
lea rcx, str.BEXtqRCFjKEsSSgDZULahmsxeZ
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x18000b318
add rsp, 0x68
ret