Function at 0x140016540
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x1400691d8]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rdx
mov rbx, rcx
xor sil, sil
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
mov dword [rbp + 0x24], eax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x40], 0x68
mov dword [rbp - 0x60], 0x18
mov dword [rbp - 0x50], 1
xor r14d, r14d
mov qword [rbp - 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov qword [rbp - 0x68], r14
mov qword [rsp + 0x78], r14
mov r9d, 0x1000
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140016609
mov r9d, 0x1000
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14001660f
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140016651
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140016651
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
or dword [rbp - 4], 0x100
jmp 0x140016665
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Unbale_to_set_security_attributes_to_pipe_handle:__d__r_n
call fcn.14000f680
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0xc
jb 0x140016c90
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001668d
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xc
lea r9, str.cmd.exe__C__
mov r8, rbx
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140010860
nop
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x48]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1400166f8
lea rcx, [rdx + 1]
mov qword [rbp + 0x40], rcx
lea rax, [rbp + 0x30]
cmp r8, 8
cmovae rax, qword [rbp + 0x30]
mov r8d, 0x22
mov word [rax + rdx*2], r8w
mov word [rax + rcx*2], r14w
lea rax, [rbp + 0x30]
jmp 0x140016716
mov qword [rsp + 0x20], 1
lea r9, [0x14005bb24]
mov edx, 1
lea rcx, [rbp + 0x30]
call fcn.1400075a0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140016790
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001678b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016c96
call fcn.140025900
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r14w
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Launching_command__s
call fcn.14000f680
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 8
cmovae rdx, qword [rbp + 0x90]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001685b
mov edx, 0xea60
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x70]
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Return_value_:__d
call fcn.14000f680
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x54], r14d
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1400168d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Unable_to_peek_pipe__d
call fcn.14000f680
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor sil, sil
jmp 0x140016bc9
mov ebx, dword [rsp + 0x54]
test ebx, ebx
je 0x140016b95
add ebx, ebx
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov edi, ebx
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp + 0x30]
call fcn.14001d050
nop
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x58]
mov r8d, ebx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x58]
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Reading_output_buffer._Amount_read:__d__Amount_avaliable:__d
call fcn.14000f680
test ebx, ebx
je 0x140016b5a
cmp dword [rsp + 0x58], 0
je 0x140016b5a
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.14001d1c0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r14w
xor r8d, r8d
mov edx, edi
lea rcx, [rbp + 0x50]
call fcn.140006c60
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call fcn.140022170
mov rbx, rax
lea rax, [rbp + 0x50]
cmp rax, rbx
je 0x140016a25
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x1400169f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400169f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016c9c
call fcn.140025900
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140016a6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016a66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016c9c
call fcn.140025900
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r14w
mov r8d, 5
lea rdx, str.ERROR
lea rcx, [rbp + 0xb0]
call fcn.140006e00
nop
xor r8d, r8d
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x50]
call fcn.140021270
cmp rax, 0xffffffffffffffff
sete bl
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140016b06
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016ca2
call fcn.140025900
test bl, bl
je 0x140016b19
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Shedule_task_created
call fcn.14000f680
mov sil, 1
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x140016b5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016ca8
call fcn.140025900
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140016b95
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016b90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016cae
call fcn.140025900
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdx, qword [rbp + 0x70]
lea rcx, str.InstallManagerApp.exe:IsScheduleTaskCreated_Output_from_launched_command:__n_hs
call fcn.14000f680
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140016c07
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016c02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016cb4
call fcn.140025900
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x140016c5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016c5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016c8a
call fcn.140025900
movzx eax, sil
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1400258e0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14002e1d4
int3
call fcn.1400036c0
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
int3
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
nop
call fcn.14002e1d4
int3