Function at 0x180005628
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Get common file path
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x530
mov edi, r9d
mov ebx, r8d
mov r13, rdx
xor esi, esi
mov byte [rax - 0x438], sil
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rax - 0x437]
call fcn.18001cca0
mov r15, qword [rsp + 0x598]
mov edx, dword [r15]
mov r9, r13
lea r8, str._r_n__s__r_n
mov r14, qword [rsp + 0x590]
mov rcx, r14
call fcn.18001d890
lea r12d, [rsi + 7]
mov r8d, r12d
lea rdx, str.runexe
mov rcx, r13
call fcn.18001e570
test eax, eax
jne 0x180005707
lea r8, [r13 + 7]
mov edx, 0x400
lea rcx, [rsp + 0x130]
call fcn.18001d58c
lea rdx, [0x180035aa0]
lea rcx, [rsp + 0x130]
call fcn.18001e600
test eax, eax
jne 0x180005966
mov edx, dword [r15]
lea r8, str.usage:_r_n__runexe_1.exe_r_n_r_n
mov rcx, r14
call fcn.18001d5f0
mov rcx, r14
call fcn.18001d680
mov dword [r15], eax
mov eax, 1
jmp 0x180005b9f
mov r8, r12
lea rdx, str.rundll
mov rcx, r13
call fcn.18001e570
test eax, eax
jne 0x180005881
mov rcx, r13
call fcn.18001d680
cmp rax, 9
jae 0x180005746
lea r8, str.illegal_command_r_n_r_n
mov edx, dword [r15]
mov rcx, r14
call fcn.18001d5f0
jmp 0x18000587c
lea r8, [r13 + 7]
mov edx, 0x400
lea rcx, [rsp + 0x130]
call fcn.18001d58c
lea rdx, [0x180035aa0]
lea rcx, [rsp + 0x130]
call fcn.18001e600
test eax, eax
jne 0x18000577d
lea r8, str.usage:_r_n__rundll_1.dll_DllMain_r_n_r_n
jmp 0x180005736
lea rdx, [0x180035b0c]
lea rcx, [rsp + 0x130]
call fcn.18001e668
mov r12, rax
test rax, rax
je 0x18000572f
mov byte [rax], sil
inc r12
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
jne 0x1800057f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call fcn.18001d680
mov ebx, dword [r15]
sub rbx, rax
mov rcx, r14
call fcn.18001d680
add rax, r14
mov r9d, edi
lea r8, str.error:0x_x_r_n_r_n
mov rdx, rbx
mov rcx, rax
call fcn.18001d890
jmp 0x18000587c
lea rdx, str.DllMain
mov rcx, r12
call fcn.18001e600
test eax, eax
je 0x180005844
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180005842
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call fcn.18001d680
mov ebx, dword [r15]
sub rbx, rax
mov rcx, r14
call fcn.18001d680
mov dword [rsp + 0x20], edi
mov r9, r12
lea r8, str.find__s_error:0x_x_r_n_r_n
jmp 0x18000586e
call rax
mov rcx, r14
call fcn.18001d680
mov ebx, dword [r15]
sub rbx, rax
mov rcx, r14
call fcn.18001d680
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x130]
lea r8, str.load__s__s__ok._r_n_r_n
add rax, r14
mov rdx, rbx
mov rcx, rax
call fcn.18001d890
jmp 0x1800056f2
mov r12d, 0x400
mov edx, r12d
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.cmd.exe
mov edx, r12d
lea rcx, [rsp + 0x130]
call fcn.18001d5f0
mov dword [rsp + 0x90], esi
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x94]
call fcn.18001cca0
lea r8, [rsp + 0x90]
xor edx, edx
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
cmp eax, 0xffffffff
jne 0x18000593c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call fcn.18001d680
mov ebx, dword [r15]
sub rbx, rax
mov rcx, r14
call fcn.18001d680
lea rcx, [r14 + rax]
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x130]
lea r8, str._s_not_exist:_0x_x_r_n_r_n
mov rdx, rbx
call fcn.18001d890
mov rcx, r14
call fcn.18001d680
mov dword [r15], eax
mov ebx, dword [rsp + 0x580]
mov edi, dword [rsp + 0x588]
lea r8, str.__c
mov rdx, r12
lea rcx, [rsp + 0x130]
call fcn.18001d5f0
mov r8, r13
mov rdx, r12
lea rcx, [rsp + 0x130]
call fcn.18001d5f0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x78], 0x18
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x88], 1
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1800059ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call fcn.18001d680
mov ebx, dword [r15]
sub rbx, rax
mov rcx, r14
call fcn.18001d680
lea rcx, [r14 + rax]
mov r9d, edi
lea r8, str.open_pipe_error:_0x_x_r_n_r_n
mov rdx, rbx
call fcn.18001d890
mov rcx, r14
call fcn.18001d680
mov dword [r15], eax
xor eax, eax
jmp 0x180005b9f
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0xc8]
call fcn.18001cca0
mov qword [rsp + 0x60], rsi
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x118], rax
mov word [rsp + 0x100], si
mov dword [rsp + 0xc0], 0x68
mov dword [rsp + 0xfc], 0x101
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x180005b7e
test ebx, ebx
je 0x180005b7e
imul edx, edi, 0x3e8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x570], esi
mov dword [rsp + 0x598], esi
mov rcx, r14
call fcn.18001d680
mov rbx, rax
cmp dword [r15], eax
jbe 0x180005b53
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x598]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180005b53
cmp dword [rsp + 0x598], esi
jbe 0x180005b53
mov r8d, dword [r15]
sub r8d, ebx
mov edx, ebx
add rdx, r14
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x570]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180005b53
cmp dword [rsp + 0x570], esi
jbe 0x180005b53
add ebx, dword [rsp + 0x570]
mov dword [rsp + 0x598], esi
mov edx, 0x3e8
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [r15], ebx
ja 0x180005aca
mov r8d, dword [r15]
sub r8d, ebx
mov ecx, ebx
add rcx, r14
xor edx, edx
call fcn.18001cca0
mov dword [r15], ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x60], rsi
setne sil
mov eax, esi
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret