Function at 0x1400503c0
Capabilities:
Create pipe
Create process on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov r14, r9
mov rbx, r8
mov esi, edx
mov r8, rcx
mov edx, 0x208
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x4c]
call fcn.1400cc120
mov dword [rbp - 0x50], 0x68
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r15
mov edi, r15d
test r14, r14
setne dil
test r14, r14
je 0x1400504c8
mov qword [rbp - 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rbp - 0x60], 1
mov qword [rbp - 0x68], r15
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_namedpipe_l1_1_0.dll_CreatePipe]
test eax, eax
jne 0x14005049e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0x14005079b
movzx eax, ax
or eax, 0x80070000
jmp 0x14005079b
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_SetHandleInformation]
test eax, eax
je 0x140050483
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
or dword [rbp - 0x14], 0x100
lea rcx, [rbp + 0x30]
call fcn.14004f380
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateProcessW]
test eax, eax
jne 0x140050542
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x30]
mov r8d, 0x23e1
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_CreateProcess_szCmd_s_bGetProcessConsoleOutput_d_GetLastError_d
call fcn.140061d00
xor eax, eax
jmp 0x14005079b
test esi, esi
je 0x140050556
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test rbx, rbx
je 0x140050569
mov rdx, rbx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test r14, r14
je 0x140050796
call fcn.140004ea0
mov rcx, rax
test rax, rax
je 0x1400507d2
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x20], rbx
mov dword [rbp + 0x28], r15d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSize]
mov edi, eax
test eax, eax
js 0x1400507dd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400505e1
mov edx, edi
lea rcx, [rbp + 0x20]
call fcn.14000c030
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x28]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jne 0x14005063c
mov r8d, 0x23fa
lea rdx, str.CreateCommandProcess
lea rcx, str._s__d_PRINT_ON_FALSE
call fcn.140061d00
nop
lea rdx, [rbx - 0x18]
mov edi, 0xffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140050635
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14005079b
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
test eax, eax
js 0x1400507c7
cmp eax, dword [rbx - 0xc]
jg 0x1400507c7
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov edi, 0xffffffff
test r14, r14
je 0x14005075e
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x140050694
cmp rax, qword [rbx - 0x18]
jne 0x140050694
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
jmp 0x1400506cb
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x1400507c1
mov eax, dword [rbx - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rbx - 0x10]
inc eax
movsxd rdx, eax
mov r8, rbx
lea rcx, [rsi + 0x18]
mov r9, rdx
call fcn.14000cd30
lea rax, [rsi + 0x18]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1400583f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [r14]
sub rbx, 0x18
cmp rcx, rbx
je 0x14005073c
cmp dword [rbx + 0x10], 0
jl 0x14005072f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005072f
call fcn.140006b40
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140050726
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14005073c
mov r8d, dword [rdx - 0x10]
mov rcx, r14
call fcn.1400048e0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005075a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x20]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14005076e
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14005077f
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140050796
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400c5860
mov rbx, qword [rsp + 0x588]
add rsp, 0x550
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140004840
nop
mov ecx, 0x80070057
call fcn.140004fd0
nop
mov ecx, 0x80004005
call fcn.140004fd0
nop
mov ecx, 0x80070057
call fcn.140004fd0
int3