Function at 0x14005cfe0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1401be040]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x58], rcx
xor esi, esi
mov r14d, esi
mov dword [rsp + 0x50], esi
mov dword [rbp - 0x38], 0x18
mov qword [rbp - 0x30], rsi
mov dword [rbp - 0x28], 1
xor r9d, r9d
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
je 0x14005d102
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
movups xmmword [rbp + 0x14], xmm1
movups xmmword [rbp + 0x24], xmm1
mov dword [rbp + 0x34], eax
mov dword [rbp - 0x20], 0x68
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
psrldq xmm1, 8
movd eax, xmm1
bts eax, 8
mov dword [rbp + 0x1c], eax
cmp qword [rbx + 0x18], 0xf
jbe 0x14005d0aa
mov rbx, qword [rbx]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14005d127
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rdi
call fcn.1400377e0
jmp 0x14005d6b1
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], sil
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x70]
mov r8d, 0x7f
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005d1de
nop dword [rax]
mov eax, dword [rbp + 0x70]
test eax, eax
je 0x14005d1de
cmp rax, 0x80
jae 0x14005d6ea
mov byte [rbp + rax + 0x180], 0
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14005d1a0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x50]
call fcn.140062620
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x70]
mov r8d, 0x7f
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14005d170
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbp + 0x50]
mov r12, qword [rbp + 0x50]
mov r13, qword [rbp + 0x68]
cmp r13, 0xf
cmova rbx, r12
mov rsi, qword [rbp + 0x60]
cmp rsi, 0xc
jb 0x14005d263
lea r15, [rsi + rbx]
lea r8, [r15 - 0xb]
sub r8, rbx
mov rcx, rbx
mov edx, 0x53
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14005d263
movabs rcx, 0x754e6c6169726553
cmp qword [rax], rcx
jne 0x14005d24f
cmp dword [rax + 8], 0x7265626d
je 0x14005d25e
inc rax
lea r8, [r15 - 0xb]
sub r8, rax
mov rcx, rax
jmp 0x14005d228
sub rax, rbx
jmp 0x14005d26a
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x14005d32c
lea rcx, [rax + 0xd]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
cmp rsi, rcx
jb 0x14005d6f0
sub rsi, rcx
mov r8, 0xffffffffffffffff
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0x50]
cmp r13, 0xf
cmova rdx, r12
add rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.1400377e0
mov r14d, 8
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14005d302
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d2fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d666
call fcn.140072c30
movups xmm2, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x50], xmm2
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r13, xmm0
movq rsi, xmm1
movq r12, xmm2
lea r15, [rbp + 0x50]
cmp r13, 0xf
cmova r15, r12
lea rbx, str.__n_r_t
test rsi, rsi
je 0x14005d39e
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
lea rdi, [0x1401acb18]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x80], 1
inc rcx
cmp rcx, rdi
jne 0x14005d362
lea rcx, [rsi + r15]
mov rdx, r15
cmp r15, rcx
mov rdi, qword [rbp - 0x68]
jae 0x14005d39e
movzx eax, byte [rdx]
cmp byte [rbp + rax + 0x80], 0
je 0x14005d45f
inc rdx
cmp rdx, rcx
jb 0x14005d385
mov rdx, 0xffffffffffffffff
cmp rsi, rdx
cmovb rdx, rsi
lea rcx, [rbp + 0x50]
cmp r13, 0xf
cmova rcx, r12
sub rsi, rdx
lea r8, [rsi + 1]
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x60], rsi
lea r15, [rbp + 0x50]
mov r12, qword [rbp + 0x50]
mov r13, qword [rbp + 0x68]
cmp r13, 0xf
cmova r15, r12
test rsi, rsi
je 0x14005d467
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1401acb18]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rbp + rax + 0x80], 1
inc rbx
cmp rbx, rcx
jne 0x14005d410
lea rax, [rsi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, r15
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x80], 0
je 0x14005d45a
cmp rcx, r15
je 0x14005d467
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x80], 0
jne 0x14005d445
sub rcx, r15
jmp 0x14005d46e
sub rdx, r15
jmp 0x14005d3a5
mov rcx, 0xffffffffffffffff
inc rcx
cmp rsi, rcx
jb 0x14005d6f0
mov qword [rbp + 0x60], rcx
lea rax, [rbp + 0x50]
cmp r13, 0xf
cmova rax, r12
mov byte [rax + rcx], 0
mov rsi, qword [rbp + 0x60]
xorps xmm0, xmm0
test rsi, rsi
jne 0x14005d4cd
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, 7
lea rdx, str.Unknown
lea rcx, [rsp + 0x58]
call fcn.1400377e0
lea rax, [rsp + 0x58]
or r14d, 2
jmp 0x14005d5ad
movups xmmword [rsp + 0x78], xmm0
lea r15, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r15, qword [rbp + 0x50]
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x14005d6de
cmp rsi, 0xf
ja 0x14005d513
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], 0xf
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x78], xmm0
jmp 0x14005d5a4
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x14005d54f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140072e78
mov rcx, rax
test rax, rax
je 0x14005d666
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14005d588
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14005d56b
xor eax, eax
jmp 0x14005d588
cmp rcx, 0x1000
jb 0x14005d583
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005d6e4
jmp 0x14005d52d
call fcn.140072e78
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
or r14d, 4
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r14d, 1
test r14b, 4
je 0x14005d62c
and r14d, 0xfffffffb
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14005d62c
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d626
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072c30
nop
test r14b, 2
je 0x14005d673
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14005d673
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d66d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d66d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072c30
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14005d6b1
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d6ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d6ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140072c30
mov rax, rdi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140072850
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140033e80
nop
call fcn.140024b00
int3
call fcn.140072a98
int3
call fcn.140040440
int3