Function at 0x14004d0d0
Capabilities:
Create pipe
Create process on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x140158010]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, r9
mov rbx, r8
mov esi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.1400c53e0
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov edi, r15d
test r14, r14
setne dil
test r14, r14
je 0x14004d1d8
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rbp - 0x60], 1
mov qword [rbp - 0x68], r15
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreatePipe]
test eax, eax
jne 0x14004d1ae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x14004d4ab
movzx eax, ax
or eax, 0x80070000
jmp 0x14004d4ab
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
test eax, eax
je 0x14004d193
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
or dword [rbp - 0x14], 0x100
lea rcx, [rbp + 0x30]
call fcn.14004c090
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x14004d252
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x30]
mov r8d, 0x23e1
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_CreateProcess_szCmd_s_bGetProcessConsoleOutput_d_GetLastError_d
call fcn.14005dbf0
xor eax, eax
jmp 0x14004d4ab
test esi, esi
je 0x14004d266
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x14004d279
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14, r14
je 0x14004d4a6
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x14004d4e2
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], r15d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov edi, eax
test eax, eax
js 0x14004d4ed
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004d2f1
mov edx, edi
lea rcx, [rbp + 0x20]
call fcn.14000c060
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x14004d34c
mov r8d, 0x23fa
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_PRINT_ON_FALSE
call fcn.14005dbf0
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004d345
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004d4ab
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x14004d4d7
cmp eax, dword [rbx - 0xc]
jg 0x14004d4d7
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov edi, 0xffffffff
test r14, r14
je 0x14004d46e
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14004d3a4
cmp rax, qword [rbx - 0x18]
jne 0x14004d3a4
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x14004d3db
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14004d4d1
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
mov r8, rbx
lea rcx, [rsi + 0x18]
mov r9, rdx
call fcn.14000cd60
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140055100
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r14]
sub rbx, 0x18
cmp rcx, rbx
je 0x14004d44c
cmp dword [rbx + 0x10], 0
jl 0x14004d43f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004d43f
call fcn.140006b40
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004d436
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14004d44c
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.1400048e0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d46a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004d47e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004d48f
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004d4a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400beb20
mov rbx, qword [rsp + 0x588]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004840
nop
mov ecx, 0x80070057
call fcn.140004fd0
nop
mov ecx, 0x80004005
call fcn.140004fd0
nop
mov ecx, 0x80070057
call fcn.140004fd0
int3