Function at 0x140036fa1
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
movups xmmword [rsp + 0x180], xmm6
xor eax, eax
mov qword [rsp + 0x1e0], rcx
mov ecx, 0x19
lea rdi, [rsp + 0xb4]
mov ebp, r8d
rep stosd dword [rdi], eax
mov rsi, rdx
mov ebx, r9d
lea rdi, [rsp + 0x80]
mov dword [rsp + 0x98], 0x18
mov ecx, 6
rep stosd dword [rdi], eax
xor edi, edi
lea rcx, str._s_____d._______s
mov dword [rsp + 0xa8], 1
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x78], 0xffffffffffffffff
call fcn.14002810c
test ebp, ebp
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov qword [rsp + 0x50], rax
je 0x14003708d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov r9d, 0x1000
lea r8, [rsp + 0x98]
call qword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x140037080
call r14
mov dword [rsp + 0x118], eax
call fcn.140038579
lea rcx, str.Could_not_set_commandline_pipe:__s
mov rdx, rax
call fcn.1400380b9
jmp 0x1400374ee
mov rdi, qword [rsp + 0x78]
mov r15d, 0x3101
jmp 0x140037092
xor edi, edi
xor r15d, r15d
mov rcx, qword [rsp + 0x1e0]
call fcn.14003585b
mov rcx, rsi
lea rsi, [rsp + 0xb0]
mov r13, rax
call fcn.14003585b
mov dword [rsp + 0xec], r15d
mov ecx, 0x1a
lea r15, [rsp + 0x118]
mov qword [rsp + 0x108], rdi
mov r12, rax
mov qword [rsp + 0x110], rdi
lea rdi, [rsp + 0x118]
mov dword [rsp + 0xb0], 0x68
rep movsd dword [rdi], dword [rsi]
xor esi, esi
call fcn.14003585b
xor ecx, ecx
mov qword [rsp + 0x128], rax
call fcn.14003585b
xor ecx, ecx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x80]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, eax
call r14
mov rcx, qword [rsp + 0x128]
mov edi, eax
test rcx, rcx
je 0x14003716e
call sub.msvcrt.dll_free
xor r11d, r11d
mov qword [rsp + 0x128], r11
mov rcx, qword [rsp + 0x130]
test rcx, rcx
jne 0x14003718a
test r13, r13
je 0x14003719c
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x14003719c
call sub.msvcrt.dll_free
xor r10d, r10d
mov qword [rsp + 0x130], r10
jmp 0x14003717b
test r12, r12
je 0x1400371a9
mov rcx, r12
call sub.msvcrt.dll_free
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
test esi, esi
jne 0x1400371e0
call r14
mov dword [rsp + 0x118], eax
call fcn.140038579
mov rdx, qword [rsp + 0x1e0]
lea rcx, str.Unable_to_launch_command__s:__s
mov r8, rax
call fcn.1400380b9
jmp 0x1400374ee
mov eax, ebp
or eax, ebx
je 0x1400374a3
test ebx, ebx
je 0x140037206
xor r9d, r9d
xor r8d, r8d
xor edx, edx
or ecx, 0xffffffff
mov dword [rsp + 0x20], r9d
xor r9d, r9d
call fcn.140044e4a
mov rax, qword [0x1400b42b0]
mov eax, dword [rax]
test eax, eax
jns 0x1400372a2
cmp ax, 0x4c7
jne 0x1400372a2
mov rcx, qword [rsp + 0x80]
mov edx, 0x4c7
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
jne 0x140037249
call fcn.140038579
lea rcx, str.Could_not_terminate_command:__s
mov rdx, rax
jmp 0x14003728d
mov rcx, qword [rsp + 0x80]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x140037270
lea rcx, str.Command_did_not_terminate_within_timeout_duration
cmp eax, 0x102
je 0x140037277
jmp 0x14003727e
lea rcx, str.Command_was_terminated_by_user
call fcn.1400380b9
jmp 0x140037292
call fcn.140038579
lea rcx, str.Error_while_waiting_for_command_to_be_terminated:__s
mov rdx, rax
call fcn.1400380b9
mov dword [rsp + 0x118], 0x4c7
jmp 0x1400374ee
xor r8d, r8d
lea rax, [rsp + 0x68]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], r8
mov rcx, qword [rsp + 0x70]
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
je 0x14003747f
mov r8d, dword [rsp + 0x68]
test r8d, r8d
je 0x14003747f
lea ecx, [r8 + 1]
mov dword [rsp + 0x5c], r8d
call sub.msvcrt.dll_malloc
mov qword [0x140113f20], rax
mov rdx, rax
test rax, rax
je 0x140037473
xor ecx, ecx
mov r8d, dword [rsp + 0x5c]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x140037473
cmp dword [rsp + 0x64], 0
mov rdx, qword [0x140113f20]
je 0x140037473
mov eax, dword [rsp + 0x68]
mov byte [rdx + rax], 0
test ebx, ebx
je 0x14003745c
mov rcx, qword [rsp + 0x50]
lea rdi, [rsp + 0x6c]
mov r8, rdi
call fcn.1400280a2
inc eax
je 0x14003745c
mov dword [rsp + 0x118], 0
movss xmm6, dword [0x14009a6d8]
xor r13d, r13d
lea r12, [0x14009a386]
mov ecx, r13d
add rcx, qword [0x140113f20]
cmp r13d, dword [rsp + 0x68]
lea esi, [r13 + 1]
jae 0x1400373a1
mov al, byte [rcx]
sub eax, 0x30
cmp al, 9
jbe 0x1400373a1
mov r13d, esi
jmp 0x14003737e
mov r8, r15
mov rdx, r12
call sub.msvcrt.dll_sscanf
movss xmm0, dword [rsp + 0x118]
mulss xmm0, xmm6
comiss xmm0, dword [0x14009a6dc]
jae 0x1400373c9
cvttss2si r8, xmm0
jmp 0x1400373db
subss xmm0, dword [0x14009a6dc]
cvttss2si r8, xmm0
btc r8, 0x3f
xor eax, eax
mov edx, ebx
mov ecx, 4
mov r9d, 0x2710
mov dword [rsp + 0x20], eax
call fcn.140044e4a
mov rdx, qword [0x140113f20]
mov ecx, dword [rsp + 0x68]
add rsi, rdx
mov r8d, r13d
inc r13d
cmp r13d, ecx
jae 0x140037419
mov al, byte [rsi]
inc rsi
cmp al, 0xa
je 0x140037419
cmp al, 0xd
jne 0x140037401
lea esi, [r8 + 2]
mov r13d, esi
cmp esi, ecx
jae 0x140037473
mov al, byte [rdx + rsi]
lea r8, [rsi + 1]
cmp al, 0xa
jne 0x140037434
mov rsi, r8
jmp 0x14003741d
cmp al, 0xd
je 0x14003742f
mov rcx, qword [rsp + 0x50]
add rdx, rsi
mov r8, rdi
call fcn.1400280a2
inc eax
jne 0x14003737e
add rsi, qword [0x140113f20]
mov rdx, rsi
jmp 0x140037467
mov rdx, qword [0x140113f20]
test ebp, ebp
je 0x140037473
lea rcx, [0x14009a38a]
call fcn.1400380b9
mov rcx, qword [0x140113f20]
call sub.msvcrt.dll_free
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x1400374b4
mov ecx, 0x64
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140037206
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
mov rdx, r15
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
jne 0x1400374d3
call r14
mov dword [rsp + 0x118], eax
mov rcx, qword [rsp + 0x80]
mov rbx, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x78]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003750c
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp + 0x78], 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140037521
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0x118]
movups xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret