Function at 0x1400019db
Capabilities:
Connect pipe
Create pipe
Read file on windows

Disassembly:
push rbp
mov eax, 0x2ad0
call fcn.140002f00
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x2a60], ecx
mov qword [rbp + 0x2a68], rdx
call dbg.__main
lea rax, str.________________________________________________________________n__________________________________________________________n______________________________________________________n_____________________________________________n________________________________________n____________________________________________n_n
mov qword [rbp + 0x2a30], rax
mov rax, qword [rbp + 0x2a30]
mov rdx, rax
lea rax, [0x140011272]
mov rcx, rax
call sym.printf_2
mov dword [rbp + 0x2a3c], 1
jmp 0x140001b74
mov eax, dword [rbp + 0x2a3c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
lea rdx, [0x140011275]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001ad8
mov eax, dword [rbp + 0x2a3c]
add eax, 1
cmp dword [rbp + 0x2a60], eax
jle 0x140001aae
mov eax, dword [rbp + 0x2a3c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x9dc], eax
jmp 0x140001b6d
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.____Option__p_requires_a_value._n
mov rdx, rax
call sym.fprintf
mov eax, 1
jmp 0x140001e89
mov eax, dword [rbp + 0x2a3c]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
lea rdx, [0x140011299]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001b6d
mov eax, dword [rbp + 0x2a3c]
add eax, 1
cmp dword [rbp + 0x2a60], eax
jle 0x140001b43
mov eax, dword [rbp + 0x2a3c]
cdqe
add rax, 1
lea rdx, [rax*8]
mov rax, qword [rbp + 0x2a68]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x2a40], rax
jmp 0x140001b6d
mov ecx, 2
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.____Option__d_requires_a_value.._n
mov rdx, rax
call sym.fprintf
mov eax, 1
jmp 0x140001e89
add dword [rbp + 0x2a3c], 1
mov eax, dword [rbp + 0x2a3c]
cmp eax, dword [rbp + 0x2a60]
jl 0x140001a39
mov rdx, qword [rbp + 0x2a40]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x7d0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov eax, dword [rbp + 0x9dc]
mov edx, eax
lea rax, str._n_n_i__PID_to_monitor__t:__lu_n
mov rcx, rax
call sym.printf_2
mov rax, qword [rbp + 0x2a40]
mov rdx, rax
lea rax, str._i__DLL_path__t_t:__s_n_n
mov rcx, rax
call sym.printf_2
mov edx, dword [rbp + 0x9dc]
lea rax, [rbp + 0x7d0]
mov rcx, rax
call sym.InjectDLL
test eax, eax
jne 0x140001c1f
lea rax, str.____Error_:_Failed_to_inject_DLL_n_n
mov rcx, rax
call sym.printf_2
mov eax, 1
jmp 0x140001e89
lea rax, str._i__Waiting_for_events_..._n_n
mov rcx, rax
call sym.printf_2
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x800
mov dword [rsp + 0x20], 0x800
mov r9d, 0xff
mov r8d, 0
mov edx, 3
lea rax, str..pipeCrimsonEDRPipe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call rax
mov qword [rbp + 0x2a28], rax
cmp qword [rbp + 0x2a28], 0xffffffffffffffff
jne 0x140001cb3
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.CreateNamedPipe
mov rdx, rax
lea rax, str._____s_failed_with_error:__ld_n
mov rcx, rax
call sym.printf_2
mov eax, 1
jmp 0x140001e89
mov rax, qword [rbp + 0x2a28]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
call rax
mov dword [rbp + 0x2a24], eax
cmp dword [rbp + 0x2a24], 0
je 0x140001dbb
jmp 0x140001d84
mov eax, dword [rbp - 0x34]
mov eax, eax
mov byte [rbp + rax - 0x30], 0
cmp dword [rbp + 0x2a4c], 0x7ff
jg 0x140001d6b
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.ExtractIDFromJSON
mov dword [rbp + 0x2a20], eax
cmp dword [rbp + 0x2a20], 0xffffffff
je 0x140001d84
mov ecx, dword [rbp + 0x2a4c]
lea rdx, [rbp + 0xa20]
mov eax, dword [rbp + 0x2a20]
mov r8d, ecx
mov ecx, eax
call sym.isIDPresent
test eax, eax
jne 0x140001d84
mov eax, dword [rbp + 0x2a4c]
lea edx, [rax + 1]
mov dword [rbp + 0x2a4c], edx
cdqe
mov edx, dword [rbp + 0x2a20]
mov dword [rbp + rax*4 + 0xa20], edx
lea rax, [rbp - 0x30]
mov rdx, rax
lea rax, str.____Alert_:__n_s_n_n_n
mov rcx, rax
call sym.printf_2
jmp 0x140001d84
lea rax, str.ID_storage_limit_reached._n
mov rcx, rax
call sym.printf_2
mov eax, 0
jmp 0x140001e89
lea rcx, [rbp - 0x34]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x2a28]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x7ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
jne 0x140001ce3
jmp 0x140001de0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, str.ConnectNamedPipe
mov rdx, rax
lea rax, str._____s_failed_with_error:__ld_n
mov rcx, rax
call sym.printf_2
mov rax, qword [rbp + 0x2a28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp + 0x9e0]
lea rax, [rbp - 0x30]
mov r8d, 0x32
mov rcx, rax
call sym.ExtractProcessStatusFromJSON
test eax, eax
jne 0x140001c2e
lea rax, [rbp + 0x9e0]
lea rdx, str.Killed
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001c2e
lea rax, str._n_n
mov rcx, rax
call sym.printf_2
lea rax, str.___Please_enter_a_new_PID_to_monitor_:
mov rcx, rax
call sym.printf_2
lea rax, [rbp + 0x9dc]
mov rdx, rax
lea rax, [0x140011431]
mov rcx, rax
call sym.scanf
cmp eax, 1
je 0x140001e83
lea rax, str.____Error_:_Invalid_input_n_n
mov rcx, rax
call sym.printf_2
nop
jmp 0x140001c2e
nop
jmp 0x140001bbd
add rsp, 0x2ad0
pop rbp
ret