Function at 0x140001000
Capabilities:
Create pipe
Create process on windows
Read file on windows
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10b0]
mov eax, 0x11b0
call fcn.140002150
sub rsp, rax
mov rax, qword [0x14001e008]
xor rax, rsp
mov qword [rbp + 0x10a0], rax
xorps xmm0, xmm0
mov qword [rbp + 0x98], 0xf
xor r14d, r14d
mov qword [rbp + 0x90], 8
movabs rax, 0x6578652e32524452
mov byte [rbp + 0x88], 0
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x80]
xor eax, eax
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0xc], eax
xor r9d, r9d
mov qword [rsp + 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rsp + 0x38], r14
lea edx, [r14 + 3]
mov dword [rsp + 0x30], r14d
lea r8d, [r14 + 7]
mov dword [rsp + 0x28], 0x1000
lea rcx, str..pipeRDR2Launcher_Pipe
mov r9d, 0xff
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rcx, qword [rsp + 0x68]
lea edx, [r14 + 0x64]
mov rdi, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400016dd
movzx ebx, byte [rsp + 0x50]
nop dword [rax + rax]
lea r9, [rsp + 0x54]
mov dword [rsp + 0x54], r14d
mov r8d, 0x1000
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400016c2
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x1400016c2
mov esi, r14d
lea rdi, [rbp + 0xa0]
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [rdi]
lea rcx, str._02hhX
call fcn.140001e80
inc esi
lea rdi, [rdi + 1]
cmp esi, dword [rsp + 0x54]
jb 0x140001190
lea rcx, [0x14001331c]
call fcn.140001e80
mov r8d, dword [rbp + 0xa0]
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
call fcn.140001cf0
mov r13, qword [rbp + 0x70]
lea r15, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
mov r14d, 5
cmp r13, r14
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
cmovb r14, r13
cmp qword [rbp + 0x78], 0x10
cmovae r15, r12
cmp r14, 0xf
ja 0x14000123c
mov r8, r14
mov qword [rbp + 0x10], r14
mov rdx, r15
lea rcx, [rbp]
call fcn.1400031a0
mov byte [rbp + r14], 0
mov rdi, qword [rbp + 0x18]
mov r14, qword [rbp + 0x10]
mov rsi, qword [rbp]
jmp 0x1400012e0
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x140001760
mov rdi, r14
or rdi, 0xf
cmp rdi, rax
jbe 0x14000126a
mov rdi, rax
movabs rax, 0x8000000000000027
jmp 0x140001291
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400012b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000176c
mov rcx, rax
call fcn.14000207c
test rax, rax
je 0x140001790
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400012c1
test rcx, rcx
je 0x1400012bf
call fcn.14000207c
mov rsi, rax
jmp 0x1400012c1
xor esi, esi
mov r8, r14
mov qword [rbp + 0x10], r14
mov rdx, r15
mov qword [rbp + 0x18], rdi
mov rcx, rsi
call fcn.1400031a0
mov byte [rsi + r14], 0
mov qword [rbp], rsi
cmp rdi, 0x10
lea rax, [rbp]
cmovae rax, rsi
cmp r14, 5
jne 0x140001305
cmp dword [rax], 0x54494e49
jne 0x140001305
cmp byte [rax + 4], 0x3a
jne 0x140001305
mov r14b, 1
jmp 0x140001308
xor r14b, r14b
cmp rdi, 0x10
jb 0x14000133f
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001337
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001790
mov rcx, rsi
call fcn.1400020b8
test r14b, r14b
je 0x14000167e
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
cmp r13, 5
jb 0x14000178a
lea rax, [r13 - 5]
mov rsi, 0xffffffffffffffff
cmp rax, rsi
lea r15, [rbp + 0x60]
cmovb rsi, rax
cmp qword [rbp + 0x78], 0x10
cmovae r15, r12
cmp rsi, 0xf
ja 0x1400013a1
mov r8, rsi
mov qword [rbp + 0x50], rsi
lea rdx, [r15 + 5]
lea rcx, [rbp + 0x40]
call fcn.1400031a0
mov byte [rbp + rsi + 0x40], 0
jmp 0x140001447
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001784
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x1400013cf
mov rdi, rax
movabs rax, 0x8000000000000027
jmp 0x1400013f6
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001415
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001772
mov rcx, rax
call fcn.14000207c
test rax, rax
je 0x14000177e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001427
test rcx, rcx
je 0x140001424
call fcn.14000207c
mov r14, rax
jmp 0x140001427
xor r14d, r14d
mov r8, rsi
mov qword [rbp + 0x50], rsi
lea rdx, [r15 + 5]
mov qword [rbp + 0x58], rdi
mov rcx, r14
call fcn.1400031a0
mov byte [r14 + rsi], 0
mov qword [rbp + 0x40], r14
mov eax, dword [0x140013338]
lea r9, [rbp + 0x40]
movsd xmm0, qword [str.TINI:launcher:]
lea r8, [rbp + 0x20]
mov dword [rbp + 0x28], eax
lea rcx, [rbp]
movzx eax, word [0x14001333c]
movzx edx, bl
mov word [rbp + 0x2c], ax
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], 0xe
movsd qword [rbp + 0x20], xmm0
mov byte [rbp + 0x2e], 0
call fcn.140001930
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400014cb
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000177e
call fcn.1400020b8
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140001506
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001501
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000177e
call fcn.1400020b8
cmp qword [rbp + 0x18], 0x10
lea r9, [rbp]
mov rdi, qword [rbp + 0x10]
cmovae r9, qword [rbp]
mov qword [rbp + 0x38], 0xf
mov qword [rbp + 0x30], 4
mov dword [rbp + 0x20], edi
mov byte [rbp + 0x24], 0
cmp rdi, 0xb
ja 0x140001557
lea rax, [rdi + 4]
mov r8, rdi
mov rdx, r9
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x24]
call fcn.1400031a0
lea rax, [rbp + 0x20]
mov byte [rbp + rdi + 0x24], 0
jmp 0x14000156b
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.1400017a0
movups xmm0, xmmword [rax]
xor r14d, r14d
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov byte [rax], r14b
mov qword [rax + 0x18], 0xf
mov rdx, qword [rbp + 0x18]
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp + 0x40], xmm1
cmp rdx, 0x10
jb 0x1400015cf
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001778
call fcn.1400020b8
movups xmm0, xmmword [rbp - 0x80]
movups xmm1, xmmword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
cmp rdx, 0x10
jb 0x140001612
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000160d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001778
call fcn.1400020b8
cmp qword [rbp + 0x18], 0x10
lea rdx, [rbp]
mov rdi, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
cmovae rdx, qword [rbp]
mov rcx, rdi
mov r8d, dword [rbp + 0x10]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140001686
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001677
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000177e
call fcn.1400020b8
jmp 0x140001686
mov rdi, qword [rsp + 0x60]
xor r14d, r14d
mov rax, qword [rbp + 0x78]
cmp rax, 0x10
jb 0x1400016c2
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400016ba
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001790
mov rcx, r12
call fcn.1400020b8
mov rcx, qword [rsp + 0x68]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140001140
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140001730
mov rcx, qword [rbp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000172b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001766
call fcn.1400020b8
mov rcx, qword [rbp + 0x10a0]
xor rcx, rsp
call fcn.1400021c0
lea r11, [rsp + 0x11b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001c50
int3
call fcn.14000429c
int3
call fcn.140001c30
int3
call fcn.140001c30
int3
call fcn.14000429c
int3
call fcn.14000429c
int3
call fcn.140001c50
int3
call fcn.140001c70
int3
call fcn.14000429c
int3