Function at 0x1802281f0
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x68], r15d
lea rax, [0x1802bccc0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x70], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x80], 1
mov qword [rsp + 0x78], r15
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r12, [0x1802bccb0]
or ebx, 0xffffffff
test eax, eax
je 0x1802283cf
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rsp + 0x58]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp], rax
mov dword [rbp - 0x14], 0x101
mov word [rbp - 0x10], r15w
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x70]
mov rdx, qword [r14]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1802283ba
mov edx, 0x2710
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x60], r15d
mov ecx, 0x401
call fcn.1800a0a4c
mov rdi, rax
nop
mov dword [rbp + 0x70], r15d
mov qword [rsp + 0x28], r15
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18022839e
cmp dword [rbp + 0x70], 0
je 0x18022839e
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x60]
mov r8d, 0x400
mov rdx, rdi
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 0x60]
mov byte [rax + rdi], 0
mov r8d, dword [rbp + 0x60]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1800ebc70
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1800ebee0
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff0
cmp rcx, r12
je 0x180228391
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x180228391
call fcn.1800a0c6c
cmp dword [rbp + 0x60], 0x400
jae 0x180228300
mov rcx, rdi
call fcn.1800a09c8
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1800e9ff0
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff0
cmp rcx, r12
je 0x1802283fe
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1802283fe
call fcn.1800a0c6c
nop
mov rax, qword [r14]
mov qword [rbp - 0x58], rax
lea rcx, [rax - 0x10]
cmp rcx, r12
je 0x18022841f
lock xadd dword [rcx], ebx
lea eax, [rbx - 1]
cmp eax, 0xffffffff
jne 0x18022841f
call fcn.1800a0c6c
mov rax, rsi
add rsp, 0x120
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret