Function at 0x14004ffd0
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe
Terminate process

Disassembly:
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0x1068]
mov eax, 0x1168
call fcn.140083760
sub rsp, rax
mov rax, qword [0x1400a70c0]
xor rax, rsp
mov qword [rbp + 0x1050], rax
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
lea r8, [rbp + 0x30]
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x1c], eax
lea rdx, [rsp + 0x70]
movups xmmword [rbp - 0x6c], xmm0
mov rbx, rcx
xor r15d, r15d
movups xmmword [rbp - 0x5c], xmm0
xor r9d, r9d
lea rcx, [rsp + 0x68]
movups xmmword [rbp - 0x4c], xmm0
mov qword [rsp + 0x68], r15
movups xmmword [rbp - 0x2c], xmm0
mov qword [rsp + 0x70], r15
psrldq xmm0, 8
movd eax, xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x30], 0x18
bts eax, 8
mov dword [rbp - 0x34], eax
xor eax, eax
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x40], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400503cb
mov rax, qword [rsp + 0x70]
movabs r12, 0x7fffffffffffffff
mov rcx, qword [rbx + 0x10]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov rax, r12
sub rax, rcx
cmp rax, 0x60
jb 0x1400503d5
cmp qword [rbx + 0x18], 0xf
mov r9, rbx
jbe 0x1400500b2
mov r9, qword [rbx]
movzx edx, byte [rsp + 0x50]
lea rax, str.__VERYSILENT__SUPPRESSMSGBOXES__NORESTART__NOCANCEL__NOCLOSEAPPLICATIONS__FORCECLOSEAPPLICATIONS
mov qword [rsp + 0x30], 0x60
mov r8, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x10]
call fcn.140069fe0
cmp qword [rbp + 0x28], 0xf
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x10]
cmova rdx, qword [rbp + 0x10]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], r15
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140050377
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x1198], rsi
mov qword [rsp + 0x11a0], rdi
mov qword [rsp + 0x11a8], r13
mov qword [rsp + 0x1160], r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
movabs rsi, 0x4e94914f0000
movabs r13, 0x7ffffffffa0a1eff
movabs r14, 0x431bde82d7b634db
nop word [rax + rax]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400501f2
cmp dword [rbp + 4], r15d
jbe 0x1400501f2
mov rcx, qword [rsp + 0x68]
lea r9, [rbp]
mov r8d, 0xfff
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400501f2
mov eax, dword [rbp]
test eax, eax
je 0x1400501f2
cmp rax, 0x1000
jae 0x1400503cf
mov byte [rbp + rax + 0x50], r15b
mov dil, 1
mov dword [0x1400da03c], 0x3f000000
mov rcx, qword [rsp + 0x78]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400502b1
test dil, dil
jne 0x1400502a4
lea rcx, [rsp + 0x60]
call fcn.140039320
mov rbx, qword [rsp + 0x60]
cmp rbx, r13
jge 0x140050230
add rbx, 0x5f5e100
jmp 0x140050233
mov rbx, r12
lea rcx, [rsp + 0x58]
call fcn.140039320
mov rax, qword [rsp + 0x58]
cmp rax, rbx
jge 0x140050180
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jle 0x140050262
mov edx, 0x5265c00
jmp 0x140050284
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140050284
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x58]
call fcn.140039320
mov rax, qword [rsp + 0x58]
cmp rax, rbx
jl 0x140050250
jmp 0x140050180
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
lea rdx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x28]
mov dword [0x1400da03c], 0x3f800000
cmp rdx, 0xf
jbe 0x140050338
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050333
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050333
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400817cc
mov r13, qword [rsp + 0x11a8]
mov al, 1
mov rdi, qword [rsp + 0x11a0]
mov rsi, qword [rsp + 0x1198]
mov r14, qword [rsp + 0x1160]
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.1400810a0
add rsp, 0x1168
pop r15
pop r12
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400503cb
mov rcx, qword [rbp + 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400503c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400503c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400817cc
xor al, al
jmp 0x14005035a
call fcn.1400812e8
int3
call fcn.140035c60
int3