Function at 0x1401564f0
Capabilities:
Create pipe
Terminate process

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1d0
lea rdi, [rsp + 0x40]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [0x140575740]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0
movsxd rax, dword [rsp + 0x1f8]
mov ecx, 0xffffffff
sub rcx, rax
mov rax, rcx
cmp rax, 0xd0
jbe 0x14015661a
movsxd rax, dword [rsp + 0x1f8]
mov ecx, 0xffffff2f
cmp rax, rcx
jae 0x14015661a
movsxd rax, dword [rsp + 0x1f8]
add rax, 0xd0
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14015661a
cmp dword [rsp + 0x1f8], 0
je 0x1401565ba
movsxd rax, dword [rsp + 0x1f8]
add rax, 0xe8
mov ecx, 0xffffffe7
cmp rax, rcx
jae 0x14015661a
cmp dword [rsp + 0x1f8], 0
jle 0x1401565d2
mov qword [rsp + 0x1a0], 0x18
jmp 0x1401565de
mov qword [rsp + 0x1a0], 0
movsxd rax, dword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1a0]
lea rax, [rax + rcx + 0xe8]
mov r9d, 0x19d
lea r8, [0x14055fc30]
mov edx, 1
mov rcx, rax
call fcn.1403ba980
mov qword [rsp + 0x1a8], rax
jmp 0x140156626
mov qword [rsp + 0x1a8], 0
movsxd rax, dword [rsp + 0x1f8]
xor r9d, r9d
mov r8, rax
mov edx, 0xd0
mov rcx, qword [rsp + 0x1a8]
call fcn.1401375b0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x1f0]
mov qword [rax + 0x58], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x1e0]
mov qword [rax + 0x38], rcx
mov dword [rsp + 0x178], 0x18
mov dword [rsp + 0x188], 1
mov qword [rsp + 0x180], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
lea r8, str..pipe_p_u
mov edx, 0xff
lea rcx, [rsp + 0x60]
call fcn.140015f80
lea rax, [rsp + 0x178]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x1e8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x1e8]
mov dword [rsp + 0x20], eax
mov r9d, 1
xor r8d, r8d
mov edx, 0x40080001
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x80], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0xffffffffffffffff
jne 0x140156771
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1aa
lea rdx, [0x14055fc90]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1aa
lea rdx, [0x14055fce0]
lea rcx, [0x14055fd28]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 5
je 0x14015668f
mov r9d, 0x1ad
lea r8, [0x14055fd50]
mov edx, 1
mov ecx, 0x20
call fcn.1403ba980
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x1b8]
mov qword [rax + 0x90], rcx
cmp qword [rsp + 0x1b8], 0
jne 0x14015680f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1ad
lea rdx, [0x14055fda0]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1ad
lea rdx, [0x14055fdf0]
lea rcx, [0x14055fe38]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov r8d, 0x20
xor edx, edx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x90]
call fcn.140410c60
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x90]
mov rcx, qword [rsp + 0x1c0]
mov qword [rax + 0x18], rcx
cmp qword [rsp + 0x1c0], 0
jne 0x1401568ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1af
lea rdx, [0x14055fe60]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1af
lea rdx, [0x14055feb0]
lea rcx, [0x14055fef8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r9, [rsp + 0x178]
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rsp + 0x40]
mov qword [rcx + 0x88], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x88], 0xffffffffffffffff
jne 0x140156945
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, 0xfe
mov r8d, 0x1b2
lea rdx, [0x14055ff20]
xor ecx, ecx
call fcn.14014da80
mov r8d, 0x1b2
lea rdx, [0x14055ff70]
lea rcx, [0x14055ffb8]
call fcn.140015e70
mov ecx, 0xfe
call fcn.14038e600
nop
mov rax, qword [rsp + 0x40]
mov rdi, rax
mov rcx, rsp
lea rdx, reloc.WS2_32.dll_bind
call fcn.14037c300
mov rax, rdi
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.14037c650
add rsp, 0x1d0
pop rdi
ret