Function at 0x1009ff20
Capabilities:
Create pipe
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov qword [rsp + 0xc0], rcx
mov byte [rsp + 0x4f], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rsp + 0xd4], ecx
xor eax, eax
mov qword [rsp + 0x100], rax
mov r14d, 8
mov dil, 1
xorps xmm6, xmm6
lea r13, [rsp + 0x68]
nop word cs:[rax + rax]
call sub.kernel32.dll_GetCurrentProcessId
mov dword [rsp + 0xdc], eax
mov rax, qword [0x1016d220]
test rax, rax
je 0x1009ffbb
jmp 0x1009fffc
mov rax, qword [rsp + 0x90]
xchg qword [0x1016d220], rax
mov rax, qword [0x1016d220]
test rax, rax
jne 0x1009fffc
movaps xmmword [rsp + 0x90], xmm6
xor ecx, ecx
lea rdx, [rsp + 0x90]
mov r8d, 0x10
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jns 0x1009ffa0
mov ecx, eax
call fcn.100a5970
xchg qword [0x1016d220], rax
mov rax, qword [0x1016d220]
test rax, rax
je 0x1009ffbb
mov eax, 1
lock xadd qword [0x1016d220], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0xe0], rax
lea rax, [fcn.100fb590]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], r13
lea rax, [fcn.100fb800]
mov qword [rsp + 0xf8], rax
lea rax, str..pipe__rust_anonymous_pipe1__.
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 2
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 2
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x90]
call fcn.100dc650
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rax
test dil, 1
jne 0x100a00d8
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x100a00d8
mov rcx, qword [rsp + 0x70]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.100028e0
mov r15, qword [rsp + 0xa0]
mov qword [rsp + 0x80], r15
movaps xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x70], xmm0
mov rsi, qword [rsp + 0x70]
lea rax, [rsi + r15]
mov qword [rsp + 0xc8], rax
test r15, r15
mov dword [rsp + 0xd8], r14d
je 0x100a0130
movzx ecx, byte [rsi]
test cl, cl
js 0x100a0150
inc rsi
mov edi, ecx
jmp 0x100a01a6
xor edi, edi
xor r14d, r14d
xor r12d, r12d
xor esi, esi
xor ebp, ebp
jmp 0x100a01d4
mov edi, ecx
and edi, 0x1f
movzx edx, byte [rsi + 1]
and edx, 0x3f
cmp cl, 0xdf
jbe 0x100a019d
movzx eax, byte [rsi + 2]
shl edx, 6
and eax, 0x3f
or eax, edx
cmp cl, 0xf0
jb 0x100a0553
movzx ecx, byte [rsi + 3]
add rsi, 4
and edi, 7
shl edi, 0x12
shl eax, 6
and ecx, 0x3f
or ecx, eax
or ecx, edi
mov edi, ecx
cmp edi, 0xffff
jbe 0x100a01a6
jmp 0x100a056a
add rsi, 2
shl edi, 6
or edi, edx
mov eax, 1
xor r12d, r12d
mov rbp, qword [rsp + 0xc8]
sub rbp, rsi
add rbp, 3
mov rcx, 0xffffffffffffffff
cmovb rbp, rcx
shr rbp, 2
add rbp, rax
mov r14w, 1
cmp rbp, 4
mov eax, 3
cmovb rbp, rax
movabs rax, 0x4000000000000000
add rax, 0xfffffffffffffffe
cmp rbp, rax
ja 0x100a073f
inc rbp
mov rbx, rbp
add rbx, rbp
mov edx, 2
mov rcx, rbx
call fcn.100028d0
test rax, rax
je 0x100a0746
mov r8, rax
mov word [rax], di
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rsi
test r15, r15
je 0x100a049a
mov ebx, 1
jmp 0x100a0257
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], rbp
mov r13, r14
mov r14d, r15d
mov word [r8 + rbx*2], r12w
inc rbx
mov r12d, edi
test rsi, rsi
cmovne rsi, r13
je 0x100a02a0
test r12w, r12w
je 0x100a0270
xor edi, edi
jmp 0x100a02b4
mov rax, qword [rsi]
cmp rax, qword [rsp + 0xc8]
je 0x100a0296
lea rcx, [rax + 1]
mov qword [rsi], rcx
movzx ecx, byte [rax]
test cl, cl
js 0x100a03e2
mov r12d, ecx
xor edi, edi
jmp 0x100a02b4
mov qword [rsp + 0x68], 0
nop
cmp r14w, 1
jne 0x100a0490
xor r14d, r14d
mov edi, r12d
xor r12d, r12d
mov rsi, qword [rsp + 0x68]
cmp rbx, rbp
jne 0x100a024c
test rsi, rsi
je 0x100a02ff
mov rax, qword [rsp + 0xc8]
sub rax, rsi
add rax, 3
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
shr rax, 2
cmp di, 1
sbb rax, 0xffffffffffffffff
cmp r14w, 1
sbb rax, 0xffffffffffffffff
inc rax
add rax, rbp
jae 0x100a0314
jmp 0x100a0724
xor eax, eax
test r14w, r14w
setne al
inc rax
add rax, rbp
jb 0x100a0724
mov qword [rsp + 0x108], rbp
mov r15d, r14d
mov r14, r13
mov r13, qword [rsp + 0x58]
mov rcx, r13
add rcx, r13
mov rbp, rcx
cmp rcx, rax
ja 0x100a0338
mov rbp, rax
cmp rbp, 5
jae 0x100a0343
mov ebp, 4
movabs rax, 0x4000000000000000
dec rax
xor r8d, r8d
cmp rbp, rax
setbe r8b
mov rdx, rbp
add rdx, rbp
add r8, r8
test r13, r13
je 0x100a0384
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
mov eax, 2
jmp 0x100a0386
xor eax, eax
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0xe0]
lea r9, [rsp + 0x90]
call fcn.10066ad0
cmp qword [rsp + 0xe0], 0
mov r8, qword [rsp + 0xe8]
je 0x100a023c
mov rdx, qword [rsp + 0xf0]
movabs rax, 0x8000000000000001
cmp rdx, rax
jne 0x100a0717
mov r8, qword [rsp + 0x50]
mov rbp, r13
jmp 0x100a0246
mov r12d, ecx
and r12d, 0x1f
lea rdx, [rax + 2]
mov qword [rsi], rdx
movzx edi, byte [rax + 1]
and edi, 0x3f
cmp cl, 0xdf
jbe 0x100a0441
lea rdx, [rax + 3]
mov qword [rsi], rdx
movzx edx, byte [rax + 2]
shl edi, 6
and edx, 0x3f
or edx, edi
cmp cl, 0xf0
jb 0x100a044f
lea rcx, [rax + 4]
mov qword [rsi], rcx
movzx eax, byte [rax + 3]
and r12d, 7
shl r12d, 0x12
shl edx, 6
and eax, 0x3f
or eax, edx
or r12d, eax
cmp r12d, 0xffff
jbe 0x100a0266
jmp 0x100a0463
shl r12d, 6
or r12d, edi
xor edi, edi
jmp 0x100a02b4
shl r12d, 0xc
or r12d, edx
cmp r12d, 0xffff
jbe 0x100a0266
add r12d, 0xffff0000
mov eax, r12d
shr eax, 0xa
or eax, 0xd800
and r12d, 0x3ff
or r12d, 0xdc00
mov edi, r12d
mov r12d, eax
jmp 0x100a02b4
mov r8, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rbx, r8
mov rcx, r8
mov edx, dword [rsp + 0xd4]
mov r14d, dword [rsp + 0xd8]
mov r8d, r14d
mov r9d, 1
call sub.kernel32.dll_CreateNamedPipeW
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x100a0612
mov rax, qword [rsp + 0x100]
lea esi, [rax + 1]
call sub.kernel32.dll_GetLastError
cmp esi, 0xa
jge 0x100a0596
cmp eax, 5
jne 0x100a0520
mov eax, esi
mov qword [rsp + 0x100], rax
jmp 0x100a052d
test r14d, r14d
je 0x100a0596
xor r14d, r14d
cmp eax, 0x57
jne 0x100a0596
xor edi, edi
test rbp, rbp
je 0x1009ff80
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.100028e0
xor edi, edi
jmp 0x1009ff80
add rsi, 3
shl edi, 0xc
or eax, edi
mov edi, eax
cmp edi, 0xffff
jbe 0x100a01a6
add edi, 0xffff0000
mov ecx, edi
shr ecx, 0xa
or ecx, 0xd800
and edi, 0x3ff
or edi, 0xdc00
mov r12d, edi
mov eax, 2
mov edi, ecx
jmp 0x100a01ae
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 8], rax
mov qword [rcx], 1
test rbp, rbp
je 0x100a05ca
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.100028e0
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x100a05e8
mov rcx, qword [rsp + 0x70]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.100028e0
cmp rdi, 0xffffffffffffffff
je 0x100a05f6
mov rcx, rdi
call sub.kernel32.dll_CloseHandle
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test rbp, rbp
je 0x100a062b
add rbp, rbp
mov r8d, 2
mov rcx, rbx
mov rdx, rbp
call fcn.100028e0
mov qword [rsp + 0x98], 0
mov word [rsp + 0xb4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xa4], xmm0
movzx eax, byte [rsp + 0x4f]
mov byte [rsp + 0xb1], al
xor al, 1
mov byte [rsp + 0xb0], al
mov dword [rsp + 0xe0], 0x18
mov qword [rsp + 0xe8], 0
mov dword [rsp + 0xf0], 1
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x90], rax
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x90]
mov rcx, rsi
call fcn.10099830
test rax, rax
je 0x100a06db
mov rax, qword [rsp + 0xc0]
mov qword [rax + 8], rdx
mov qword [rax], 1
mov rdx, qword [rsp + 0x78]
test rdx, rdx
jne 0x100a05d4
jmp 0x100a05e8
mov rax, qword [rsp + 0xc0]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdx
mov qword [rax], 0
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x100a05f6
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, rsi
call fcn.100028e0
jmp 0x100a05f6
test rdx, rdx
mov rbp, qword [rsp + 0x108]
jne 0x100a0730
mov qword [rsp + 0x60], rbp
call fcn.100db020
jmp 0x100a0753
mov qword [rsp + 0x60], rbp
mov rcx, r8
call fcn.100db070
jmp 0x100a0753
call fcn.100db020
jmp 0x100a0753
mov edx, 2
mov rcx, rbx
call fcn.100db070
ud2