Function at 0x140001f38
Capabilities:
Create pipe
Get common file path
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14d, r9d
lea r13d, [r8 + 0x489]
xor r14d, 0x6d4
lea r12d, [r8 + 0xaa8]
mov ebp, r8d
mov dword [rsp + 0x80], r12d
xor ebp, 0x58f
lea r15d, [r9 + 0x16a]
mov rsi, rdx
lea eax, [r14 + 0x67]
cmp r13d, eax
jle 0x14000291c
mov edi, dword [rsp + 0x90]
lea eax, [rbp - 0x47b]
cmp edi, eax
jle 0x140002182
lea eax, [r13 + 0x112]
cmp r15d, eax
jle 0x140002052
mov rdx, qword [section..data]
cmp dword [rdx + 0x130], 0xe763
je 0x140001fdf
imul eax, dword [rsi + 0x78], 0x181781
mov dword [rsi + 0x78], eax
mov rdx, qword [section..data]
jmp 0x140001ff7
mov ecx, dword [rdx + 0xd0]
add ecx, 0xfffdbe38
add ecx, dword [rsi + 0x148]
mov dword [0x1400cd10c], ecx
mov eax, dword [rdx + 0x28]
add edi, 0xfffffa85
mov dword [rsp + 0x90], edi
cmp dword [rsi + 0x54], eax
jbe 0x14000201a
mov eax, dword [rsi + 0x74]
xor eax, 0x217ae
sub dword [0x1400cd15c], eax
sub r15d, 0x634
cmp dword [rdx + 0x24], 0xddd1
jae 0x140002046
mov ecx, dword [rsi + 0xbc]
mov eax, dword [0x1400cd02c]
sub ecx, dword [rsi + 0x60]
add eax, 0xfff16cb8
add ecx, eax
mov dword [0x1400cd02c], ecx
xor r14d, 0x18a
jmp 0x1400020e7
mov eax, dword [0x1400cd028]
add eax, 0xffffe1d2
cmp ebp, eax
je 0x1400020c8
mov ecx, r13d
mov ebx, 0x1ae4
or ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov eax, r13d
mov r8d, 0x1e15
xor eax, r8d
or dword [rsi + 0x168], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x10c]
mov ecx, dword [rcx + 0x28]
add eax, 0xffffe5a7
and ecx, dword [0x1400cd0f0]
add r13d, eax
mov eax, dword [rsi + 0x1c]
imul eax, ecx
mov ecx, dword [rsi + 0x18]
or rcx, rbx
movsxd rdx, r13d
mov dword [rsi + 0x1c], eax
movsxd rax, r12d
or rdx, rax
mov eax, r12d
xor rcx, rax
xor rdx, r8
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov edx, dword [rsi + 0xd0]
mov eax, dword [rsi + 0x3c]
mov ecx, dword [rsi + 0x54]
xor rdx, rax
sub ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rdx, qword [section..data]
lea eax, [r12 - 0x148]
cmp edi, eax
jge 0x140002189
lea eax, [r13 - 0x2e3]
cmp r15d, eax
jg 0x14000212f
mov eax, dword [rsi + 0x18]
sub ebp, 0x489
cmp dword [0x1400cd10c], eax
jbe 0x140002129
mov eax, dword [0x1400cd03c]
add eax, 0x1d2561
xor dword [rsi + 0x28], eax
mov rdx, qword [section..data]
xor ebp, 0x1c8
lea eax, [r12 - 0xa33]
cmp r14d, eax
jl 0x140002189
lea eax, [r15 + 0x10e]
cmp r14d, eax
je 0x140002189
mov eax, dword [rsi + 0x2c]
sub r12d, 0xa9a
add eax, 0x1943e8
mov dword [rsp + 0x80], r12d
add r14d, 0x804
mov dword [rsi + 0xf0], eax
add ebp, 0x9de
xor edi, 0x72
add edi, 0x554
mov dword [rsp + 0x90], edi
mov rdx, qword [section..data]
mov eax, r14d
xor eax, 0x3b21
cmp r15d, eax
je 0x140002330
mov eax, r12d
xor eax, 0x1ba
cmp r14d, eax
jle 0x140002586
mov eax, r14d
xor eax, 0x214
cmp r13d, eax
je 0x140002266
mov eax, dword [rsi + 0x130]
cmp dword [rsi + 0x24], eax
ja 0x1400021dc
mov eax, dword [rsi + 0xd0]
add eax, 0xfeb5a
add dword [rsi + 0x28], eax
mov rdx, qword [section..data]
mov eax, edi
sub r13d, 0x258
xor eax, 0x47b
xor r12d, 0x1e9
xor r15d, 0x63
cmp r12d, eax
jge 0x140002266
imul eax, dword [rsi + 0xfc], 0x6a82b
sub edi, 0x49a
sub ebp, 0x9de
mov dword [rsp + 0x90], edi
add r12d, 0x4f7
mov dword [rsi + 0xfc], eax
mov eax, dword [0x1400cd028]
cmp dword [rsi + 0x78], eax
je 0x140002239
mov dword [rsi + 0x144], 0x1ba2
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xb0]
cmp dword [rdx + 8], eax
jae 0x140002266
mov eax, dword [rsi + 0xf0]
sub eax, dword [rdx + 0x8c]
sub eax, 0x8634d
mov dword [rsi + 0x18], eax
mov rdx, qword [section..data]
lea eax, [r15 + 0x827]
cmp ebp, eax
jge 0x1400022b0
mov eax, 0xfffb3f57
add r15d, 0x298
sub eax, dword [0x1400cd108]
add dword [rdx + 0x24], eax
mov eax, dword [0x1400cd100]
cmp dword [0x1400cd15c], eax
jb 0x14000257f
mov rax, qword [section..data]
mov ecx, dword [rax + 0x1c]
add ecx, 0x1f4116
mov dword [rsi + 0x3c], ecx
jmp 0x14000257f
mov r11d, dword [rdx + 0x28]
lea r10d, [r14 - 0x1e1f]
mov ebx, dword [rsi + 0x60]
mov eax, 0x1928
mov r9d, dword [rsi + 0xfc]
xor ebx, 0x1a59
add ebx, dword [rdx + 0x14c]
mov r8d, r14d
or r9d, dword [rsi + 0x54]
or edi, eax
mov ecx, dword [0x1400cd06c]
or r8d, eax
xor r8d, dword [rsp + 0x90]
mov edx, ebp
mov qword [rsp + 0x38], rbx
or r11d, 0x18c1
mov dword [rsp + 0x30], edi
or r9d, r15d
mov dword [rsp + 0x28], r10d
xor edx, 0x2213
sub ecx, r14d
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edi, dword [rsp + 0x90]
jmp 0x14000257f
mov ecx, dword [0x1400cd054]
add ecx, r15d
or ecx, dword [rdx + 0x28]
cmp ebp, ecx
je 0x140002496
mov r12d, ebp
mov ecx, dword [rsi + 0x8c]
or ecx, dword [rsi + 0xac]
movsxd rax, r13d
add ecx, r15d
movsxd rdx, ebp
and rdx, rax
or rdx, 0x18b3
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r11d, dword [rsi + 0x74]
lea eax, [rbp - 0x2213]
mov r8d, dword [rsi + 0x14c]
mov r9d, ebp
mov edx, dword [rsi + 0x128]
mov ebx, edi
or ebx, dword [rsi + 0x148]
add edx, 0x1e2e
mov ecx, dword [rsi + 0x28]
and ebx, 0x1f7f
sub r9d, dword [0x1400cd09c]
movsxd r10, eax
mov eax, edi
xor r11, rax
mov dword [rsp + 0x30], ebx
mov eax, r15d
or r8, rax
mov qword [rsp + 0x28], r10
mov eax, ebp
and rcx, rax
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
lea eax, [r13 - 0x235b]
cmp ebp, eax
jl 0x14000246e
mov rax, qword [section..data]
imul ebx, dword [rsi + 0xe0], 0x197b
mov r8d, dword [rsi + 0xf4]
or r8d, dword [rsi + 0x148]
mov ecx, dword [rax + 0x6c]
and ecx, dword [rsi + 0x28]
add ebp, ecx
mov eax, r15d
or rbx, rax
imul r11d, r13d, 0x1d3c
mov ecx, r13d
mov r10d, r13d
or ecx, r15d
mov qword [rsp + 0x30], rbx
imul ecx, dword [rsi + 0xd0]
mov eax, r15d
or eax, 0x2359
mov qword [rsp + 0x28], r10
sub eax, edi
movsxd r9, r13d
movsxd rdx, eax
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x54]
or eax, dword [rsi + 0x134]
sub r13d, eax
mov eax, dword [rsi + 0xc0]
sub eax, dword [rsi + 0x148]
or r13d, eax
or r13d, 0x1e4e
jmp 0x140002475
mov rdx, qword [section..data]
mov ecx, dword [0x1400cd054]
add r12d, 3
add ecx, r15d
or ecx, dword [rdx + 0x28]
cmp r12d, ecx
jne 0x140002347
mov r12d, dword [rsp + 0x80]
mov r9d, dword [rdx + 0xd0]
mov eax, r15d
and r9d, dword [rsi + 0x8c]
mov r8d, r12d
add r9d, dword [rdx + 0x100]
mov ecx, r13d
mov dword [rsp + 0x28], r9d
lea edx, [r14 + 0x1d3c]
and eax, 0x1e4e
mov r9, rsi
and r8d, 0x18c1
mov dword [rsp + 0x20], eax
sub ecx, ebp
call fcn.140001460
mov r14d, eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x168]
sub ecx, r12d
add ecx, edi
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
mov ecx, dword [rsi + 8]
mov eax, r12d
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov rax, qword [section..data]
lea r11d, [r14 - 0x2359]
mov ebx, dword [0x1400cd034]
or r11d, 0x1e1f
mov r8d, dword [0x1400cd084]
or ebx, edi
imul ebx, dword [rsi + 0x3c]
sub r8d, edi
mov r10d, dword [rax + 0x60]
sub r8d, 0x1e15
mov edx, dword [rsi + 0x118]
xor r10d, 0x1864
mov r9d, dword [rsi + 0x8c]
add r10d, ebp
mov eax, dword [0x1400cd10c]
or edx, dword [rsi + 0xf8]
xor r9, rax
mov ecx, dword [rsi + 0xb0]
add edx, ebp
mov qword [rsp + 0x30], rbx
sub ecx, edi
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov rdx, qword [section..data]
mov eax, r13d
xor eax, 0x4ca
cmp r12d, eax
je 0x140002782
mov eax, 0xfffe737f
add edi, 0x3c1
sub eax, dword [rsi + 8]
xor r14d, 0x3867
add dword [rsi + 0x148], eax
lea eax, [rbp - 0xba]
cmp edi, eax
je 0x14000277b
lea eax, [r13 + 0x49b]
cmp r12d, eax
jge 0x140002630
add r15d, 0x255
lea eax, [r15 + 0x33a]
cmp ebp, eax
je 0x1400026b1
mov rcx, qword [section..data]
mov edx, dword [rsi + 0x28]
cmp dword [rcx + 0xa0], edx
je 0x14000260d
mov eax, dword [rsi + 0xd0]
sub eax, dword [0x1400cd084]
add eax, 0x2c7f2
add dword [rcx + 0x144], eax
jmp 0x14000261d
mov eax, dword [rsi + 0xa0]
xor eax, edx
xor eax, 0x2819d
mov dword [rsi + 0x28], eax
sub r15d, 0xd9
sub r13d, 0x280
jmp 0x1400026b1
mov r9d, dword [rsi + 0xa4]
lea r8d, [r15 - 0x2359]
sub r9d, dword [rsi + 0x1c]
and r8d, r12d
mov eax, dword [rsi + 0x140]
add r9d, r12d
mov ecx, dword [rsi + 0x108]
mov edx, dword [rsi + 0x5c]
xor ecx, 0x2359
imul eax, edi
sub edx, 0x1e2e
mov dword [rsi + 0x2c], eax
lea eax, [rbp + 0x1a59]
or dword [rsi + 0xfc], eax
mov eax, r12d
or eax, r14d
xor eax, dword [rsi + 0x74]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r9d
mov r9, rsi
call fcn.140001460
imul ecx, dword [rsi + 0x6c], 0x1a6e
mov r13d, eax
mov edx, dword [rsi + 0xb4]
mov eax, dword [rsi + 0x130]
add edx, dword [rsi + 0x74]
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [r14 - 0x75]
cmp r15d, eax
jle 0x14000277b
mov rdx, qword [section..data]
lea eax, [r15 - 0x2e3]
cmp ebp, eax
jge 0x1400026ed
mov eax, 0xfffffc33
sub eax, dword [rdx + 0xf8]
add dword [0x1400cd154], eax
add r13d, 0x5bb
jmp 0x140002782
mov eax, dword [rsi + 0x60]
mov ecx, 0x1bc0
imul eax, dword [rsi + 0x3c]
imul eax, edi
cmp ebp, eax
jae 0x140002728
imul eax, edi, 0x1e2e
cmp dword [rsi + 0x7c], eax
jae 0x140002728
mov eax, dword [rdx + 0x24]
sub eax, ecx
imul eax, dword [rdx + 0xa4]
or dword [0x1400cd158], eax
lea eax, [r12 + 0x18c1]
xor r15d, eax
mov eax, dword [rsi + 0xd0]
or eax, 0x1a59
cmp dword [0x1400cd0c8], eax
je 0x140002782
mov eax, dword [rsi + 0x124]
xor r15d, 0x1f7f
and eax, dword [0x1400cd0e0]
add eax, r14d
sub ebp, eax
mov eax, dword [rsi + 0x3c]
or dword [0x1400cd120], r15d
and eax, r12d
and eax, 0x235b
or dword [0x1400cd140], eax
mov eax, r12d
and eax, ecx
imul eax, dword [rsi + 0x148]
add ebp, eax
jmp 0x140002782
mov rdx, qword [section..data]
cmp r14d, r13d
jg 0x14000291c
xor r13d, 0x67b
cmp edi, r13d
jl 0x140002864
mov edx, dword [rsi + 0xe4]
xor ebp, 0x3a22
mov ecx, dword [rsi + 0x148]
sub ebp, 0x8eb
add ecx, 0x3f9c6
add r14d, 0x506
add ecx, edx
imul ecx, edx
mov dword [rsi + 0xe4], ecx
add dword [0x1400cd0cc], 0x182b6
mov eax, dword [rsi + 0x148]
sub eax, dword [rsi + 0x1c]
sub eax, 0xa3903
xor dword [0x1400cd154], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x118]
xor ecx, 0x1b62
sub dword [rsi + 0x144], ecx
mov rax, qword [section..data]
mov ecx, dword [rsi + 0x144]
cmp dword [rax + 0xb0], 0xf8b0
ja 0x14000282d
sub ecx, dword [0x1400cd084]
sub ecx, 0x1027
mov dword [rsi + 0x144], ecx
mov eax, dword [rsi + 0x16c]
xor r14d, 0x31
xor eax, 0xffffe676
sub r12d, 0x3c6
sub dword [0x1400cd154], eax
sub r14d, 0x4a4
mov eax, dword [rsi + 0xb0]
add eax, 0xb355bd9
mov dword [rsi], eax
mov rdx, qword [section..data]
xor r12d, 0x199
cmp r14d, r12d
jge 0x140002894
mov dword [0x1400cd014], 0x1e10e9c0
mov eax, dword [rdx + 0x3c]
cmp dword [rsi + 0x78], eax
je 0x140002894
mov eax, dword [rsi + 0x74]
add eax, 0x898b
mov dword [rsi + 0x40], eax
mov rdx, qword [section..data]
mov eax, dword [rsi + 0x108]
sub ebp, 0x20a
xor eax, 0x4449b6f7
mov dword [rdx + 0x58], eax
mov rax, qword [section..data]
mov r8d, dword [rsi + 0x40]
mov ecx, dword [rax + 0xd0]
xor ecx, dword [0x1400cd09c]
xor ecx, 1
mov dword [rsi + 0x120], ecx
mov rax, qword [section..data]
cmp r8d, dword [rax + 0x58]
ja 0x14000291c
mov ecx, r8d
mov eax, 1
sub eax, dword [rsi + 0x50]
add dword [rsi + 0x148], eax
mov rdx, qword [section..data]
imul ecx, r8d
inc r8d
add dword [rdx + 0x120], ecx
mov ecx, dword [rsi + 0x68]
add dword [0x1400cd108], ecx
mov ecx, dword [rsi + 0xe4]
or dword [rsi + 0x14c], ecx
mov rcx, qword [section..data]
cmp r8d, dword [rcx + 0x58]
jbe 0x1400028d5
lea r11, [rsp + 0x40]
xor ebp, 0x3a4
mov rbx, qword [r11 + 0x30]
mov eax, ebp
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret