Function at 0x140079650
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d90
call fcn.14009f130
sub rsp, rax
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x1d80], rax
mov qword [rsp + 0x68], r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
mov r15, qword [rsp + 0x1df0]
mov qword [rsp + 0x60], r15
mov rsi, qword [rsp + 0x1e00]
xor edi, edi
mov dword [rsp + 0x140], edi
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x180]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x7f8
lea rcx, [rsp + 0xd80]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x150], rdi
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x980]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x580]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x144], edi
mov dword [rsp + 0x158], 1
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x148], edi
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
xor edx, edx
mov r8d, 0x7f8
lea rcx, [rsp + 0x1580]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0xa8], rdi
mov r14d, edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
test rbx, rbx
je 0x140079f04
test r12, r12
je 0x140079f04
cmp qword [rsp + 0x1df8], rdi
je 0x140079f04
test r15, r15
je 0x140079f04
test rsi, rsi
je 0x140079f04
mov r15, qword [rsp + 0x1e20]
test r15, r15
je 0x140079f04
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, r12
mov r8d, 0x3fc
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp eax, 0x2a
je 0x140079852
test eax, eax
je 0x140079852
cmp eax, 0x50
je 0x140079852
xor r13d, r13d
jmp 0x140079f07
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x580]
call fcn.140075ef0
cmp eax, 1
jne 0x140079874
xor r13d, r13d
jmp 0x140079f07
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov r8d, 0x3fc
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp eax, 0x2a
je 0x1400798b2
test eax, eax
je 0x1400798b2
cmp eax, 0x50
je 0x1400798b2
xor r13d, r13d
jmp 0x140079f07
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x980]
call fcn.140075ef0
cmp eax, 1
jne 0x1400798d4
xor r13d, r13d
jmp 0x140079f07
mov r9, rbx
lea r8, [0x1400f3864]
mov edx, 0x3fc
lea rcx, [rsp + 0xd80]
call fcn.140001280
xor ecx, ecx
mov word [rsp + 0x1576], cx
cmp eax, 0xffffffff
jne 0x140079907
xor r13d, r13d
jmp 0x140079f07
lea rcx, [rsp + 0xd80]
call fcn.140077540
cmp eax, 1
jne 0x140079921
xor r13d, r13d
jmp 0x140079f07
lea rax, [rsp + 0xd80]
mov edx, 0x3fc
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x1580]
test r13, r13
je 0x14007995a
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str._s__s
call fcn.140001140
jmp 0x14007996b
mov qword [rsp + 0x20], rax
lea r9, [0x1400f381c]
call fcn.140001140
xor r13d, r13d
mov word [rsp + 0x1d76], r13w
mov dword [rsp + 0xb0], 0x18
mov dword [rsp + 0xc0], 1
mov qword [rsp + 0xb8], r13
mov r9d, 0x9f6
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140079f07
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x140079f07
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140079f07
mov r9d, 0x9f6
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140079f07
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140079f07
mov dword [rsp + 0xd0], WSACleanup
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x128], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x120], rax
or dword [rsp + 0x10c], 0x100
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], rax
mov qword [rsp + 0xa8], r13
mov r14d, r13d
mov dword [rsp + 0x50], r13d
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140079b6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140079f07
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0xa8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140079f07
mov r8, qword [rsp + 0xa8]
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140079f07
mov r14d, 1
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x160]
xor edx, edx
mov r8d, 0x20002
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x138], rdi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80200
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1580]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140079f07
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
mov qword [rsp + 0x170], r15
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x178], rax
mov r9d, 0x493e0
xor r8d, r8d
lea rdx, [rsp + 0x170]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x140], eax
test eax, eax
je 0x140079c60
sub eax, 1
je 0x140079ca1
cmp eax, 0x101
jne 0x140079f07
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140079c5b
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x140079ca1
jmp 0x140079f07
jmp 0x140079f07
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140079f02
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140079f07
xor edx, edx
mov r8d, 0x9f6
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x180]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x148]
mov r8d, 0x3fb
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov byte [rsp + 0x57b], r13b
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x180]
mov edx, 0x9f6
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
cmp ebx, 1
jne 0x140079d35
cmp dword [rsp + 0x148], r13d
jbe 0x140079d35
test eax, eax
je 0x140079cc0
mov byte [rsi + 0x9f5], r13b
mov ebx, r13d
mov dword [rsp + 0x54], ebx
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x144]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140079f07
cmp dword [rsp + 0x144], 0x103
jne 0x140079df3
mov eax, ebx
inc ebx
mov dword [rsp + 0x54], ebx
cmp eax, 5
jae 0x140079d95
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140079d50
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140079f07
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140079dee
mov edx, 1
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140079df3
jmp 0x140079f07
jmp 0x140079f07
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140079e16
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x90], r13
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140079e39
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x98], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140079e56
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140079e79
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x80], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140079e92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140079eb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140079f07
mov qword [rsp + 0x88], r13
cmp r14d, 1
jne 0x140079ec8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r14d, r13d
mov dword [rsp + 0x50], r13d
test rdi, rdi
je 0x140079eed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, r13
mov qword [rsp + 0x58], r13
test eax, eax
je 0x140079f07
mov eax, dword [rsp + 0x144]
mov rdx, qword [rsp + 0x60]
mov dword [rdx], eax
xor eax, eax
jmp 0x140079ff6
jmp 0x140079f07
xor r13d, r13d
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140079f23
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x90], r13
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140079f3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140079f53
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140079f6e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140079f83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140079f9e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], r13
cmp r14d, 1
jne 0x140079fb2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov dword [rsp + 0x50], r13d
test rdi, rdi
je 0x140079fd0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x58], r13
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140079fe3
mov ecx, dword [rsp + 0x144]
mov dword [rdx], ecx
mov eax, 1
jmp 0x140079ff6
mov rcx, qword [rsp + 0x1d80]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x1d90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret