Function at 0x140052860
Capabilities:
Create pipe
Create process on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x14019b010]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, r9
mov rbx, r8
mov esi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.1400d54b0
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov edi, r15d
test r14, r14
setne dil
test r14, r14
je 0x140052968
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rbp - 0x60], 1
mov qword [rbp - 0x68], r15
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreatePipe]
test eax, eax
jne 0x14005293e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x140052c3b
movzx eax, ax
or eax, 0x80070000
jmp 0x140052c3b
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
test eax, eax
je 0x140052923
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
or dword [rbp - 0x14], 0x100
lea rcx, [rbp + 0x30]
call fcn.140051820
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x1400529e2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x30]
mov r8d, 0x23e1
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_CreateProcess_szCmd_s_bGetProcessConsoleOutput_d_GetLastError_d
call fcn.140064950
xor eax, eax
jmp 0x140052c3b
test esi, esi
je 0x1400529f6
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x140052a09
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14, r14
je 0x140052c36
call fcn.140005430
mov rcx, rax
test rax, rax
je 0x140052c72
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], r15d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov edi, eax
test eax, eax
js 0x140052c7d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140052a81
mov edx, edi
lea rcx, [rbp + 0x20]
call fcn.14000c5f0
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x140052adc
mov r8d, 0x23fa
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_PRINT_ON_FALSE
call fcn.140064950
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140052ad5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140052c3b
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x140052c67
cmp eax, dword [rbx - 0xc]
jg 0x140052c67
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov edi, 0xffffffff
test r14, r14
je 0x140052bfe
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140052b34
cmp rax, qword [rbx - 0x18]
jne 0x140052b34
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x140052b6b
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140052c61
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
mov r8, rbx
lea rcx, [rsi + 0x18]
mov r9, rdx
call fcn.14000d2f0
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14005a890
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r14]
sub rbx, 0x18
cmp rcx, rbx
je 0x140052bdc
cmp dword [rbx + 0x10], 0
jl 0x140052bcf
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140052bcf
call fcn.140007120
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140052bc6
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x140052bdc
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140004e70
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140052bfa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140052c0e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140052c1f
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140052c36
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400ce210
mov rbx, qword [rsp + 0x588]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004dd0
nop
mov ecx, 0x80070057
call fcn.140005560
nop
mov ecx, 0x80004005
call fcn.140005560
nop
mov ecx, 0x80070057
call fcn.140005560
int3