Function at 0x140002665
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
xor r12d, r12d
xor r9d, r9d
mov eax, r12d
mov rbp, rdx
lea rdx, [rsp + 0x6c]
mov rsi, rcx
mov ecx, 5
mov rdi, rdx
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x68], 0x18
rep stosd dword [rdi], eax
lea rbx, [rsp + 0x53f]
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x58]
and rbx, 0xffffffffffffffe0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000273a
movabs rax, 0x6c5e398e6426823c
movabs rdx, 0x50e5cfa0543f07f
mov qword [rbx + 0x20], rax
movabs rax, 0xf3ba34a32c4f48e8
mov qword [rbx], rdx
movabs rdx, 0x9adb528305672d98
mov qword [rbx + 0x28], rax
movabs rax, 0x6c088d34db1dff85
mov qword [rbx + 8], rdx
movabs rdx, 0x6c088d34d1799ae9
mov qword [rbx + 0x30], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm1, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm1, ymmword [rbx]
jmp 0x1400028cb
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400027ce
movabs rax, 0x696a329b4d37952c
mov qword [rbx + 0x20], rax
movabs rax, 0xfbb620ec630964fd
mov qword [rbx + 0x28], rax
movabs rax, 0xa28a41cbf16f39d
mov qword [rbx + 0x30], rax
movabs rax, 0x4a4e71913676f76b
mov qword [rbx + 0x38], rax
vmovdqa ymm2, ymmword [rbx + 0x20]
movabs rax, 0x50e5cfa0543f07f
mov qword [rbx], rax
movabs rax, 0x9adb528305672d98
mov qword [rbx + 8], rax
movabs rax, 0x6c088d34d1799ae9
mov qword [rbx + 0x10], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm2, ymmword [rbx]
jmp 0x1400028cb
lea rdx, [rsp + 0xbc]
mov eax, r12d
mov ecx, 0x15
xor r9d, r9d
mov rdi, rdx
lea r8, [rsp + 0xb8]
mov dword [rsp + 0xb8], 0x68
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rbp]
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400028e1
movabs rax, 0x775e398e6426823c
movabs rdx, 0x50e5cfa0543f07f
mov qword [rbx + 0x20], rax
movabs rax, 0xbaf27af076024ef7
mov qword [rbx], rdx
movabs rdx, 0x9adb528305672d98
mov qword [rbx + 0x28], rax
movabs rax, 0x6c02e951bd10fb8f
mov qword [rbx + 8], rdx
movabs rdx, 0x6c088d34d1799ae9
mov qword [rbx + 0x30], rax
movabs rax, 0x4a4e7bf5531a9e0a
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm3, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm3, ymmword [rbx]
vmovdqa ymmword [rbx + 0x20], ymm0
lea rdx, [rbx + 0x20]
mov rcx, rsi
call fcn.14000188c
jmp 0x1400029a6
mov rcx, qword [rsp + 0x60]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r12, [rsp + 0x54]
lea rbp, [rsp + 0x120]
call rdi
lea rax, [rsp + 0xa8]
xor edx, edx
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x98], rax
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], rdx
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov r9, r12
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rdx, rbp
lea rbx, [rsp + 0x98]
call r13
test eax, eax
je 0x140002963
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x140002963
mov rdx, rbp
mov rcx, rbx
call fcn.1400052d0
jmp 0x140002925
mov rcx, qword [rsp + 0x80]
call rdi
mov rcx, qword [rsp + 0x88]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov rcx, rsi
mov rdx, rbx
call fcn.140005290
mov rcx, rbx
call fcn.1400052f0
jmp 0x1400029a6
mov rax, rsi
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret