Function at 0x1400358c8
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
xor r10d, r10d
mov r12, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov r14, rcx
mov ecx, 0x19
test r8d, r8d
mov rbx, rdx
lea rdi, [rsp + 0xb4]
mov r13d, r8d
mov dword [rsp + 0x98], 0x18
rep stosd dword [rdi], eax
mov ecx, 6
lea rdi, [rsp + 0x80]
mov qword [rsp + 0xa0], r10
rep stosd dword [rdi], eax
mov dword [rsp + 0xa8], 1
mov qword [rsp + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x78], 0xffffffffffffffff
je 0x140035991
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov r9d, 0x1000
lea r8, [rsp + 0x98]
call qword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x140035985
call r12
mov dword [rsp + 0x68], eax
call fcn.140036bd7
lea rcx, str.Could_not_set_commandline_pipe:__s
mov rdx, rax
call fcn.140036717
jmp 0x140035bf9
mov rsi, qword [rsp + 0x78]
mov edi, 0x3101
jmp 0x140035995
xor esi, esi
xor edi, edi
mov rcx, r14
call fcn.1400342ad
mov rcx, rbx
mov rbp, rax
call fcn.1400342ad
mov dword [rsp + 0xec], edi
mov ecx, 0x1a
lea rdi, [rsp + 0x118]
mov qword [rsp + 0x108], rsi
mov rbx, rax
mov qword [rsp + 0x110], rsi
lea rsi, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0x68
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x118]
call fcn.1400342ad
xor ecx, ecx
mov qword [rsp + 0x128], rax
call fcn.1400342ad
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x80]
mov rdx, rbp
mov qword [rsp + 0x30], r9
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov edi, eax
call r12
mov rcx, qword [rsp + 0x128]
mov r15d, eax
test rcx, rcx
je 0x140035a6d
call sub.msvcrt.dll_free
xor r8d, r8d
mov qword [rsp + 0x128], r8
mov rcx, qword [rsp + 0x130]
test rcx, rcx
jne 0x140035a89
test rbp, rbp
je 0x140035a9a
mov rcx, rbp
call sub.msvcrt.dll_free
jmp 0x140035a9a
call sub.msvcrt.dll_free
xor ecx, ecx
mov qword [rsp + 0x130], rcx
jmp 0x140035a7a
test rbx, rbx
je 0x140035aa7
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, r15d
call qword [sym.imp.KERNEL32.DLL_SetLastError]
test edi, edi
jne 0x140035ad7
call r12
mov dword [rsp + 0x68], eax
call fcn.140036bd7
mov rdx, r14
lea rcx, str.Unable_to_launch_command__s:__s
mov r8, rax
call fcn.140036717
jmp 0x140035bf9
test r13d, r13d
mov rbx, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
je 0x140035bb3
mov r13, qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
mov r14, qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rbp, qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rdx
mov r8d, 0x1000
xor edx, edx
call r13
test eax, eax
je 0x140035b97
mov r8d, dword [rsp + 0x118]
test r8d, r8d
je 0x140035b97
lea ecx, [r8 + 1]
mov dword [rsp + 0x5c], r8d
call sub.msvcrt.dll_malloc
mov qword [0x14010ece0], rax
mov rdx, rax
test rax, rax
je 0x140035b8b
xor eax, eax
mov r8d, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
call r14
test eax, eax
je 0x140035b8b
cmp dword [rsp + 0x6c], 0
mov rdx, qword [0x14010ece0]
je 0x140035b8b
mov eax, dword [rsp + 0x118]
lea rcx, [0x140094d64]
mov byte [rdx + rax], 0
call fcn.140036717
mov rcx, qword [0x14010ece0]
call sub.msvcrt.dll_free
xor edx, edx
mov rcx, qword [rsp + 0x80]
call rbx
test eax, eax
je 0x140035bc0
mov ecx, 0x64
call rbp
jmp 0x140035afc
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call rbx
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
jne 0x140035bde
call r12
mov dword [rsp + 0x68], eax
mov rcx, qword [rsp + 0x80]
mov rbx, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035c17
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x78], 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140035c2c
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0x68]
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret