Function at 0x140003e00
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5b8
vpxor xmm0, xmm0, xmm0
xor r9d, r9d
lea rsi, [rsp + 0x57f]
mov rbx, rcx
mov rbp, rdx
vmovdqu xmmword [rsp + 0x94], xmm0
and rsi, 0xffffffffffffffe0
lea rdx, [rsp + 0x88]
mov dword [rsp + 0xa4], 0
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x90], 0x18
lea r8, [rsp + 0x90]
mov dword [rsp + 0xa0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140003f60
lea rbp, [rbx + 0x10]
lea r12, [rsi + 0x20]
movabs rax, 0x1cb8ba0644f37054
movabs rdx, 0x75e8df7225960217
mov qword [rsi + 0x20], rax
mov rcx, r12
movabs rax, 0x1fb2f19b3d0d8cec
mov qword [rsi], rdx
movabs rdx, 0x76d397bb1425e99c
mov qword [rsi + 0x28], rax
movabs rax, 0x84bfdf5858861965
mov qword [rsi + 8], rdx
movabs rdx, 0x84bfdf5852e27c09
mov qword [rsi + 0x30], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [rsi + 0x10], rdx
mov qword [rbx], rbp
mov qword [rsi + 0x38], rax
vmovdqa ymm1, ymmword [rsi + 0x20]
mov qword [rsi + 0x18], rax
vpxor ymm0, ymm1, ymmword [rsi]
vmovdqa ymmword [rsi + 0x20], ymm0
vmovdqu ymmword [rsp + 0x50], ymm0
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
vmovdqu ymm0, ymmword [rsp + 0x50]
cmp rax, 0xf
mov qword [rsp + 0x160], rax
mov rdi, rax
mov rdx, rax
ja 0x140004220
cmp rax, 1
jne 0x140004468
vpextrb byte [rbx + 0x10], xmm0, 0
vzeroupper
mov qword [rbx + 8], rdx
mov byte [rbp + rdx], 0
mov rax, rbx
add rsp, 0x5b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r8d, r8d
mov rcx, qword [rsp + 0x80]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140004058
lea rdi, [rbx + 0x10]
lea r12, [rsi + 0x20]
movabs rax, 0x198cb1136de26744
mov qword [rbx], rdi
mov rcx, r12
mov qword [rsi + 0x20], rax
movabs rax, 0x17bee5d4724ba0f9
mov qword [rsi + 0x28], rax
movabs rax, 0xe29ff6703c8d157d
mov qword [rsi + 0x30], rax
movabs rax, 0x1ed4ebbdb9df1d17
mov qword [rsi + 0x38], rax
vmovdqa ymm2, ymmword [rsi + 0x20]
movabs rax, 0x75e8df7225960217
mov qword [rsi], rax
movabs rax, 0x76d397bb1425e99c
mov qword [rsi + 8], rax
movabs rax, 0x84bfdf5852e27c09
mov qword [rsi + 0x10], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [rsi + 0x18], rax
vpxor ymm0, ymm2, ymmword [rsi]
vmovdqa ymmword [rsi + 0x20], ymm0
vmovdqu ymmword [rsp + 0x50], ymm0
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
vmovdqu ymm0, ymmword [rsp + 0x50]
cmp rax, 0xf
mov qword [rsp + 0x160], rax
mov rbp, rax
ja 0x1400043b0
cmp rax, 1
jne 0x140004480
vpextrb byte [rbx + 0x10], xmm0, 0
vzeroupper
mov qword [rbx + 8], rax
mov byte [rdi + rax], 0
jmp 0x140003f46
xor eax, eax
xor r9d, r9d
lea rdi, [rsp + 0xf8]
mov ecx, 0xa
mov qword [rsp + 0xf4], 0
lea r8, [rsp + 0xf0]
mov qword [rsp + 0x140], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0xb0]
mov dword [rsp + 0xf0], 0x68
mov dword [rsp + 0x12c], 0x100
vmovddup xmm0, qword [rsp + 0x88]
mov rdx, qword [rbp]
vmovdqu xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140004290
mov rcx, qword [rsp + 0x88]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbp, [rsp + 0x160]
lea r13, [rsp + 0x7c]
call r15
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xd8], 0
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0xd0]
movabs r14, 0x3fffffffffffffff
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xe0], 0
jmp 0x140004191
mov r8d, dword [rsp + 0x7c]
test r8d, r8d
je 0x1400041b8
mov rax, r14
sub rax, qword [rsp + 0xd8]
cmp rax, r8
jb 0x1400045ed
mov rdx, rbp
mov rcx, rsi
call fcn.14000bae0
mov r9, r13
mov r8d, 0x400
mov rdx, rbp
mov rdi, rsi
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x80]
call r12
test eax, eax
jne 0x140004168
mov rcx, qword [rsp + 0xb0]
lea rdi, [rsp + 0xd0]
call r15
mov rcx, qword [rsp + 0xb8]
call r15
mov rcx, qword [rsp + 0x80]
call r15
mov rax, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0x50]
lea rdx, [rbx + 0x10]
mov qword [rbx], rdx
mov r8, qword [rsp + 0xd8]
cmp rax, rdi
je 0x140004520
mov qword [rbx], rax
mov rax, qword [rsp + 0xe0]
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r8
jmp 0x140003f46
xor r8d, r8d
lea rdx, [rsp + 0x160]
mov rcx, rbx
vzeroupper
call fcn.14000bad0
mov qword [rbx], rax
mov rbp, rax
mov rax, qword [rsp + 0x160]
mov qword [rbx + 0x10], rax
cmp edi, 8
jae 0x140004498
test dil, 4
jne 0x1400045ae
test edi, edi
je 0x140004280
movzx eax, byte [rsi + 0x20]
mov byte [rbp], al
test dil, 2
je 0x140004280
mov edi, edi
movzx eax, word [r12 + rdi - 2]
mov word [rbp + rdi - 2], ax
nop dword [rax]
mov rdx, qword [rsp + 0x160]
mov rbp, qword [rbx]
jmp 0x140003f3d
lea rdi, [rbx + 0x10]
lea r12, [rsi + 0x20]
movabs rax, 0x7b8ba0644f37054
movabs rdx, 0x75e8df7225960217
mov qword [rsi + 0x20], rax
mov rcx, r12
movabs rax, 0x56fabfc867408af3
mov qword [rsi], rdx
movabs rdx, 0x76d397bb1425e99c
mov qword [rsi + 0x28], rax
movabs rax, 0x84b5bb3d3e8b1d6f
mov qword [rsi + 8], rdx
movabs rdx, 0x84bfdf5852e27c09
mov qword [rsi + 0x30], rax
movabs rax, 0x1ed4e1d9dcb37476
mov qword [rsi + 0x10], rdx
mov qword [rbx], rdi
mov qword [rsi + 0x38], rax
vmovdqa ymm3, ymmword [rsi + 0x20]
mov qword [rsi + 0x18], rax
vpxor ymm0, ymm3, ymmword [rsi]
vmovdqa ymmword [rsi + 0x20], ymm0
vmovdqu ymmword [rsp + 0x50], ymm0
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
vmovdqu ymm0, ymmword [rsp + 0x50]
cmp rax, 0xf
mov qword [rsp + 0x160], rax
mov rbp, rax
ja 0x1400044f0
cmp rax, 1
je 0x14000403c
test rax, rax
je 0x140004489
vzeroupper
cmp ebp, 8
jb 0x140004430
mov rax, qword [rsi + 0x20]
lea r9, [rdi + 8]
and r9, 0xfffffffffffffff8
mov qword [rdi], rax
mov eax, ebp
mov rdx, qword [r12 + rax - 8]
mov qword [rdi + rax - 8], rdx
sub rdi, r9
mov rax, r12
lea edx, [rbp + rdi]
sub rax, rdi
and edx, 0xfffffff8
cmp edx, 8
jb 0x1400043a0
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov r10, qword [rax + r8]
mov qword [r9 + r8], r10
cmp ecx, edx
jb 0x14000438e
mov rax, qword [rsp + 0x160]
mov rdi, qword [rbx]
jmp 0x140004046
xor r8d, r8d
lea rdx, [rsp + 0x160]
mov rcx, rbx
vzeroupper
call fcn.14000bad0
mov qword [rbx], rax
mov rdi, rax
mov rax, qword [rsp + 0x160]
mov qword [rbx + 0x10], rax
cmp ebp, 8
jb 0x140004430
mov rax, qword [rsi + 0x20]
lea r9, [rdi + 8]
and r9, 0xfffffffffffffff8
mov qword [rdi], rax
mov eax, ebp
mov rdx, qword [r12 + rax - 8]
mov qword [rdi + rax - 8], rdx
sub rdi, r9
mov rax, r12
lea edx, [rbp + rdi]
sub rax, rdi
and edx, 0xfffffff8
cmp edx, 8
jb 0x1400043a0
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov r10, qword [rax + r8]
mov qword [r9 + r8], r10
cmp ecx, edx
jb 0x140004412
jmp 0x1400043a0
test bpl, 4
jne 0x1400045c4
test ebp, ebp
je 0x1400043a0
movzx eax, byte [rsi + 0x20]
mov byte [rdi], al
test bpl, 2
je 0x1400043a0
mov eax, ebp
movzx edx, word [r12 + rax - 2]
mov word [rdi + rax - 2], dx
jmp 0x1400043a0
test rax, rax
jne 0x140004609
vzeroupper
jmp 0x140003f3d
test rax, rax
jne 0x140004601
vzeroupper
jmp 0x140004046
mov rax, qword [rsi + 0x20]
lea r8, [rbp + 8]
and r8, 0xfffffffffffffff8
mov qword [rbp], rax
mov eax, edi
mov rdx, qword [r12 + rax - 8]
mov qword [rbp + rax - 8], rdx
sub rbp, r8
mov rax, r12
add edi, ebp
sub rax, rbp
and edi, 0xfffffff8
cmp edi, 8
jb 0x140004280
and edi, 0xfffffff8
xor edx, edx
mov ecx, edx
add edx, 8
mov r9, qword [rax + rcx]
mov qword [r8 + rcx], r9
cmp edx, edi
jb 0x1400044d0
jmp 0x140004280
xor r8d, r8d
lea rdx, [rsp + 0x160]
mov rcx, rbx
vzeroupper
call fcn.14000bad0
mov qword [rbx], rax
mov rdi, rax
mov rax, qword [rsp + 0x160]
mov qword [rbx + 0x10], rax
jmp 0x140004350
lea rcx, [r8 + 1]
cmp ecx, 8
jae 0x140004560
test cl, 4
jne 0x1400045d9
test ecx, ecx
je 0x140004215
movzx eax, byte [rdi]
mov byte [rbx + 0x10], al
test cl, 2
je 0x140004215
mov rax, qword [rsp + 0x50]
mov ecx, ecx
movzx eax, word [rax + rcx - 2]
mov word [rdx + rcx - 2], ax
jmp 0x140004215
mov rax, qword [rdi]
lea r10, [rbx + 0x18]
and r10, 0xfffffffffffffff8
mov qword [rbx + 0x10], rax
mov eax, ecx
mov r9, qword [rdi + rax - 8]
mov qword [rdx + rax - 8], r9
sub rdx, r10
mov rax, rdi
add ecx, edx
sub rax, rdx
and ecx, 0xfffffff8
cmp ecx, 8
jb 0x140004215
and ecx, 0xfffffff8
xor edx, edx
mov r9d, edx
add edx, 8
mov r11, qword [rax + r9]
mov qword [r10 + r9], r11
cmp edx, ecx
jb 0x140004597
jmp 0x140004215
mov eax, dword [rsi + 0x20]
mov edi, edi
mov dword [rbp], eax
mov eax, dword [r12 + rdi - 4]
mov dword [rbp + rdi - 4], eax
jmp 0x140004280
mov eax, dword [rsi + 0x20]
mov dword [rdi], eax
mov eax, ebp
mov edx, dword [r12 + rax - 4]
mov dword [rdi + rax - 4], edx
jmp 0x1400043a0
mov eax, dword [rdi]
mov ecx, ecx
mov dword [rbx + 0x10], eax
mov eax, dword [rdi + rcx - 4]
mov dword [rdx + rcx - 4], eax
jmp 0x140004215
lea rcx, str.basic_string::append
lea rdi, [rsp + 0xd0]
call fcn.14000ba48
vzeroupper
jmp 0x1400043d8
vzeroupper
jmp 0x140004248