Function at 0x69903721
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
xor r15d, r15d
xor r12d, r12d
mov eax, r15d
mov r13, r8
lea r8, [rsp + 0x90]
mov rbx, rcx
mov ecx, 6
mov rdi, r8
mov dword [rsp + 0x478], edx
lea rdx, [rsp + 0x70]
rep stosd dword [rdi], eax
mov qword [rsp + 0x488], r9
lea rcx, [rsp + 0x68]
mov r9d, 0x100000
mov dword [rsp + 0x90], 0x18
mov dword [rsp + 0xa0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x69903bd3
lea rsi, [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rdi, rsi
mov eax, r15d
mov ecx, 0x16
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x78]
mov ecx, 6
mov dword [rsp + 0xa8], 0x68
mov dword [rsp + 0xe4], 0x100
mov rdi, rbp
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], rax
call fcn.699022a5
mov r12, rax
test rax, rax
je 0x69903bbe
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea r15, [rax + 0x401]
lea rcx, [r15 + r15]
call fcn.69904e00
mov r13, rax
test rax, rax
je 0x69903bb3
lea rcx, [0x6990a5c0]
call fcn.69905ab0
mov r9, r12
mov rdx, r15
mov rcx, r13
mov r8, rax
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x218]
call fcn.699021f0
mov r8, qword [rsp + 0x58]
mov rcx, r8
call fcn.69905b32
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x48], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rdx, r13
xor ecx, ecx
xor ebp, ebp
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x69903ba8
mov rcx, qword [rsp + 0x78]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.6990361e
mov dword [rsp + 0x60], 0
mov rdi, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov esi, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x6990392e
cmp dword [rsp + 0x60], 0
jne 0x6990392e
cmp ebp, 0x33
je 0x6990392e
mov ecx, 0x64
inc ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x699038ed
xor edi, edi
cmp dword [rsp + 0x60], 0
jne 0x6990398a
test esi, esi
je 0x6990397d
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r15
call fcn.6990231e
mov r14, rax
test rax, rax
je 0x69903973
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
mov rax, rcx
not rax
add eax, 2
mov dword [rsp + 0x60], eax
jmp 0x69903985
mov dword [rsp + 0x60], 1
jmp 0x69903985
mov dword [rsp + 0x60], 0x14
mov edi, 1
mov eax, dword [rsp + 0x60]
lea ecx, [rax + 1]
call fcn.69904e00
mov rbp, rax
test rax, rax
je 0x69903b83
test edi, edi
je 0x699039f7
test esi, esi
je 0x699039d3
test r14, r14
je 0x69903a18
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
lea rdx, [0x6990a5e5]
call sub.msvcrt.dll_strcat
mov rcx, r14
call fcn.69904e58
jmp 0x69903a18
lea rcx, [0x6990a5e8]
call fcn.69905a30
mov rcx, rbp
mov r14, rax
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call fcn.69905b32
jmp 0x69903a18
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
inc rcx
add rcx, rcx
call fcn.69904e00
mov r14, rax
test rax, rax
je 0x69903b78
mov eax, dword [rsp + 0x60]
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x20], r14
inc eax
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r14
call fcn.6990220e
mov r15, rax
test rax, rax
je 0x69903b6d
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x69903a79
xor esi, esi
jmp 0x69903b62
add rcx, 0x201
add rcx, rcx
call fcn.69904e00
mov rsi, rax
test rax, rax
je 0x69903a72
mov eax, dword [rbx]
or rcx, 0xffffffffffffffff
mov rdi, r15
lea r9, [rsi + 0x24]
mov rdx, r15
mov dword [rsi + 4], eax
mov eax, dword [rbx + 4]
xor ebx, ebx
mov dword [rsi + 8], eax
movabs rax, 0x400000002
mov qword [rsi + 0xc], rax
mov eax, dword [rsp + 0x478]
mov dword [rsi + 0x14], eax
mov eax, ebx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, r9
call fcn.699014b5
mov dword [rsi + 0x18], 0x24
xor r8d, r8d
lea rcx, [rsi + 4]
mov dword [rsi + 0x1c], eax
lea edx, [rax + 3]
and edx, 0xfffffffc
lea eax, [rdx + 0x24]
add edx, 0x20
mov dword [rsp + 0x60], eax
call fcn.69901c90
cmp dword [rsp + 0x490], 0
mov dword [rsi], eax
je 0x69903b54
mov rdi, qword [rsp + 0x488]
mov eax, ebx
or rcx, 0xffffffffffffffff
lea r11, [rsp + 0x116]
mov rdx, qword [rsp + 0x488]
repne scasb al, byte [rdi]
mov qword [rsp + 0x58], r11
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call fcn.69905170
mov r11, qword [rsp + 0x58]
mov r8, rsi
mov rdx, rsi
mov r9d, dword [rsp + 0x60]
mov rcx, r11
call fcn.699051c5
mov rax, qword [rsp + 0x498]
mov edx, dword [rsp + 0x60]
mov dword [rax], edx
mov rcx, r15
mov r15, rsi
call fcn.69904e58
mov rcx, r14
mov r14, r15
call fcn.69904e58
mov rcx, rbp
mov rbp, r14
call fcn.69904e58
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, r13
mov r13, rbp
call fcn.69904e58
mov rcx, r12
mov r12, r13
call fcn.69904e58
mov rcx, qword [rsp + 0x70]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rax, r12
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret