Function at 0x140004320
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
xor r12d, r12d
mov dword [rsp + 0x4a8], edx
mov rsi, rcx
mov rbx, r8
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x4b8], r9
lea rcx, [rsp + 0x70]
mov r9d, 0x100000
lea r8, [rsp + 0xa0]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xa0], 0x18
mov dword [rsp + 0xb0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14000456a
lea rbp, [rsp + 0xc0]
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rdi, rbp
mov rax, r12
mov ecx, 0xb
rep stosq qword [rdi], rax
movq xmm0, qword [rsp + 0x78]
mov r8, rbx
xor edx, edx
mov dword [rsp + 0xc0], 0x68
mov ecx, 0xfde9
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9d, 0xffffffff
punpcklqdq xmm0, xmm0
mov qword [rsp + 0x80], 0
lea r14, [rsp + 0x80]
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xfc], 0x100
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x118], xmm0
call rdi
mov r12d, eax
test eax, eax
je 0x140004588
cdqe
lea rcx, [rax + rax + 2]
call fcn.140005de0
mov r13, rax
test rax, rax
je 0x140004588
mov r8, rbx
mov r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], r12d
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
call rdi
mov rcx, r13
call sub.msvcrt.dll_wcslen
lea r15, [rax + 0x401]
lea rcx, [r15 + r15]
call fcn.140005de0
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, rax
test rax, rax
je 0x140004554
lea rcx, [0x14001a5d8]
call fcn.140006e10
mov r9, r13
mov rdx, r15
mov rcx, r12
mov r8, rax
mov qword [rsp + 0x50], rax
lea r15, [rsp + 0x240]
call fcn.140002640
mov r8, qword [rsp + 0x50]
mov rcx, r8
call fcn.140006ea0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, r15
mov ecx, 0x104
mov qword [rsp + 0x50], rax
call rax
mov qword [rsp + 0x48], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov rdx, r12
xor ecx, ecx
xor r14d, r14d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400045a8
mov rcx, r12
mov r12, r14
call fcn.140005e40
mov rcx, r13
call fcn.140005e40
mov rcx, qword [rsp + 0x78]
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
mov rax, r12
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
jmp 0x14000456a
mov rcx, qword [rsp + 0x80]
mov edx, 0x1388
xor ebx, ebx
lea rbp, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r13
call fcn.140004140
mov dword [rsp + 0x68], 0
mov r14, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [rsp + 0x5c], eax
jmp 0x1400045fb
cmp ebx, 0x33
je 0x140004621
test eax, eax
jne 0x140004688
mov ecx, 0x64
add ebx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x70]
call r14
test eax, eax
mov eax, dword [rsp + 0x68]
jne 0x1400045e0
test eax, eax
jne 0x140004688
mov ecx, dword [rsp + 0x5c]
test ecx, ecx
jne 0x140004847
mov ecx, 0x15
mov dword [rsp + 0x68], 0x14
call fcn.140005de0
mov r15, rax
test rax, rax
jne 0x14000492f
xor r14d, r14d
mov rcx, qword [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x80]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
jmp 0x140004549
lea ecx, [rax + 1]
call fcn.140005de0
mov r15, rax
test rax, rax
je 0x14000464f
mov r8d, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x6c]
mov rdx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x68]
lea rcx, [rax + rax + 2]
call fcn.140005de0
mov r14, rax
test rax, rax
je 0x140004799
mov eax, dword [rsp + 0x68]
mov r9d, 0xffffffff
mov r8, r15
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x20], r14
add eax, 1
mov dword [rsp + 0x28], eax
call rdi
mov dword [rsp + 0x28], 0
mov r8, r14
xor edx, edx
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call rbx
mov edi, eax
test eax, eax
je 0x140004840
movsxd rcx, eax
call fcn.140005de0
mov rbp, rax
test rax, rax
je 0x140004840
mov dword [rsp + 0x28], edi
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov qword [rsp + 0x38], 0
mov ecx, 0xfde9
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
call rbx
mov eax, dword [rsp + 0x68]
test eax, eax
jne 0x1400047a6
xor ebx, ebx
mov rcx, rbp
call fcn.140005e40
mov rcx, r14
mov r14, rbx
call fcn.140005e40
mov rcx, r15
call fcn.140005e40
jmp 0x140004652
lea rcx, [rax + rax + 0x402]
call fcn.140005de0
mov rbx, rax
test rax, rax
je 0x140004784
mov eax, dword [rsi]
mov rcx, rbp
mov dword [rbx + 4], eax
mov eax, dword [rsi + 4]
mov dword [rbx + 8], eax
movabs rax, 0x400000002
mov qword [rbx + 0xc], rax
mov eax, dword [rsp + 0x4a8]
mov dword [rbx + 0x14], eax
call sub.msvcrt.dll_strlen
lea rcx, [rbx + 0x24]
mov rdx, rbp
mov r8d, eax
call fcn.140001590
mov dword [rbx + 0x18], 0x24
lea rcx, [rbx + 4]
xor r8d, r8d
mov dword [rbx + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea edx, [rax + 0x24]
mov dword [rsp + 0x68], edx
lea edx, [rax + 0x20]
call fcn.140001f50
mov dword [rbx], eax
mov eax, dword [rsp + 0x4c0]
test eax, eax
jne 0x140004979
mov rax, qword [rsp + 0x4c8]
mov edx, dword [rsp + 0x68]
mov dword [rax], edx
jmp 0x140004786
xor ebx, ebx
jmp 0x14000478e
mov rdx, r15
mov ecx, 0x104
mov rax, qword [rsp + 0x50]
call rax
mov dword [rsp + 0x28], 0
mov r8, r15
xor edx, edx
mov qword [rsp + 0x38], 0
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0xffffffff
mov ecx, 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
call rbx
mov ebp, eax
test eax, eax
je 0x140004956
movsxd rcx, eax
call fcn.140005de0
mov r14, rax
test rax, rax
je 0x140004956
mov r8, r15
mov r9d, 0xffffffff
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call rbx
mov rcx, r14
call sub.msvcrt.dll_strlen
lea edx, [rax + 3]
lea ecx, [rax + 4]
mov dword [rsp + 0x68], edx
call fcn.140005de0
mov r15, rax
test rax, rax
je 0x14000464f
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r15
call sub.msvcrt.dll_strlen
mov edx, 0xa0d
mov rcx, r14
add rax, r15
mov word [rax], dx
mov byte [rax + 2], 0
call fcn.140005e40
jmp 0x1400046b9
lea rcx, [0x14001a5fd]
call fcn.140006d90
mov rcx, r15
mov r14, rax
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call fcn.140006ea0
jmp 0x1400046b9
mov ecx, 2
mov dword [rsp + 0x68], 1
call fcn.140005de0
mov r15, rax
test rax, rax
jne 0x1400046b9
jmp 0x14000464f
mov rcx, qword [rsp + 0x4b8]
lea rsi, [rsp + 0x130]
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x4b8]
mov rcx, rsi
mov r8, rax
call fcn.140006220
mov r9d, dword [rsp + 0x68]
mov r8, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.140006350
jmp 0x14000482c