Function at 0x259e75090
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
xor r9d, r9d
mov rbp, rsp
push r14
push r13
xor r13d, r13d
push r12
mov eax, r13d
push rdi
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
mov ecx, 5
and rsp, 0xffffffffffffffe0
sub rsp, 0x550
lea rdx, [rsp + 0x84]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x80], 0x18
mov rdi, rdx
lea rdx, [rsp + 0x78]
lea r12, [rsp + 0xd0]
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x90], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x259e751a4
movabs rax, 0x5dcb5814447b7da0
movabs rdx, 0x349b3d60251e0fe3
mov qword [rsp + 0xd0], rax
movabs rax, 0x29e9c3e5070eb010
mov qword [rsp + 0x150], rdx
movabs rdx, 0x4088a5c52e26d560
mov qword [rsp + 0xd8], rax
movabs rax, 0xad99f586e1369469
mov qword [rsp + 0x158], rdx
movabs rdx, 0xad99f586eb52f105
mov qword [rsp + 0xe0], rax
movabs rax, 0xa4afaa4b2c027fba
mov qword [rsp + 0x160], rdx
mov qword [rsp + 0xe8], rax
vmovdqa ymm1, ymmword [rsp + 0xd0]
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm1, ymmword [rsp + 0x150]
jmp 0x259e75261
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x259e75272
movabs rax, 0x58ff53016d6a6ab0
mov qword [rsp + 0xd0], rax
movabs rax, 0x21e5d7aa48489c05
mov qword [rsp + 0xd8], rax
movabs rax, 0xcbb9dcae853d9871
mov qword [rsp + 0xe0], rax
movabs rax, 0xa4afa02f496e16db
mov qword [rsp + 0xe8], rax
movabs rax, 0x349b3d60251e0fe3
vmovdqa ymm2, ymmword [rsp + 0xd0]
mov qword [rsp + 0x150], rax
movabs rax, 0x4088a5c52e26d560
mov qword [rsp + 0x158], rax
movabs rax, 0xad99f586eb52f105
mov qword [rsp + 0x160], rax
movabs rax, 0xa4afaa4b2c027fba
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm2, ymmword [rsp + 0x150]
vmovdqa ymmword [rsp + 0xd0], ymm0
mov rdx, r12
jmp 0x259e753a4
mov eax, r13d
mov ecx, 0x15
xor r8d, r8d
xor r9d, r9d
lea rdx, [rsp + 0xd4]
mov rdi, rdx
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rsi]
lea rsi, [rsp + 0xb0]
mov dword [rsp + 0xd0], 0x68
mov dword [rsp + 0x10c], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x259e753b1
movabs rax, 0x46cb5814447b7da0
movabs rdx, 0x349b3d60251e0fe3
mov qword [rsp + 0xb0], rax
movabs rax, 0x60a18db65d43b60f
mov qword [rsp + 0x150], rdx
movabs rdx, 0x4088a5c52e26d560
mov qword [rsp + 0xb8], rax
movabs rax, 0xad9391e3873b9063
mov qword [rsp + 0x158], rdx
movabs rdx, 0xad99f586eb52f105
mov qword [rsp + 0xc0], rax
movabs rax, 0xa4afaa4b2c027fba
mov qword [rsp + 0x160], rdx
mov rdx, rsi
mov qword [rsp + 0xc8], rax
vmovdqa ymm3, ymmword [rsp + 0xb0]
mov qword [rsp + 0x168], rax
vpxor ymm0, ymm3, ymmword [rsp + 0x150]
vmovdqa ymmword [rsp + 0xb0], ymm0
mov rcx, rbx
call fcn.259efe6b0
jmp 0x259e75459
mov rcx, qword [rsp + 0x78]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r13, [rsp + 0x6c]
lea r12, [rsp + 0x150]
call rdi
lea rax, [rsp + 0xc0]
xor edx, edx
mov byte [rsp + 0xc0], 0
mov qword [rsp + 0xb0], rax
mov r14, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xb8], rdx
xor eax, eax
mov rcx, qword [rsp + 0x70]
mov r9, r13
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rdx, r12
call r14
test eax, eax
je 0x259e7542b
mov r8d, dword [rsp + 0x6c]
test r8d, r8d
je 0x259e7542b
mov rdx, r12
mov rcx, rsi
call fcn.259efbfe0
jmp 0x259e753f5
mov rcx, qword [rsp + 0x98]
call rdi
mov rcx, qword [rsp + 0xa0]
call rdi
mov rcx, qword [rsp + 0x70]
call rdi
mov rcx, rbx
mov rdx, rsi
call fcn.259efd7d0
mov rcx, rsi
call fcn.259efa9f0
lea rsp, [rbp - 0x30]
mov rax, rbx
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret