Function at 0x1800015b0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Get file size
Read file on windows
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rsi, qword [rcx]
xor r14d, r14d
mov rbx, rdx
mov edi, r14d
mov rdx, rcx
cmp word [rsi + 1], r14w
je 0x1800015ea
nop dword [rax]
inc edi
cmp word [rsi + rdi*2 + 1], r14w
jne 0x1800015e0
mov eax, dword [rdx + 8]
lea ecx, [rdi*2 + 2]
dec rax
cmp rcx, rax
jne 0x18000183c
mov qword [rbp - 0x78], r14
lea r8, [rbp - 0x78]
mov qword [rbp - 0x68], r14
lea rdx, [rsp + 0x68]
xor r9d, r9d
mov dword [rbp - 0x78], 0x18
lea rcx, [rsp + 0x60]
mov dword [rbp - 0x68], 1
mov qword [rbp - 0x70], r14
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x18000183c
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x180001826
mov r9d, 0xa00000
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x180001826
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x180001810
xor eax, eax
mov qword [rsp + 0x70], r14
lea rdi, [rbp - 0x60]
mov qword [rsp + 0x78], r14
mov ecx, 0x68
mov qword [rbp - 0x80], r14
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x60]
lea rdx, [rsi + 1]
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov rax, qword [rsp + 0x58]
xor r8d, r8d
mov qword [rbp - 8], rax
xor ecx, ecx
mov qword [rbp], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r14w
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180001810
mov rcx, qword [rsp + 0x70]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [rbp + 0x40], r14d
jne 0x1800017f8
test eax, eax
je 0x1800017f8
lea edi, [rax + 1]
test rbx, rbx
je 0x18000177a
test edi, edi
je 0x18000177a
mov edx, edi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001774
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbx], rax
mov dword [rbx + 8], edi
mov rax, qword [rbx]
lea r9, [rbp + 0x50]
mov r8d, esi
mov qword [rsp + 0x20], r14
mov byte [rax], r14b
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
inc rdx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800017f8
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x18000186e
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x18000185c
test eax, eax
je 0x18000185c
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000186a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], r14
mov dword [rbx + 8], r14d
xor eax, eax
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret