Function at 0x404817
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
xor esi, esi
xor r9d, r9d
mov eax, esi
lea r8, [rsp + 0x68]
mov r12, rcx
mov ecx, 6
mov r13, rdx
mov rdi, r8
lea rbx, [rsp + 0x53f]
lea rdx, [rsp + 0x60]
rep stosd dword [rdi], eax
and rbx, 0xffffffffffffffe0
mov dword [rsp + 0x68], 0x18
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4048e5
movabs rax, 0xa60fa82ee3c39c80
movabs rdx, 0xcf5fcd5a82a6eec3
mov qword [rbx + 0x20], rax
movabs rax, 0x2aa93837815a20c8
mov qword [rbx], rdx
movabs rdx, 0x43c85e17a87245b8
mov qword [rbx + 0x28], rax
movabs rax, 0x9b6b748cdf71c29
mov qword [rbx + 8], rdx
movabs rdx, 0x9b6b748c7937945
mov qword [rbx + 0x30], rax
movabs rax, 0xde2d44c59b6e525a
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x18], rax
vmovdqu ymm1, ymmword [rbx]
vpxor ymm0, ymm1, ymmword [rbx + 0x20]
jmp 0x404a72
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x404979
movabs rax, 0xa33ba33bcad28b90
mov qword [rbx + 0x20], rax
movabs rax, 0x22a52c78ce1c0cdd
mov qword [rbx + 0x28], rax
movabs rax, 0x6f969e60a9fc1031
mov qword [rbx + 0x30], rax
movabs rax, 0xde2d4ea1fe023b3b
mov qword [rbx + 0x38], rax
vmovdqu ymm2, ymmword [rbx + 0x20]
movabs rax, 0xcf5fcd5a82a6eec3
mov qword [rbx], rax
movabs rax, 0x43c85e17a87245b8
mov qword [rbx + 8], rax
movabs rax, 0x9b6b748c7937945
mov qword [rbx + 0x10], rax
movabs rax, 0xde2d44c59b6e525a
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm2, ymmword [rbx]
jmp 0x404a72
lea rdx, [rsp + 0xb8]
mov eax, esi
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
mov ecx, 0x16
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [r13]
mov dword [rsp + 0xb8], 0x68
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x404a88
movabs rax, 0xbd0fa82ee3c39c80
movabs rdx, 0xcf5fcd5a82a6eec3
mov qword [rbx + 0x20], rax
movabs rax, 0x63e17664db1726d7
mov qword [rbx], rdx
movabs rdx, 0x43c85e17a87245b8
mov qword [rbx + 0x28], rax
movabs rax, 0x9bcd32dabfa1823
mov qword [rbx + 8], rdx
movabs rdx, 0x9b6b748c7937945
mov qword [rbx + 0x30], rax
movabs rax, 0xde2d44c59b6e525a
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqu ymm3, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm3, ymmword [rbx]
vmovdqu ymmword [rbx + 0x20], ymm0
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.00403210
jmp 0x404b50
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x54]
lea rsi, [rsp + 0x120]
call rbx
lea rax, [rsp + 0xa8]
mov rbp, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x98], rax
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x58]
mov r9, rdi
mov rdx, rsi
mov r8d, 0x400
lea r13, [rsp + 0x98]
call rbp
test eax, eax
je 0x404b0d
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x404b0d
mov rdx, rsi
mov rcx, r13
call fcn.004a24c0
jmp 0x404ace
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov rcx, r12
mov rdx, r13
call fcn.004a3920
mov rcx, r13
call fcn.004a18b0
jmp 0x404b50
mov rax, r12
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret