Function at 0x140002f92
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x570
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x510], rcx
mov qword [rbp + 0x518], rdx
mov dword [rbp + 0x4ec], 1
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4c0], 0
mov dword [rbp + 0x4a0], 0x18
mov qword [rbp + 0x4a8], 0
mov dword [rbp + 0x4b0], 1
lea rcx, [rbp + 0x4a0]
lea rdx, [rbp + 0x4c0]
lea rax, [rbp + 0x4c8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
lea rdx, [rbp + 0x430]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x430], 0x68
mov dword [rbp + 0x46c], 0x100
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x490], rax
mov rax, qword [rbp + 0x4c0]
mov qword [rbp + 0x488], rax
pxor xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
movq qword [rbp + 0x420], xmm0
lea rax, str.C:WindowsSystem32cmd.exe
mov qword [rbp + 0x4e0], rax
lea rax, [rbp + 0x4d7]
mov qword [rbp + 0x4d8], rax
nop
nop
lea rdx, [rbp + 0x4d7]
lea rax, [rbp + 0x3f0]
mov r8, rdx
lea rdx, str.C:WindowsSystem32cmd.exe__c
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rax, [rbp + 0x4d7]
mov rcx, rax
call dbg.std::__new_allocator<char>::~__new_allocator()
nop
mov rdx, qword [rbp + 0x518]
lea rax, [rbp + 0x3f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x3f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp + 0x410]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x430]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.C:WindowsSystem32cmd.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x4c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp - 0x20]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov byte [rdx], al
add rdx, 1
mov dword [rbp - 0x24], 0
mov rax, qword [rbp + 0x510]
mov rcx, rax
call fcn.1400bbab0
mov rax, qword [rbp + 0x4c8]
lea rcx, [rbp - 0x24]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov dword [rbp + 0x4ec], eax
jmp 0x14000320f
mov eax, dword [rbp - 0x24]
mov eax, eax
mov byte [rbp + rax - 0x20], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x510]
mov rcx, rax
call fcn.1400bc860
mov rax, qword [rbp + 0x4c8]
lea rcx, [rbp - 0x24]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov dword [rbp + 0x4ec], eax
cmp dword [rbp + 0x4ec], 1
je 0x1400031bf
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
lea rax, [rbp + 0x3f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x14000328c
mov rax, qword [rbp + 0x510]
add rsp, 0x570
pop rbx
pop rdi
pop rbp
ret