Function at 0x14004f800
Capabilities:
Connect pipe
Create pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], 0xfffffffffffffffe
mov ebx, edx
mov rsi, rcx
mov edi, 1
lock xadd dword [0x14017330c], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp + 0x18], eax
mov dword [rbp + 0x28], edi
mov qword [rbp + 0xd0], 0x22
lea rax, [rbp + 0x18]
mov qword [rbp + 0xd8], rax
lea rax, str..pipe_trackd__
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], 0x15
lea rdi, [rbp + 0x90]
lea rdx, [rbp + 0xb0]
lea r8, [rbp + 0xd0]
mov rcx, rdi
call fcn.1400506d0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xf0], xmm0
lea r12, vtable.ATL::CAccessToken.0
mov qword [rbp + 0xd0], r12
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rbp + 0x18]
mov rcx, rax
mov edx, 8
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x14004fa79
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xd8], rax
lea rax, vtable.ATL::CSid.0
mov qword [rbp + 0x18], rax
mov byte [rbp + 0x64], 0
mov dword [rbp + 0x68], 7
call fcn.14004f470
mov rax, qword [0x140173280]
lea r14, [0x140173280]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x70], rax
call fcn.14004f470
mov rax, qword [0x140173280]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x78], rax
call fcn.14004f470
mov rax, qword [0x140173280]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
call fcn.14004f470
mov rax, qword [0x140173280]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xd0]
lea rdx, [rbp + 0x18]
call fcn.140063590
test al, al
je 0x14004fd33
mov rax, qword [0x1401306c0]
mov qword [rbp], rax
movups xmm0, xmmword [0x1401306b0]
movaps xmmword [rbp - 0x10], xmm0
mov rax, qword [rbp + 0x80]
cmp dword [rax - 0x10], 0
jne 0x14004fbcf
lea rcx, [rbp + 0x20]
lea rdx, [rbp + 0xb0]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x14004fbc8
mov r15, qword [rbp + 0xb0]
test r15, r15
je 0x14004fad8
mov rcx, r15
call fcn.1400ed29c
mov r14, rax
test r14d, r14d
je 0x14004fad8
js 0x14005001b
mov r13, qword [rbp + 0x80]
mov edx, dword [r13 - 0x10]
mov eax, 1
sub eax, dword [r13 - 8]
mov ecx, dword [r13 - 0xc]
sub ecx, r14d
or ecx, eax
mov rcx, r13
jns 0x14004fa42
mov qword [rbp + 0x10], rdx
lea rcx, [rbp + 0x80]
mov edx, r14d
call fcn.140063bc0
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x10]
mov rax, r15
sub rax, r13
sar rax, 1
cmp rax, rdx
jbe 0x14004fb29
mov r8d, r14d
add r8, r8
movsxd rax, dword [rcx - 0xc]
add rax, rax
cmp rax, r8
jae 0x14004fb71
xor edx, edx
mov r8, rax
call fcn.140102980
jmp 0x14004fb40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x14004fabc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x18]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004fabc
mov rax, qword [rbp + 0xd0]
lea rcx, [rbp + 0xd0]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0x18]
jmp 0x14004f8ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
lea rax, [0x14016ed90]
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
jmp 0x14004fef2
mov rdx, qword [rbp + 0x80]
cmp dword [rdx - 0x10], 0
je 0x14004fbbb
cmp dword [rdx - 8], 0
js 0x14004fb52
mov r14, qword [rdx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
dec eax
test eax, eax
jg 0x14004fb10
add rdx, 0xffffffffffffffe8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x80], rax
jmp 0x14004fbbb
test rcx, rcx
je 0x14004fb7b
mov r8d, r14d
add r8, r8
movsxd rdx, dword [rcx - 0xc]
add rdx, rdx
cmp rdx, r8
jae 0x14004fb8d
call fcn.1400e0530
mov dword [rax], 0x22
call fcn.1400e191c
jmp 0x14004fb96
cmp dword [rdx - 0xc], 0
js 0x14005002f
mov dword [rdx - 0x10], 0
mov rax, qword [rbp + 0x80]
mov word [rax], 0
jmp 0x14004fbbb
mov rdx, r15
call fcn.1401022e0
jmp 0x14004fb96
call fcn.1400e0530
mov dword [rax], 0x16
call fcn.1400e191c
jmp 0x14004fb96
lea rdx, [rcx + rax*2]
call fcn.1401022e0
mov rax, qword [rbp + 0x80]
cmp dword [rax - 0xc], r14d
jl 0x140050025
mov dword [rax - 0x10], r14d
mov rax, qword [rbp + 0x80]
mov ecx, r14d
mov word [rax + rcx*2], 0
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], reloc.WS2_32.dll_inet_ntoa
lea rax, [rbp - 0x40]
mov qword [rbp - 0x28], rax
lea rax, str.D:_A__FA____
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0xe
lea r14, [rbp + 0xb0]
lea rdx, [rbp - 0x20]
lea r8, [rbp - 0x30]
mov rcx, r14
call fcn.1400506d0
lea r8, [rbp - 8]
cmp qword [rbp + 0xc8], 8
jb 0x14004fc22
mov r14, qword [rbp + 0xb0]
lea r9, [rbp + 0xc]
mov rcx, r14
mov edx, 1
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
mov r14d, eax
mov rax, qword [rbp + 0xc8]
cmp rax, 8
jb 0x14004fc82
mov rcx, qword [rbp + 0xb0]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004fc7d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140050016
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400cd44c
test r14d, r14d
je 0x14004fd33
mov eax, ebx
xor al, 1
movzx r14d, al
mov eax, r14d
shl eax, 0xe
movzx r15d, bl
mov ecx, r15d
shl ecx, 0xe
lea edx, [r15 + 0x40000001]
cmp qword [rbp + 0xa8], 8
jb 0x14004fcbb
mov rdi, qword [rbp + 0x90]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 0
mov rcx, rdi
mov r8d, 8
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14004fe38
mov rdi, rax
mov rcx, qword [rbp + r15*8 + 0xf0]
mov qword [rbp + r15*8 + 0xf0], rax
test rcx, rcx
je 0x14004fd11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
mov eax, 0x80000000
mov edx, 0x40000000
cmovne edx, eax
cmp qword [rbp + 0xa8], 8
jb 0x14004fd56
mov rcx, qword [rbp + 0x90]
jmp 0x14004fd5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
lea rax, [0x14016ed90]
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
lea rdi, vtable.ATL::CSid.0
jmp 0x14004fe60
lea rcx, [rbp + 0x90]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x14004fe38
mov rcx, qword [rbp + r14*8 + 0xf0]
mov qword [rbp + r14*8 + 0xf0], rax
test rcx, rcx
je 0x14004fda7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
lea rdi, vtable.ATL::CSid.0
je 0x14004ffd3
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0xf0], 0
mov qword [rsi], rax
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0xf8], 0
mov qword [rsi + 8], rax
mov al, 1
mov byte [rsi + 0x10], al
test rbx, rbx
je 0x14004fe56
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14004fe56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
lea rax, [0x14016ed90]
mov qword [rsi + 8], rax
mov byte [rsi + 0x10], 0
lea rdi, vtable.ATL::CSid.0
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp + 0x18], rdi
mov rdx, qword [rbp + 0x88]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
mov edi, 0xffffffff
dec eax
test eax, eax
jg 0x14004fe8e
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x80]
lock xadd dword [rdx - 8], edi
dec edi
test edi, edi
jg 0x14004feae
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x78]
mov eax, 0xffffffff
lock xadd dword [rdx - 8], eax
mov edi, 0xffffffff
dec eax
test eax, eax
jg 0x14004fed5
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp + 0x70]
lock xadd dword [rdx - 8], edi
dec edi
test edi, edi
jg 0x14004fef2
mov rcx, qword [rdx - 0x18]
add rdx, 0xffffffffffffffe8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rbp + 0xd0], r12
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
je 0x14004ff22
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x14004ff17
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov qword [rbp + 0xe0], 0
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x14004ff3f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xd8], 0
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x14004ff50
call fcn.1400cd43c
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14004ff62
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x14004ff74
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0xa8]
cmp rax, 8
jb 0x14004ffbc
mov rcx, qword [rbp + 0x90]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14004ffb7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140050016
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400cd44c
mov rax, rsi
add rsp, 0x188
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x14004fdf8
cmp eax, 0x3e5
jne 0x140050002
mov rcx, qword [rbp + 0xc8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14004fdf8
mov dword [rsi], eax
lea rax, [0x14016ed90]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14004fe25
call fcn.1400e193c
mov ecx, 0x80070057
call fcn.14004f440
mov ecx, 0x80070057
call fcn.14004f440
mov ecx, 0x80070057
call fcn.14004f440
int3