Function at 0x14000348e
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x580], rcx
mov qword [rbp + 0x588], rdx
lea rax, [rbp + 0x490]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x490], 0x18
mov dword [rbp + 0x4a0], 1
mov qword [rbp + 0x498], 0
lea rcx, [rbp + 0x490]
lea rdx, [rbp + 0x4a8]
lea rax, [rbp + 0x4b0]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
sete al
test al, al
je 0x140003584
lea rax, [rbp + 0x4bf]
mov qword [rbp + 0x548], rax
nop
nop
lea rax, [rbp + 0x4c0]
mov r8d, edi
lea rdx, str.CreatePipe___failed_n
mov rcx, rax
call sym._ZN11xorstr_impl6stringILy20ELi20EEC1IJLy0ELy1ELy2ELy3ELy4ELy5ELy6ELy7ELy8ELy9ELy10ELy11ELy12ELy13ELy14ELy15ELy16ELy17ELy18ELy
lea rax, [rbp + 0x4c0]
mov rcx, rax
call method.xorstr_impl::string_20ull__20_.decrypt__
mov rdx, rax
lea rcx, [rbp + 0x4bf]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
nop
lea rax, [rbp + 0x4bf]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
jmp 0x140003888
mov rax, qword [rbp + 0x4b0]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
test eax, eax
sete al
test al, al
je 0x140003614
lea rax, [rbp + 0x4df]
mov qword [rbp + 0x540], rax
nop
nop
lea rax, [rbp + 0x4e0]
mov r8d, esi
lea rdx, str.SetHandleInformation___failed_n
mov rcx, rax
call sym._ZN11xorstr_impl6stringILy30ELi21EEC1IJLy0ELy1ELy2ELy3ELy4ELy5ELy6ELy7ELy8ELy9ELy10ELy11ELy12ELy13ELy14ELy15ELy16ELy17ELy18ELy
lea rax, [rbp + 0x4e0]
mov rcx, rax
call method.xorstr_impl::string_30ull__21_.decrypt__
mov rdx, rax
lea rcx, [rbp + 0x4df]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
nop
lea rax, [rbp + 0x4df]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
jmp 0x140003888
lea rax, [rbp + 0x400]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x400], 0x68
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x460], rax
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x458], rax
mov eax, dword [rbp + 0x43c]
or ah, 1
mov dword [rbp + 0x43c], eax
mov rax, qword [rbp + 0x588]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp + 0x470]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x400]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x14000373b
lea rax, [rbp + 0x50f]
mov qword [rbp + 0x538], rax
nop
nop
lea rax, [rbp + 0x510]
mov r8d, ebx
lea rdx, str.CreateProcess___failed_n
mov rcx, rax
call sym._ZN11xorstr_impl6stringILy23ELi22EEC1IJLy0ELy1ELy2ELy3ELy4ELy5ELy6ELy7ELy8ELy9ELy10ELy11ELy12ELy13ELy14ELy15ELy16ELy17ELy18ELy
lea rax, [rbp + 0x510]
mov rcx, rax
call method.xorstr_impl::string_23ull__22_.decrypt__
mov rdx, rax
lea rcx, [rbp + 0x50f]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
nop
lea rax, [rbp + 0x50f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
jmp 0x140003888
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400baa80
jmp 0x140003773
mov eax, dword [rbp - 4]
mov ecx, eax
mov rdx, rbp
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.append_char_const__unsigned_long_long_
mov rax, qword [rbp + 0x4b0]
lea rcx, [rbp - 4]
mov rdx, rbp
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x1400037b1
mov eax, dword [rbp - 4]
test eax, eax
je 0x1400037b1
mov eax, 1
jmp 0x1400037b6
mov eax, 0
test al, al
jne 0x14000375c
mov rax, qword [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x4b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x580]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x140003888
mov rax, qword [rbp + 0x580]
add rsp, 0x5d8
pop rbx
pop rsi
pop rdi
pop rbp
ret