Function at 0x14000384e
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x580], rcx
mov qword [rbp + 0x588], rdx
lea rax, [rbp + 0x490]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp + 0x490], 0x18
mov dword [rbp + 0x4a0], 1
mov qword [rbp + 0x498], 0
lea rcx, [rbp + 0x490]
lea rdx, [rbp + 0x4a8]
lea rax, [rbp + 0x4b0]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
sete al
test al, al
je 0x140003944
lea rax, [rbp + 0x4bf]
mov qword [rbp + 0x548], rax
nop
nop
lea rax, [rbp + 0x4c0]
mov r8d, edi
lea rdx, str.CreatePipe___failed_n
mov rcx, rax
call fcn.14002b770
lea rax, [rbp + 0x4c0]
mov rcx, rax
call fcn.14002b6d0
mov rdx, rax
lea rcx, [rbp + 0x4bf]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call fcn.1400c0030
nop
lea rax, [rbp + 0x4bf]
mov rcx, rax
call fcn.1400afb10
jmp 0x140003c48
mov rax, qword [rbp + 0x4b0]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
test eax, eax
sete al
test al, al
je 0x1400039d4
lea rax, [rbp + 0x4df]
mov qword [rbp + 0x540], rax
nop
nop
lea rax, [rbp + 0x4e0]
mov r8d, esi
lea rdx, str.SetHandleInformation___failed_n
mov rcx, rax
call fcn.14002e370
lea rax, [rbp + 0x4e0]
mov rcx, rax
call fcn.14002e2d0
mov rdx, rax
lea rcx, [rbp + 0x4df]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call fcn.1400c0030
nop
lea rax, [rbp + 0x4df]
mov rcx, rax
call fcn.1400afb10
jmp 0x140003c48
lea rax, [rbp + 0x400]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp + 0x400], 0x68
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x460], rax
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x458], rax
mov eax, dword [rbp + 0x43c]
or ah, 1
mov dword [rbp + 0x43c], eax
mov rax, qword [rbp + 0x588]
mov rcx, rax
call fcn.140043db0
mov rdx, rax
lea rax, [rbp + 0x470]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x400]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x140003afb
lea rax, [rbp + 0x50f]
mov qword [rbp + 0x538], rax
nop
nop
lea rax, [rbp + 0x510]
mov r8d, ebx
lea rdx, str.CreateProcess___failed_n
mov rcx, rax
call fcn.14002be50
lea rax, [rbp + 0x510]
mov rcx, rax
call fcn.14002bdb0
mov rdx, rax
lea rcx, [rbp + 0x50f]
mov rax, qword [rbp + 0x580]
mov r8, rcx
mov rcx, rax
call fcn.1400c0030
nop
lea rax, [rbp + 0x50f]
mov rcx, rax
call fcn.1400afb10
jmp 0x140003c48
mov rax, qword [rbp + 0x4a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400bfd70
jmp 0x140003b33
mov eax, dword [rbp - 4]
mov ecx, eax
mov rdx, rbp
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400be050
mov rax, qword [rbp + 0x4b0]
lea rcx, [rbp - 4]
mov rdx, rbp
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x140003b71
mov eax, dword [rbp - 4]
test eax, eax
je 0x140003b71
mov eax, 1
jmp 0x140003b76
mov eax, 0
test al, al
jne 0x140003b1c
mov rax, qword [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x4b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x580]
mov rcx, rax
call fcn.1400bf840
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400c0880
jmp 0x140003c48
mov rax, qword [rbp + 0x580]
add rsp, 0x5d8
pop rbx
pop rsi
pop rdi
pop rbp
ret