Function at 0x14004ff90
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe
Terminate process

Disassembly:
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0x1068]
mov eax, 0x1168
call fcn.14007d130
sub rsp, rax
mov rax, qword [0x14009d0c0]
xor rax, rsp
mov qword [rbp + 0x1050], rax
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
lea r8, [rbp + 0x30]
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x1c], eax
lea rdx, [rsp + 0x70]
movups xmmword [rbp - 0x6c], xmm0
mov rbx, rcx
xor r15d, r15d
movups xmmword [rbp - 0x5c], xmm0
xor r9d, r9d
lea rcx, [rsp + 0x68]
movups xmmword [rbp - 0x4c], xmm0
mov qword [rsp + 0x68], r15
movups xmmword [rbp - 0x2c], xmm0
mov qword [rsp + 0x70], r15
psrldq xmm0, 8
movd eax, xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x30], 0x18
bts eax, 8
mov dword [rbp - 0x34], eax
xor eax, eax
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14005038b
mov rax, qword [rsp + 0x70]
movabs r12, 0x7fffffffffffffff
mov rcx, qword [rbx + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov rax, r12
sub rax, rcx
cmp rax, 0x60
jb 0x140050395
cmp qword [rbx + 0x18], 0xf
mov r9, rbx
jbe 0x140050072
mov r9, qword [rbx]
movzx edx, byte [rsp + 0x50]
lea rax, str.__VERYSILENT__SUPPRESSMSGBOXES__NORESTART__NOCANCEL__NOCLOSEAPPLICATIONS__FORCECLOSEAPPLICATIONS
mov qword [rsp + 0x30], 0x60
mov r8, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x10]
call fcn.140063a80
cmp qword [rbp + 0x28], 0xf
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x10]
cmova rdx, qword [rbp + 0x10]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140050337
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x1198], rsi
mov qword [rsp + 0x11a0], rdi
mov qword [rsp + 0x11a8], r13
mov qword [rsp + 0x1160], r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
movabs rsi, 0x4e94914f0000
movabs r13, 0x7ffffffffa0a1eff
movabs r14, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400501b2
cmp dword [rbp + 4], r15d
jbe 0x1400501b2
mov rcx, qword [rsp + 0x68]
lea r9, [rbp]
mov r8d, 0xfff
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400501b2
mov eax, dword [rbp]
test eax, eax
je 0x1400501b2
cmp rax, 0x1000
jae 0x14005038f
mov byte [rbp + rax + 0x50], r15b
mov dil, 1
mov dword [0x1400cffdc], 0x3f000000
mov rcx, qword [rsp + 0x78]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140050271
test dil, dil
jne 0x140050264
lea rcx, [rsp + 0x60]
call fcn.1400392d0
mov rbx, qword [rsp + 0x60]
cmp rbx, r13
jge 0x1400501f0
add rbx, 0x5f5e100
jmp 0x1400501f3
mov rbx, r12
lea rcx, [rsp + 0x58]
call fcn.1400392d0
mov rax, qword [rsp + 0x58]
cmp rax, rbx
jge 0x140050140
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jle 0x140050222
mov edx, 0x5265c00
jmp 0x140050244
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140050244
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x58]
call fcn.1400392d0
mov rax, qword [rsp + 0x58]
cmp rax, rbx
jl 0x140050210
jmp 0x140050140
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x28]
mov dword [0x1400cffdc], 0x3f800000
cmp rdx, 0xf
jbe 0x1400502f8
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400502f3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400502f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007b19c
mov r13, qword [rsp + 0x11a8]
mov al, 1
mov rdi, qword [rsp + 0x11a0]
mov rsi, qword [rsp + 0x1198]
mov r14, qword [rsp + 0x1160]
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.14007aa70
add rsp, 0x1168
pop r15
pop r12
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14005038b
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050386
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050386
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007b19c
xor al, al
jmp 0x14005031a
call fcn.14007acb8
int3
call fcn.140035c10
int3