Function at 0x2c9913c54
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov rsi, rcx
mov ebp, edx
mov r12, r8
mov qword [rsp + 0x4a8], r9
mov qword [rsp + 0x390], 0
mov qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], 0
mov dword [rsp + 0x390], 0x18
mov dword [rsp + 0x3a0], 1
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x388]
mov r9d, 0x100000
lea r8, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebx, 0
test eax, eax
je 0x2c9913e68
mov r8d, 0
mov edx, 1
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdx, [rsp + 0x3d0]
mov ecx, 0xb
mov eax, 0
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rsp + 0x3b0], 0
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x3c0], 0
mov dword [rsp + 0x3d0], 0x68
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x428], rax
mov dword [rsp + 0x40c], 0x100
mov rcx, r12
call fcn.2c99127cd
mov rbx, rax
test rax, rax
je 0x2c9913e4d
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea r12, [rax + 0x401]
lea rcx, [r12 + r12]
call fcn.2c9914d40
mov rdi, rax
test rax, rax
je 0x2c9913e42
lea rcx, [0x2c991e708]
call fcn.2c9915bf5
mov r13, rax
mov r9, rbx
mov r8, rax
mov rdx, r12
mov rcx, rdi
call fcn.2c9912710
mov rcx, r13
call fcn.2c9915c7c
lea r12, [rsp + 0x170]
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rdi
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r12d, 0
test eax, eax
jne 0x2c9913e7f
mov rcx, rdi
call fcn.2c9914d92
mov rdi, r12
mov rcx, rbx
call fcn.2c9914d92
mov rbx, rdi
mov rcx, qword [rsp + 0x380]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x388]
call rsi
mov rax, rbx
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x1388
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call fcn.2c9913b10
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x37c], 0
lea r14, [rsp + 0x37c]
mov r13, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2c9913ecd
mov ecx, 0x64
call r15
add r12d, 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, qword [rsp + 0x388]
call r13
test eax, eax
je 0x2c9913f0b
cmp dword [rsp + 0x37c], 0
jne 0x2c9913f0b
cmp r12d, 0x32
jbe 0x2c9913ec1
mov eax, dword [rsp + 0x37c]
test eax, eax
jne 0x2c99140f2
cmp dword [rsp + 0x5c], 0
jne 0x2c9913f6c
mov dword [rsp + 0x37c], 0x14
mov ecx, 0x15
call fcn.2c9914d40
mov r12, rax
test rax, rax
je 0x2c99141bb
lea rcx, [0x2c991e72d]
call fcn.2c9915b70
mov r13, rax
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rcx, r13
call fcn.2c9915c7c
mov r13, r12
jmp 0x2c9914133
lea r12, [rsp + 0x170]
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r12
call fcn.2c991284d
mov r12, rax
test rax, rax
je 0x2c9913fe8
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 3]
mov dword [rsp + 0x37c], edx
lea ecx, [rax + 4]
call fcn.2c9914d40
mov r13, rax
test rax, rax
je 0x2c9913fe0
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r13
call sub.msvcrt.dll_strlen
add rax, r13
mov word [rax], 0xa0d
mov byte [rax + 2], 0
mov rcx, r12
call fcn.2c9914d92
jmp 0x2c9914133
mov r12, rax
jmp 0x2c99141bb
mov dword [rsp + 0x37c], 1
mov ecx, 2
call fcn.2c9914d40
mov r13, rax
test rax, rax
jne 0x2c9914133
mov r12, rax
jmp 0x2c99141bb
mov eax, eax
lea rcx, [rax + rax + 0x402]
call fcn.2c9914d40
mov r15, rax
test rax, rax
je 0x2c99141a0
mov eax, dword [rsi]
mov dword [r15 + 4], eax
mov eax, dword [rsi + 4]
mov dword [r15 + 8], eax
mov dword [r15 + 0xc], 2
mov dword [r15 + 0x10], 4
mov dword [r15 + 0x14], ebp
mov rcx, r14
call sub.msvcrt.dll_strlen
lea rcx, [r15 + 0x24]
mov r8d, eax
mov rdx, r14
call fcn.2c99114be
mov dword [r15 + 0x18], 0x24
mov dword [r15 + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea edx, [rax + 0x24]
mov dword [rsp + 0x37c], edx
lea edx, [rax + 0x20]
lea rcx, [r15 + 4]
mov r8d, 0
call fcn.2c99120f0
mov dword [r15], eax
cmp dword [rsp + 0x4b0], 0
jne 0x2c99140b5
mov rax, qword [rsp + 0x4b8]
mov edx, dword [rsp + 0x37c]
mov dword [rax], edx
jmp 0x2c99141a0
mov rcx, qword [rsp + 0x4a8]
call sub.msvcrt.dll_strlen
mov r8, rax
lea rsi, [rsp + 0x60]
mov rdx, qword [rsp + 0x4a8]
mov rcx, rsi
call fcn.2c9915130
mov r9d, dword [rsp + 0x37c]
mov r8, r15
mov rdx, r15
mov rcx, rsi
call fcn.2c991519c
jmp 0x2c991409f
lea ecx, [rax + 1]
call fcn.2c9914d40
mov r12, rax
test rax, rax
je 0x2c99141bb
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x378]
mov r8d, dword [rsp + 0x37c]
mov rdx, r12
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r13, r12
mov eax, dword [rsp + 0x37c]
lea rcx, [rax + rax + 2]
call fcn.2c9914d40
mov r12, rax
test rax, rax
je 0x2c99141b3
mov eax, dword [rsp + 0x37c]
add eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 0xffffffff
mov r8, r13
mov edx, 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r12
call fcn.2c991272d
mov r14, rax
mov r15, rax
test rax, rax
je 0x2c99141a8
mov eax, dword [rsp + 0x37c]
mov r15d, 0
test eax, eax
jne 0x2c9914011
mov rcx, r14
call fcn.2c9914d92
mov rcx, r12
call fcn.2c9914d92
mov r12, r15
mov rcx, r13
call fcn.2c9914d92
mov edx, 0
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x3b0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x3b8]
call rsi
jmp 0x2c9913e37