Function at 0x14000ca50
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create thread
Create two anonymous pipes
Terminate process
Terminate thread

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x51], 0x18
xor edi, edi
mov qword [rbp - 0x49], rdi
mov dword [rbp - 0x41], 1
xor r9d, r9d
lea r8, [rbp - 0x51]
lea rdx, [rcx + 0x30]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000caef
lea rax, [0x14002bed0]
mov qword [rbp - 1], rax
lea r8d, [rdi + 1]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x39]
call fcn.1400185b8
lea rdx, [0x1400360a0]
lea rcx, [rbp - 0x39]
call fcn.140018c20
int3
xor r9d, r9d
lea r8, [rbp - 0x51]
lea rdx, [rbx + 0x40]
lea rcx, [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000cb37
lea rax, [0x14002bed0]
mov qword [rbp - 1], rax
mov r8d, 2
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x39]
call fcn.1400185b8
lea rdx, [0x1400360a0]
lea rcx, [rbp - 0x39]
call fcn.140018c20
int3
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
mov rcx, rbx
call fcn.14000c700
mov qword [rbx + 0x28], rax
lea rax, [rbx + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000bb50]
xor edx, edx
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
test rax, rax
jne 0x14000cba6
lea rax, [0x14002bed0]
mov qword [rbp - 1], rax
mov r8d, 4
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x39]
call fcn.1400185b8
lea rdx, [0x1400360a0]
lea rcx, [rbp - 0x39]
call fcn.140018c20
int3
mov dword [rbp + 0x17], 0x6e72656b
mov dword [rbp + 0x1b], 0x32336c65
mov dword [rbp + 0x1f], 0x6c6c642e
mov byte [rbp + 0x23], dil
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r12, rax
test rax, rax
jne 0x14000cbe3
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
je 0x14000cc31
mov dword [rbp - 1], 0x61657243
mov dword [rbp + 3], 0x68546574
mov dword [rbp + 7], 0x64616572
mov byte [rbp + 0xb], dil
lea rdx, [rbp - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000cc31
lea rcx, [rbx + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000bf40]
xor edx, edx
lea rcx, [rbp - 0x51]
call rax
mov qword [rbx + 0x60], rax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x14000cc67
lea rax, [0x14002bed0]
mov qword [rbp - 1], rax
lea r8d, [rcx + 5]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x39]
call fcn.1400185b8
lea rdx, [0x1400360a0]
lea rcx, [rbp - 0x39]
call fcn.140018c20
int3
mov rax, qword [rbx + 0x58]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rcx
mov rax, qword [rbx + 0x28]
mov qword [rbp - 0x11], rax
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x21]
lea ecx, [r8 + 3]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x70]
mov byte [rcx + 8], dil
mov dword [rbp - 0x59], 1
test eax, eax
je 0x14000ce09
dec eax
je 0x14000cd71
dec eax
jne 0x14000cec0
lea ecx, [rax + 0x30]
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000ccf2
mov qword [rsp + 0x20], 0xb
lea r9, [0x140038258]
mov r8d, 0x19
lea rdx, [0x1400381b8]
mov rcx, rax
call fcn.14000ff40
mov rsi, rax
jmp 0x14000ccf5
mov rsi, rdi
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000cd16
mov rdx, rax
mov rcx, rsi
call fcn.1400106c0
mov rdi, rax
mov rdx, rdi
mov rcx, rbx
call fcn.14000b990
test rsi, rsi
je 0x14000cd36
mov rcx, rsi
call fcn.14000ff70
mov rcx, rsi
call fcn.1400187b4
lea rdx, [rbp - 0x59]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rbp - 0x59]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rdx, [rbp - 0x59]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rbp - 0x59]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x14000cec0
mov ecx, 0x30
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000cdae
mov qword [rsp + 0x20], 0xb
lea r9, [0x140038258]
mov r8d, 0x31
lea rdx, [0x1400381d8]
mov rcx, rax
call fcn.14000ff40
mov rsi, rax
jmp 0x14000cdb1
mov rsi, rdi
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000cdd2
mov rdx, rax
mov rcx, rsi
call fcn.1400106c0
mov rdi, rax
mov rdx, rdi
mov rcx, rbx
call fcn.14000b990
test rsi, rsi
je 0x14000cdf2
mov rcx, rsi
call fcn.14000ff70
mov rcx, rsi
call fcn.1400187b4
lea rdx, [rbp - 0x59]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [rbx + 0x58]
jmp 0x14000ce9c
mov ecx, 0x30
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000ce46
mov qword [rsp + 0x20], 0xb
lea r9, [0x140038258]
mov r8d, 0x31
lea rdx, [0x1400381d8]
mov rcx, rax
call fcn.14000ff40
mov rsi, rax
jmp 0x14000ce49
mov rsi, rdi
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 1], rax
test rax, rax
je 0x14000ce6a
mov rdx, rax
mov rcx, rsi
call fcn.1400106c0
mov rdi, rax
mov rdx, rdi
mov rcx, rbx
call fcn.14000b990
test rsi, rsi
je 0x14000ce8a
mov rcx, rsi
call fcn.14000ff70
mov rcx, rsi
call fcn.1400187b4
lea rdx, [rbp - 0x59]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, qword [rbx + 0x60]
mov edx, dword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rdx, [rbp - 0x59]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rbp - 0x59]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rbx + 0x30]
test r12, r12
je 0x14000cf03
mov dword [rbp - 1], 0x63736944
mov dword [rbp + 3], 0x656e6e6f
mov dword [rbp + 7], 0x614e7463
mov dword [rbp + 0xb], 0x5064656d
mov dword [rbp + 0xf], 0x657069
lea rdx, [rbp - 1]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000cf03
mov rcx, rdi
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400194d0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret