Function at 0x140091530
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1d90
call fcn.1400ae240
sub rsp, rax
mov rax, qword [0x1400c1008]
xor rax, rsp
mov qword [rsp + 0x1d80], rax
mov qword [rsp + 0x68], r9
mov r12, r8
mov r13, rdx
mov rbx, rcx
mov r15, qword [rsp + 0x1df0]
mov qword [rsp + 0x60], r15
mov rsi, qword [rsp + 0x1e00]
xor edi, edi
mov dword [rsp + 0x140], edi
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x180]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x7f8
lea rcx, [rsp + 0xd80]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x150], rdi
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x980]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x580]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x144], edi
mov dword [rsp + 0x158], 1
xor eax, eax
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x148], edi
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
movups xmmword [rsp + 0x110], xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
xor edx, edx
mov r8d, 0x7f8
lea rcx, [rsp + 0x1580]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0xa8], rdi
mov r14d, edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
test rbx, rbx
je 0x140091de4
test r12, r12
je 0x140091de4
cmp qword [rsp + 0x1df8], rdi
je 0x140091de4
test r15, r15
je 0x140091de4
test rsi, rsi
je 0x140091de4
mov r15, qword [rsp + 0x1e20]
test r15, r15
je 0x140091de4
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, r12
mov r8d, 0x3fc
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp eax, 0x2a
je 0x140091732
test eax, eax
je 0x140091732
cmp eax, 0x50
je 0x140091732
xor r13d, r13d
jmp 0x140091de7
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x580]
call fcn.14008e250
cmp eax, 1
jne 0x140091754
xor r13d, r13d
jmp 0x140091de7
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov r8d, 0x3fc
lea rdx, [rsp + 0x980]
lea rcx, [rsp + 0x150]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
cmp eax, 0x2a
je 0x140091792
test eax, eax
je 0x140091792
cmp eax, 0x50
je 0x140091792
xor r13d, r13d
jmp 0x140091de7
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x980]
call fcn.14008e250
cmp eax, 1
jne 0x1400917b4
xor r13d, r13d
jmp 0x140091de7
mov r9, rbx
lea r8, [0x1400fff48]
mov edx, 0x3fc
lea rcx, [rsp + 0xd80]
call fcn.140001280
xor ecx, ecx
mov word [rsp + 0x1576], cx
cmp eax, 0xffffffff
jne 0x1400917e7
xor r13d, r13d
jmp 0x140091de7
lea rcx, [rsp + 0xd80]
call fcn.14008f500
cmp eax, 1
jne 0x140091801
xor r13d, r13d
jmp 0x140091de7
lea rax, [rsp + 0xd80]
mov edx, 0x3fc
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x1580]
test r13, r13
je 0x14009183a
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, str._s__s
call fcn.140001140
jmp 0x14009184b
mov qword [rsp + 0x20], rax
lea r9, [0x1400ffee8]
call fcn.140001140
xor r13d, r13d
mov word [rsp + 0x1d76], r13w
mov dword [rsp + 0xb0], 0x18
mov dword [rsp + 0xc0], 1
mov qword [rsp + 0xb8], r13
mov r9d, 0x9f6
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140091de7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x158]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x140091de7
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140091de7
mov r9d, 0x9f6
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140091de7
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140091de7
mov dword [rsp + 0xd0], WSACleanup
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x128], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x120], rax
or dword [rsp + 0x10c], 0x100
mov qword [rsp + 0x160], rcx
mov qword [rsp + 0x168], rax
mov qword [rsp + 0xa8], r13
mov r14d, r13d
mov dword [rsp + 0x50], r13d
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140091a4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140091de7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0xa8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140091de7
mov r8, qword [rsp + 0xa8]
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0xa8]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140091de7
mov r14d, 1
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r9, [rsp + 0x160]
xor edx, edx
mov r8d, 0x20002
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x138], rdi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80200
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1580]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140091de7
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
mov qword [rsp + 0x170], r15
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x178], rax
mov r9d, 0x493e0
xor r8d, r8d
lea rdx, [rsp + 0x170]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x140], eax
test eax, eax
je 0x140091b40
sub eax, 1
je 0x140091b81
cmp eax, 0x101
jne 0x140091de7
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140091b3b
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
jne 0x140091b81
jmp 0x140091de7
jmp 0x140091de7
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140091de2
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140091de7
xor edx, edx
mov r8d, 0x9f6
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x3fc
lea rcx, [rsp + 0x180]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x148]
mov r8d, 0x3fb
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov byte [rsp + 0x57b], r13b
mov r9, 0xffffffffffffffff
lea r8, [rsp + 0x180]
mov edx, 0x9f6
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
cmp ebx, 1
jne 0x140091c15
cmp dword [rsp + 0x148], r13d
jbe 0x140091c15
test eax, eax
je 0x140091ba0
mov byte [rsi + 0x9f5], r13b
mov ebx, r13d
mov dword [rsp + 0x54], ebx
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x144]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140091de7
cmp dword [rsp + 0x144], 0x103
jne 0x140091cd3
mov eax, ebx
inc ebx
mov dword [rsp + 0x54], ebx
cmp eax, 5
jae 0x140091c75
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140091c30
mov edx, dword [rsp + 0xa0]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
test eax, eax
je 0x140091de7
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x140], 0x103
jne 0x140091cce
mov edx, 1
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140091cd3
jmp 0x140091de7
jmp 0x140091de7
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140091cf6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x90], r13
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140091d19
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x98], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140091d36
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140091d59
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x80], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140091d72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140091d91
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140091de7
mov qword [rsp + 0x88], r13
cmp r14d, 1
jne 0x140091da8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r14d, r13d
mov dword [rsp + 0x50], r13d
test rdi, rdi
je 0x140091dcd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, r13
mov qword [rsp + 0x58], r13
test eax, eax
je 0x140091de7
mov eax, dword [rsp + 0x144]
mov rdx, qword [rsp + 0x60]
mov dword [rdx], eax
xor eax, eax
jmp 0x140091ed6
jmp 0x140091de7
xor r13d, r13d
nop
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x140091e03
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x90], r13
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140091e1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x98], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140091e33
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], r13
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140091e4e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x80], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140091e63
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140091e7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x88], r13
cmp r14d, 1
jne 0x140091e92
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov dword [rsp + 0x50], r13d
test rdi, rdi
je 0x140091eb0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x58], r13
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140091ec3
mov ecx, dword [rsp + 0x144]
mov dword [rdx], ecx
mov eax, 1
jmp 0x140091ed6
mov rcx, qword [rsp + 0x1d80]
xor rcx, rsp
call fcn.140001ea0
add rsp, 0x1d90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret