Function at 0x140006b20
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1340
call fcn.14006a6b0
sub rsp, rax
mov qword [rsp + 0x2a8], 0xfffffffffffffffe
mov qword [rsp + 0x1380], rbx
mov qword [rsp + 0x1388], rsi
mov rax, qword [0x1400dc010]
xor rax, rsp
mov qword [rsp + 0x1330], rax
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x1d8], rcx
mov qword [rsp + 0x1e0], rdx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x98], r12
mov dword [rsp + 0x1f8], 0x18
mov dword [rsp + 0x208], 1
mov qword [rsp + 0x200], r12
xor r9d, r9d
lea r8, [rsp + 0x1f8]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140006c33
lea rcx, str.executeCommand_StdoutRd_CreatePipe
call fcn.140007600
lea rdx, str.Error:_executeCommand_StdoutRd_CreatePipe
mov rcx, r15
call fcn.14000c8e0
mov dword [rsp + 0x50], 1
mov rcx, qword [r14]
sub rcx, 0x18
mov qword [rsp + 0x120], rcx
mov edi, 0xffffffff
lock xadd dword [rcx + 0x10], edi
sub edi, 1
jg 0x140006c2b
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r15
jmp 0x140007543
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140006ca3
lea rcx, str.executeCommand_Stdout_SetHandleInformation
call fcn.140007600
lea rdx, str.Error:_executeCommand_Stdout_SetHandleInformation
mov rcx, r15
call fcn.14000c8e0
mov dword [rsp + 0x50], 1
mov rax, qword [r14]
sub rax, 0x18
mov qword [rsp + 0x128], rax
mov edi, 0xffffffff
lock xadd dword [rax + 0x10], edi
sub edi, 1
jg 0x140006c9b
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140007543
lea rdx, str.C:WINDOWSSystem32cmd.exe__c
lea rcx, [rsp + 0xa8]
call fcn.14000c8e0
nop
mov rdi, qword [r14]
mov qword [rsp + 0x130], rdi
mov rbx, r12
mov qword [rsp + 0xb0], rbx
nop
movzx ecx, word [rdi]
test cx, cx
je 0x140006d0a
mov word [rsp + 0x70], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140006cf1
test rbx, rbx
jne 0x140006cfc
mov rbx, rdi
jmp 0x140006cf4
mov rbx, r12
mov qword [rsp + 0xb0], rbx
add rdi, 2
mov qword [rsp + 0x130], rdi
jmp 0x140006cd0
test rbx, rbx
je 0x140006d72
mov rax, qword [r14]
mov qword [rsp + 0x2b8], rax
sub rbx, rax
sar rbx, 1
mov dword [rsp + 0x1a0], ebx
test ebx, ebx
js 0x140007570
mov ecx, 1
sub ecx, dword [rax - 8]
mov dword [rsp + 0x1f0], ecx
mov eax, dword [rax - 0xc]
sub eax, ebx
mov dword [rsp + 0xd8], eax
or eax, ecx
jge 0x140006d58
mov edx, ebx
mov rcx, r14
call fcn.14000d2f0
mov rax, qword [r14]
cmp ebx, dword [rax - 0xc]
jg 0x14000757a
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [r14]
mov word [rax + rcx*2], r12w
mov qword [rsp + 0x210], r14
mov rbx, qword [r14]
mov qword [rsp + 0xb8], rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rsp + 0x78], cx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140006db0
add rbx, 2
mov qword [rsp + 0xb8], rbx
jmp 0x140006d90
mov r9, qword [r14]
mov qword [rsp + 0x218], r9
cmp rbx, r9
je 0x140006ea9
mov qword [rsp + 0x220], r9
sub rbx, r9
sar rbx, 1
mov dword [rsp + 0xdc], ebx
mov edx, dword [r9 - 0x10]
mov dword [rsp + 0xe0], edx
test edx, edx
js 0x140007584
mov ecx, 1
sub ecx, dword [r9 - 8]
mov dword [rsp + 0xe4], ecx
mov eax, dword [r9 - 0xc]
sub eax, edx
mov dword [rsp + 0xe8], eax
or eax, ecx
jge 0x140006e18
mov rcx, r14
call fcn.14000d2f0
mov r9, qword [r14]
movsxd rax, ebx
lea rdx, [r9 + rax*2]
mov qword [rsp + 0xb8], rdx
mov ecx, dword [r9 - 0x10]
mov dword [rsp + 0xec], ecx
mov edi, ecx
sub edi, ebx
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], ecx
lea eax, [rdi + 1]
movsxd r8, eax
add r8, r8
mov qword [rsp + 0x228], r8
je 0x140006e87
test rdx, rdx
jne 0x140006e6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x14000759a
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x14000758e
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
test edi, edi
js 0x1400075aa
mov rax, qword [r14]
cmp edi, dword [rax - 0xc]
jg 0x1400075aa
mov dword [rax - 0x10], edi
movsxd rcx, edi
mov rax, qword [r14]
mov word [rax + rcx*2], r12w
mov r8, r14
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x148]
call fcn.14000bc20
mov qword [rsp + 0x230], rax
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov qword [rsp + 0x238], rcx
mov rbx, qword [r14]
sub rbx, 0x18
mov qword [rsp + 0x138], rbx
cmp rcx, rbx
je 0x140006f56
cmp dword [rbx + 0x10], 0
jl 0x140006f3a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140006f3a
call fcn.14000d260
mov qword [rsp + 0x140], rax
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140006f29
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [rsp + 0x140]
add rax, 0x18
mov qword [r14], rax
jmp 0x140006f5b
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0xf8], r8d
mov qword [rsp + 0x240], rdx
mov rcx, r14
call fcn.14000d350
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x148]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x150], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140006f8d
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x158], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140006fbe
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rsi, qword [r14]
mov eax, dword [rsi - 0x10]
mov dword [rsp + 0xfc], eax
lea ebx, [rax + 1]
mov dword [rsp + 0x100], ebx
xor eax, eax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
xor edx, edx
lea r8d, [rax + 0x68]
lea rcx, [rsp + 0x2c0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x2c0], 0x68
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x318], rax
mov eax, dword [rsp + 0x2fc]
bts eax, 8
mov dword [rsp + 0x2fc], eax
or eax, 1
mov dword [rsp + 0x2fc], eax
mov word [rsp + 0x300], r12w
test ebx, ebx
js 0x1400075b5
mov ecx, 1
sub ecx, dword [rsi - 8]
mov dword [rsp + 0x104], ecx
mov eax, dword [rsi - 0xc]
sub eax, ebx
mov dword [rsp + 0x108], eax
or eax, ecx
jge 0x14000707b
mov edx, ebx
mov rcx, r14
call fcn.14000d2f0
mov rdx, qword [r14]
mov qword [rsp + 0x248], rdx
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov dword [rsp + 0x8c], eax
mov rcx, qword [r14]
movsxd rdx, dword [rcx - 0xc]
mov dword [rsp + 0x10c], edx
mov qword [rsp + 0x250], rcx
test rcx, rcx
jne 0x1400070f8
mov eax, r12d
mov dword [rsp + 0x80], eax
jmp 0x14000710d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov dword [rsp + 0x80], eax
test eax, eax
js 0x1400075e9
mov rcx, qword [r14]
cmp eax, dword [rcx - 0xc]
jg 0x1400075e9
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r14]
mov word [rax + rcx*2], r12w
test ebx, ebx
jne 0x14000717d
lea rcx, str.CreateChildProcess_CreateProcess
call fcn.140007600
lea rdx, str.Error:_CreateChildProcess_CreateProcess_Fail
mov rcx, r15
call fcn.14000c8e0
or dword [rsp + 0x50], 1
mov rax, qword [r14]
sub rax, 0x18
mov qword [rsp + 0x160], rax
lock xadd dword [rax + 0x10], edi
sub edi, 1
jg 0x140007175
mov rdx, qword [rsp + 0x160]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140007543
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, eax
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140007227
lea rax, [rsp + 0x168]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x260], rax
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x168]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.CommonUtils_CreateChildProcess_Error:_Executed_command_but_couldnt_get_exit_code:
lea rcx, [rsp + 0x170]
call fcn.14000c8e0
nop
mov r8d, dword [rsp + 0x88]
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140007293
lea rax, [rsp + 0x178]
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x270], rax
lea rdx, [0x140099090]
lea rcx, [rsp + 0x178]
call fcn.14000c8e0
mov rbx, rax
lea rdx, str.CreateChildProcess_Error:_g_hChildStd_OUT_Wr_Pipe_Close_failure
lea rcx, [rsp + 0x180]
call fcn.14000c8e0
nop
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call fcn.14005c860
lea rdx, [0x140098d49]
lea rcx, [rsp + 0x58]
call fcn.14000c8e0
nop
nop word [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x90]
mov r8d, 0x1000
lea rdx, [rsp + 0x330]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x8c], eax
test eax, eax
je 0x140007451
mov r8d, dword [rsp + 0x90]
test r8d, r8d
je 0x140007451
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x190]
call fcn.14000c7d0
mov qword [rsp + 0x278], rax
mov r15, qword [rax]
movsxd rcx, dword [r15 - 0x10]
mov qword [rsp + 0x280], r15
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x188], r15
mov r12, r15
mov rax, qword [rsp + 0x58]
sub r12, rax
sar r12, 1
mov qword [rsp + 0x288], r12
mov r13d, dword [rax - 0x10]
test ecx, ecx
js 0x1400075c0
test r15, r15
jne 0x14000735d
xor esi, esi
mov dword [rsp + 0x60], esi
jmp 0x140007375
mov rdx, rcx
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rsi, rax
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x58]
mov ecx, 0x7fffffff
sub ecx, esi
cmp ecx, r13d
jl 0x1400075ca
lea ebx, [rsi + r13]
mov dword [rsp + 0x110], ebx
test ebx, ebx
js 0x1400075d4
lea rcx, [rax - 0x18]
mov qword [rsp + 0x290], rcx
mov edx, 1
sub edx, dword [rcx + 0x10]
mov dword [rsp + 0x114], edx
mov ecx, dword [rcx + 0xc]
sub ecx, ebx
mov dword [rsp + 0x118], ecx
or ecx, edx
jge 0x1400073d4
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.14000d2f0
mov rax, qword [rsp + 0x58]
cmp r12, r13
ja 0x1400073e5
lea r15, [rax + r12*2]
mov qword [rsp + 0x188], r15
movsxd rdx, esi
add rdx, rdx
lea rcx, [rax + r13*2]
mov r9, rdx
mov r8, r15
call fcn.14000dc80
mov rax, qword [rsp + 0x58]
cmp ebx, dword [rax - 0xc]
jg 0x1400075de
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsp + 0x58]
xor r12d, r12d
mov word [rax + rcx*2], r12w
mov rcx, qword [rsp + 0x190]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x198], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14000744c
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400072b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000746c
lea rcx, str.CreateChildProcess_Error:_Pipe_Close_failure
call fcn.140007600
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x298], rcx
call fcn.14000d260
mov qword [rsp + 0x2a0], rax
add rax, 0x18
mov r15, qword [rsp + 0xa0]
mov qword [r15], rax
or dword [rsp + 0x50], 1
mov rcx, qword [rsp + 0x58]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x1a8], rcx
mov eax, edi
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400074cd
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [r14]
sub rax, 0x18
mov qword [rsp + 0x1b0], rax
lock xadd dword [rax + 0x10], edi
sub edi, 1
jg 0x1400074f7
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, r15
jmp 0x140007543
mov rcx, qword [rsp + 0x1330]
xor rcx, rsp
call fcn.1400693e0
lea r11, [rsp + 0x1340]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
mov ecx, 0x80070057
call fcn.14000df80
nop
mov ecx, 0x80070057
call fcn.14000df80
int3