Function at 0x14001cbb8
Capabilities:
Create pipe
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x140064068]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, rdx
mov r13, rcx
lea rcx, [0x1400702d7]
call fcn.140041b34
xor r15d, r15d
movzx r14d, r15b
mov edi, r15d
or r12, 0xffffffffffffffff
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r15w
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.140003c60
nop
lea rcx, str.___ipc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea r9, str.___ipc
xor r8d, r8d
mov rdx, qword [rbp - 0x51]
call fcn.14001e564
mov rbx, rax
cmp rax, r12
je 0x14001d08c
add rbx, 7
lea rcx, str.___proc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rcx, qword [rbp - 0x61]
mov qword [rsp + 0x20], rax
lea r9, str.___proc
mov r8, rbx
mov rdx, qword [rbp - 0x51]
call fcn.14001e564
mov rsi, rax
cmp rax, r12
je 0x14001d08c
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea rcx, [0x14004bc58]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rax
lea rdx, [0x14004bc58]
lea rcx, [rbp - 1]
call fcn.140003c60
nop
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
mov rax, qword [rbp - 0x51]
cmp rax, rbx
jb 0x14001d105
mov r8, rsi
sub r8, rbx
sub rax, rbx
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rax, qword [rbp - 0x61]
lea rdx, [rax + rbx*2]
lea rcx, [rbp - 0x21]
call fcn.140003c60
nop
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
mov r8, qword [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.140003e30
nop
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x14001cd89
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cd84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cd84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140041c60
add rsi, 8
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r15w
mov rax, qword [rbp - 0x51]
cmp rax, rsi
jb 0x14001d10b
sub rax, rsi
or rbx, 0xffffffffffffffff
cmp rax, rbx
cmovb rbx, rax
lea rax, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rax, qword [rbp - 0x61]
lea rax, [rax + rsi*2]
mov qword [rbp - 0x69], rax
cmp rbx, 7
ja 0x14001cdf4
mov qword [rbp - 0x31], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memmove
xor esi, esi
mov word [rbp + rbx - 0x41], si
mov r15, qword [rbp - 0x41]
jmp 0x14001ce51
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x14001d0f9
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x14001cf55
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
call fcn.140002050
mov r15, rax
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], rsi
add rbx, rbx
mov r8, rbx
mov rdx, qword [rbp - 0x69]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor esi, esi
mov word [r15 + rbx], si
mov qword [rbp - 0x41], r15
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rcx, r15
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov r8d, eax
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov r15d, 1
test rax, rax
je 0x14001cf83
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rcx, qword [rbp - 1]
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x7d0
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov r9d, r15d
mov edx, 0x40080003
lea r8d, [r15 + 7]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001cf83
lea rdx, [0x14004ebe1]
lea ecx, [r15 + 0xf]
call fcn.1400426b8
mov rdi, rax
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14001cf80
mov qword [rax], r13
mov qword [rax + 8], r12
test rax, rax
je 0x14001cf83
mov dword [rbp - 0x69], esi
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14001c9f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13], rax
test rax, rax
je 0x14001cf83
or r12, 0xffffffffffffffff
mov rcx, r13
call fcn.140024e54
test al, al
cmovne r14d, r15d
jmp 0x14001cf83
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001d0ff
jmp 0x14001ce21
mov rdi, rsi
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14001cfc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cfc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cfc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140041c60
mov qword [rbp - 0x31], rsi
mov r15d, 7
mov qword [rbp - 0x29], r15
mov word [rbp - 0x41], si
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x14001d01b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d016
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d016
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140041c60
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], r15
mov word [rbp - 1], si
test r14b, r14b
je 0x14001d05c
mov qword [rbp - 0x21], rbx
mov rax, qword [r13]
mov qword [rbp - 0x19], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x21]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14001d059
cmp eax, 1
mov r14b, sil
jne 0x14001d05c
mov r14b, 1
cmp r12, 0xffffffffffffffff
je 0x14001d06b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14001d079
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x14001d08c
mov edx, 0x10
mov rcx, rdi
call fcn.140041c60
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x14001d0cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d0ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d0ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140041c60
mov al, r14b
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140041c00
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140002320
nop
call fcn.1400015c0
int3
call fcn.1400342c8
int3
call fcn.1400342c8
int3