Function at 0x2291536f7
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
xor r15d, r15d
xor r12d, r12d
mov eax, r15d
mov r13, r8
lea r8, [rsp + 0x90]
mov rbx, rcx
mov ecx, 6
mov rdi, r8
mov dword [rsp + 0x478], edx
lea rdx, [rsp + 0x70]
rep stosd dword [rdi], eax
mov qword [rsp + 0x488], r9
lea rcx, [rsp + 0x68]
mov r9d, 0x100000
mov dword [rsp + 0x90], 0x18
mov dword [rsp + 0xa0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x229153b87
lea rsi, [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rdi, rsi
mov eax, r15d
mov ecx, 0x16
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x78]
mov ecx, 6
mov dword [rsp + 0xa8], 0x68
mov dword [rsp + 0xe4], 0x100
mov rdi, rbp
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], rax
call fcn.2291523f4
mov r12, rax
test rax, rax
je 0x229153b72
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea r15, [rax + 0x401]
lea rcx, [r15 + r15]
call fcn.229154520
mov r13, rax
test rax, rax
je 0x229153b67
lea rcx, [0x22915d610]
xor edi, edi
call fcn.2291551d0
mov r9, r12
mov rdx, r15
mov rcx, r13
mov r8, rax
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x218]
call fcn.229152340
mov r8, qword [rsp + 0x58]
mov rcx, r8
call fcn.229155252
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x48], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rdx, r13
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x229153b5c
mov rcx, qword [rsp + 0x78]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.2291535ee
mov dword [rsp + 0x60], 0
mov rbp, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov esi, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x229153904
cmp dword [rsp + 0x60], 0
jne 0x229153904
cmp edi, 0x33
je 0x229153904
mov ecx, 0x64
inc edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2291538c3
xor ebp, ebp
cmp dword [rsp + 0x60], 0
jne 0x229153957
test esi, esi
je 0x22915394a
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r15
call fcn.22915246d
mov r14, rax
test rax, rax
je 0x229153940
mov rcx, rax
call sub.msvcrt.dll_strlen
add eax, 3
mov dword [rsp + 0x60], eax
jmp 0x229153952
mov dword [rsp + 0x60], 1
jmp 0x229153952
mov dword [rsp + 0x60], 0x14
mov ebp, 1
mov eax, dword [rsp + 0x60]
lea ecx, [rax + 1]
call fcn.229154520
mov rdi, rax
test rax, rax
je 0x229153b37
test ebp, ebp
je 0x2291539c4
test esi, esi
je 0x2291539a0
test r14, r14
je 0x2291539e5
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rdi
lea rdx, [0x22915d635]
call sub.msvcrt.dll_strcat
mov rcx, r14
call fcn.229154578
jmp 0x2291539e5
lea rcx, [0x22915d638]
call fcn.229155150
mov rcx, rdi
mov r14, rax
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call fcn.229155252
jmp 0x2291539e5
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
inc rcx
add rcx, rcx
call fcn.229154520
mov r14, rax
test rax, rax
je 0x229153b2c
mov eax, dword [rsp + 0x60]
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x20], r14
inc eax
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r14
call fcn.22915235d
mov r15, rax
test rax, rax
je 0x229153b21
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x229153a46
xor esi, esi
jmp 0x229153b16
add rcx, 0x201
add rcx, rcx
call fcn.229154520
mov rsi, rax
test rax, rax
je 0x229153a3f
mov eax, dword [rbx]
mov rcx, r15
mov dword [rsi + 4], eax
mov eax, dword [rbx + 4]
mov dword [rsi + 8], eax
movabs rax, 0x400000002
mov qword [rsi + 0xc], rax
mov eax, dword [rsp + 0x478]
mov dword [rsi + 0x14], eax
call sub.msvcrt.dll_strlen
lea rcx, [rsi + 0x24]
mov rdx, r15
mov r8d, eax
call fcn.229151483
mov dword [rsi + 0x18], 0x24
xor r8d, r8d
lea rcx, [rsi + 4]
mov dword [rsi + 0x1c], eax
lea edx, [rax + 3]
and edx, 0xfffffffc
lea eax, [rdx + 0x24]
add edx, 0x20
mov dword [rsp + 0x60], eax
call fcn.229151de0
cmp dword [rsp + 0x490], 0
mov dword [rsi], eax
je 0x229153b08
mov rcx, qword [rsp + 0x488]
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x488]
lea rcx, [rsp + 0x116]
mov r8, rax
mov qword [rsp + 0x58], rcx
call fcn.229154890
mov r9d, dword [rsp + 0x60]
mov r8, rsi
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call fcn.2291548e5
mov rax, qword [rsp + 0x498]
mov edx, dword [rsp + 0x60]
mov dword [rax], edx
mov rcx, r15
mov r15, rsi
call fcn.229154578
mov rcx, r14
mov r14, r15
call fcn.229154578
mov rcx, rdi
mov rdi, r14
call fcn.229154578
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, r13
mov r13, rdi
call fcn.229154578
mov rcx, r12
mov r12, r13
call fcn.229154578
mov rcx, qword [rsp + 0x70]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rax, r12
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret