Function at 0x140053530
Capabilities:
Create pipe
Create process on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x1401a4010]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, r9
mov rbx, r8
mov esi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.1400daa40
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov edi, r15d
test r14, r14
setne dil
test r14, r14
je 0x140053638
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rbp - 0x60], 1
mov qword [rbp - 0x68], r15
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreatePipe]
test eax, eax
jne 0x14005360e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x14005390b
movzx eax, ax
or eax, 0x80070000
jmp 0x14005390b
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
test eax, eax
je 0x1400535f3
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
or dword [rbp - 0x14], 0x100
lea rcx, [rbp + 0x30]
call fcn.1400524f0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x1400536b2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x30]
mov r8d, 0x23e1
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_CreateProcess_szCmd_s_bGetProcessConsoleOutput_d_GetLastError_d
call fcn.140065460
xor eax, eax
jmp 0x14005390b
test esi, esi
je 0x1400536c6
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x1400536d9
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14, r14
je 0x140053906
call fcn.140005430
mov rcx, rax
test rax, rax
je 0x140053942
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], r15d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov edi, eax
test eax, eax
js 0x14005394d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140053751
mov edx, edi
lea rcx, [rbp + 0x20]
call fcn.14000c5f0
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x1400537ac
mov r8d, 0x23fa
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_PRINT_ON_FALSE
call fcn.140065460
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400537a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14005390b
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x140053937
cmp eax, dword [rbx - 0xc]
jg 0x140053937
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov edi, 0xffffffff
test r14, r14
je 0x1400538ce
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140053804
cmp rax, qword [rbx - 0x18]
jne 0x140053804
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14005383b
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140053931
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
mov r8, rbx
lea rcx, [rsi + 0x18]
mov r9, rdx
call fcn.14000d2f0
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14005b560
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r14]
sub rbx, 0x18
cmp rcx, rbx
je 0x1400538ac
cmp dword [rbx + 0x10], 0
jl 0x14005389f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005389f
call fcn.140007120
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140053896
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x1400538ac
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.140004e70
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400538ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400538de
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400538ef
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140053906
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400d37a0
mov rbx, qword [rsp + 0x588]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004dd0
nop
mov ecx, 0x80070057
call fcn.140005560
nop
mov ecx, 0x80004005
call fcn.140005560
nop
mov ecx, 0x80070057
call fcn.140005560
int3