Function at 0x140002629
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
xor r9d, r9d
mov rbp, rsp
push r14
push r13
xor r13d, r13d
push r12
mov eax, r13d
push rdi
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
mov ecx, 5
and rsp, 0xffffffffffffffe0
sub rsp, 0x550
lea rdx, [rsp + 0x84]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], 0x18
mov rdi, rdx
lea rdx, [rsp + 0x78]
lea r12, [rsp + 0xd0]
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x90], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000273d
movabs rax, 0xbd5d54d1f14d7586
movabs rdx, 0xd40d31a5902807c5
mov qword [rsp + 0xd0], rax
movabs rax, 0x9f4d0f188a69d86a
mov qword [rsp + 0x150], rdx
movabs rdx, 0xf62c6938a341bd1a
mov qword [rsp + 0xd8], rax
movabs rax, 0x959c96a7e20a4fab
mov qword [rsp + 0x158], rdx
movabs rdx, 0x959c96a7e86e2ac7
mov qword [rsp + 0xe0], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x160], rdx
mov qword [rsp + 0xe8], rax
vmovdqa ymm1, ymmword [rsp + 0xd0]
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm1, ymmword [rsp + 0x150]
jmp 0x1400027fa
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x14000280b
movabs rax, 0xb8695fc4d85c6296
mov qword [rsp + 0xd0], rax
movabs rax, 0x97411b57c52ff47f
mov qword [rsp + 0xd8], rax
movabs rax, 0xf3bcbf8f860143b3
mov qword [rsp + 0xe0], rax
movabs rax, 0xfcfd422eafdc8aa5
mov qword [rsp + 0xe8], rax
movabs rax, 0xd40d31a5902807c5
vmovdqa ymm2, ymmword [rsp + 0xd0]
mov qword [rsp + 0x150], rax
movabs rax, 0xf62c6938a341bd1a
mov qword [rsp + 0x158], rax
movabs rax, 0x959c96a7e86e2ac7
mov qword [rsp + 0x160], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm2, ymmword [rsp + 0x150]
vmovdqa ymmword [rsp + 0xd0], ymm0
mov rdx, r12
jmp 0x14000293d
mov eax, r13d
mov ecx, 0x15
xor r8d, r8d
xor r9d, r9d
lea rdx, [rsp + 0xd4]
mov rdi, rdx
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rsi]
lea rsi, [rsp + 0xb0]
mov dword [rsp + 0xd0], 0x68
mov dword [rsp + 0x10c], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000294a
movabs rax, 0xa65d54d1f14d7586
movabs rdx, 0xd40d31a5902807c5
mov qword [rsp + 0xb0], rax
movabs rax, 0xd605414bd024de75
mov qword [rsp + 0x150], rdx
movabs rdx, 0xf62c6938a341bd1a
mov qword [rsp + 0xb8], rax
movabs rax, 0x9596f2c284074ba1
mov qword [rsp + 0x158], rdx
movabs rdx, 0x959c96a7e86e2ac7
mov qword [rsp + 0xc0], rax
movabs rax, 0xfcfd484acab0e3c4
mov qword [rsp + 0x160], rdx
mov rdx, rsi
mov qword [rsp + 0xc8], rax
vmovdqa ymm3, ymmword [rsp + 0xb0]
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm3, ymmword [rsp + 0x150]
vmovdqa ymmword [rsp + 0xb0], ymm0
mov rcx, rbx
call fcn.14000181c
jmp 0x1400029f2
mov rcx, qword [rsp + 0x78]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r13, [rsp + 0x6c]
lea r12, [rsp + 0x150]
call rdi
lea rax, [rsp + 0xc0]
xor edx, edx
mov byte [rsp + 0xc0], 0
mov qword [rsp + 0xb0], rax
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xb8], rdx
xor eax, eax
mov rcx, qword [rsp + 0x70]
mov r9, r13
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rdx, r12
call r14
test eax, eax
je 0x1400029c4
mov r8d, dword [rsp + 0x6c]
test r8d, r8d
je 0x1400029c4
mov rdx, r12
mov rcx, rsi
call fcn.1400abad0
jmp 0x14000298e
mov rcx, qword [rsp + 0x98]
call rdi
mov rcx, qword [rsp + 0xa0]
call rdi
mov rcx, qword [rsp + 0x70]
call rdi
mov rcx, rbx
mov rdx, rsi
call fcn.1400ad2c0
mov rcx, rsi
call fcn.1400aa4a0
lea rsp, [rbp - 0x30]
mov rax, rbx
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret