Function at 0x140001ae0
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Read file on windows
Terminate process

Disassembly:
push rbp
push r12
push r13
push r14
lea rbp, [rsp - 0x478]
sub rsp, 0x578
mov r12, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x401
call fcn.140017850
xor r13d, r13d
mov qword [rsp + 0x68], 0xf
xorps xmm0, xmm0
mov qword [rsp + 0x60], r13
movups xmmword [rsp + 0x50], xmm0
xor r9d, r9d
mov byte [rsp + 0x50], r13b
lea r8, [rbp - 0x78]
mov qword [rsp + 0x78], r13
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x80], r13
lea rcx, [rsp + 0x78]
mov qword [rbp + 0x4b8], r13
mov qword [rsp + 0x70], r13
mov dword [rbp - 0x78], 0x18
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x68], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x18], rax
mov rdx, r14
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x10], rax
xor eax, eax
cmp qword [r14 + 0x18], 0x10
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 4], 0x100
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x50], rax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp - 0x60], xmm0
jb 0x140001bd8
mov rdx, qword [r14]
mov qword [rsp + 0x5a0], rbx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x570], rsi
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r13
xor ecx, ecx
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x568], rdi
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x560], r15
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001ccc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Create_Process_Failed_:__d
call fcn.140002250
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001c8b
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c86
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020cd
call fcn.140013f58
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x140001cc5
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140001cc0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400020cd
mov rcx, r8
call fcn.140013f58
xor eax, eax
jmp 0x14000208f
mov rcx, qword [rbp - 0x60]
mov edx, 0xbb8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4b8]
lea r9, [rbp + 0x4b0]
mov r8d, 0x400
mov dword [rbp + 0x4b0], r13d
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x140001dd9
mov eax, dword [rbp + 0x4b0]
mov rbx, 0xffffffffffffffff
mov byte [rbp + rax + 0x50], r13b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r13b
jne 0x140001d46
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140001d94
cmp rdx, 0x10
lea rax, [rbx + rcx]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x60], rax
cmovae rdi, qword [rsp + 0x50]
lea rdx, [rbp + 0x50]
add rdi, rcx
mov r8, rbx
mov rcx, rdi
call fcn.140017ef0
mov byte [rdi + rbx], r13b
jmp 0x140001dad
lea r9, [rbp + 0x50]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140001580
mov rcx, qword [rbp + 0x4b8]
lea r9, [rbp + 0x4b0]
mov r8d, 0x400
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x140001d30
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov edi, r13d
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
test rbx, rbx
je 0x140001eab
mov rsi, r13
nop
cmp rdx, 0x10
lea rax, [rsp + 0x50]
cmovae rax, rcx
cmp byte [rsi + rax], 0x7f
jbe 0x140001e9a
cmp rdx, 0x10
lea rax, [rsp + 0x50]
cmovae rax, rcx
lea rcx, [0x14003f530]
movzx edx, byte [rsi + rax]
call fcn.140002250
mov rbx, qword [rsp + 0x60]
movsxd r9, edi
cmp rbx, r9
jb 0x1400020df
mov rax, rbx
lea rcx, [rsp + 0x50]
sub rax, r9
mov edx, 1
cmp rax, rdx
cmovb rdx, rax
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
sub rbx, rdx
add rcx, r9
mov r8, rbx
sub r8, r9
add rdx, rcx
inc r8
call fcn.140017ef0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
inc edi
inc rsi
movsxd rax, edi
cmp rax, rbx
jb 0x140001e10
cmp rdx, 0x10
lea r15, [rsp + 0x50]
movabs rdi, 0x7fffffffffffffff
cmovae r15, rcx
cmp rbx, rdi
ja 0x1400020d9
cmp rbx, 0x10
jae 0x140001edb
mov rsi, qword [r15]
mov edi, 0xf
jmp 0x140001f24
mov rax, rbx
or rax, 0xf
cmp rax, rdi
ja 0x140001ef6
mov ecx, 0x16
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x30]
call fcn.140002150
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
mov rsi, rax
call fcn.140017ef0
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp rdi, 0x10
jb 0x140001f6a
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001f53
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020cd
mov rcx, rsi
call fcn.140013f58
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov qword [r12], rbx
test rbx, rbx
jne 0x140001fbe
cmp rdx, 0x10
jb 0x140001fa6
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fa1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020cd
call fcn.140013f58
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r13b
jmp 0x140001c8b
movsxd rsi, dword [rsp + 0x60]
lea rdi, [rsp + 0x50]
cmp rdx, 0x10
cmovae rdi, rcx
lea eax, [rsi + 1]
movsxd r15, eax
mov rcx, r15
call fcn.14001ce38
mov rbx, rax
test rax, rax
jne 0x140001feb
mov rbx, r13
jmp 0x140002006
mov r8, r15
xor edx, edx
mov rcx, rbx
call fcn.140017850
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140017ef0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140002043
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000203e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400020d3
call fcn.140013f58
mov rdx, qword [r14 + 0x18]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r13b
cmp rdx, 0x10
jb 0x14000208c
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140002087
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400020d3
mov rcx, r8
call fcn.140013f58
mov rax, rbx
mov r15, qword [rsp + 0x560]
mov rdi, qword [rsp + 0x568]
mov rsi, qword [rsp + 0x570]
mov rbx, qword [rsp + 0x5a0]
mov byte [r14], r13b
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r13
add rsp, 0x578
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001d24c
int3
call fcn.14001d24c
int3
call fcn.140002110
int3
call fcn.140002130
int3