Function at 0x14004e720
Capabilities:
Create pipe
Create process on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x14015b010]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, r9
mov rbx, r8
mov esi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.1400c71e0
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov edi, r15d
test r14, r14
setne dil
test r14, r14
je 0x14004e828
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rbp - 0x60], 1
mov qword [rbp - 0x68], r15
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreatePipe]
test eax, eax
jne 0x14004e7fe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x14004eafb
movzx eax, ax
or eax, 0x80070000
jmp 0x14004eafb
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
test eax, eax
je 0x14004e7e3
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
or dword [rbp - 0x14], 0x100
lea rcx, [rbp + 0x30]
call fcn.14004d6e0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x14004e8a2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x30]
mov r8d, 0x23e1
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_CreateProcess_szCmd_s_bGetProcessConsoleOutput_d_GetLastError_d
call fcn.14005f240
xor eax, eax
jmp 0x14004eafb
test esi, esi
je 0x14004e8b6
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x14004e8c9
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14, r14
je 0x14004eaf6
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x14004eb32
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], r15d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov edi, eax
test eax, eax
js 0x14004eb3d
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004e941
mov edx, edi
lea rcx, [rbp + 0x20]
call fcn.14000c110
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x14004e99c
mov r8d, 0x23fa
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_PRINT_ON_FALSE
call fcn.14005f240
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004e995
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004eafb
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x14004eb27
cmp eax, dword [rbx - 0xc]
jg 0x14004eb27
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov edi, 0xffffffff
test r14, r14
je 0x14004eabe
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14004e9f4
cmp rax, qword [rbx - 0x18]
jne 0x14004e9f4
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14004ea2b
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14004eb21
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
mov r8, rbx
lea rcx, [rsi + 0x18]
mov r9, rdx
call fcn.14000ce10
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140056750
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r14]
sub rbx, 0x18
cmp rcx, rbx
je 0x14004ea9c
cmp dword [rbx + 0x10], 0
jl 0x14004ea8f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004ea8f
call fcn.140006b40
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004ea86
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14004ea9c
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.1400048e0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004eaba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004eace
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004eadf
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004eaf6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400c0920
mov rbx, qword [rsp + 0x588]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004840
nop
mov ecx, 0x80070057
call fcn.140004fd0
nop
mov ecx, 0x80004005
call fcn.140004fd0
nop
mov ecx, 0x80070057
call fcn.140004fd0
int3