Function at 0x1400060ed
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x7e8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x780], rcx
mov qword [rbp + 0x788], rdx
lea rax, [rbp + 0x760]
sub rax, 0x790
add rax, 0x1f
shr rax, 5
shl rax, 5
mov rbx, rax
lea rax, [rbp + 0x610]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp + 0x610], 0x18
mov dword [rbp + 0x620], 1
mov qword [rbp + 0x618], 0
lea rcx, [rbp + 0x610]
lea rdx, [rbp + 0x628]
lea rax, [rbp + 0x630]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
sete al
test al, al
je 0x1400063d0
lea rax, [rbp + 0x63d]
mov qword [rbp + 0x700], rax
nop
nop
movabs rax, 0xbf5aa0fa7c008e80
mov qword [rbp + 0x720], rax
mov rax, qword [rbp + 0x720]
mov qword [rbp + 0x720], rax
mov rax, qword [rbp + 0x720]
mov qword [rbx + 0x140], rax
movabs rax, 0x6ecaa8db535d5e68
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x718]
mov qword [rbp + 0x718], rax
mov rax, qword [rbp + 0x718]
mov qword [rbx + 0x148], rax
movabs rax, 0xaa6dcb1c4ad33489
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x710]
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x710]
mov qword [rbx + 0x150], rax
movabs rdx, 0xfc566c9e7e394ca
mov qword [rbp + 0x708], rdx
mov rax, qword [rbp + 0x708]
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov qword [rbx + 0x158], rax
nop
movabs rax, 0xd60ac58e1d65fcc3
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbp + 0x758], rax
mov rax, qword [rbp + 0x758]
mov qword [rbx + 0x120], rax
movabs rax, 0x7abcefb7a753b18
mov qword [rbp + 0x750], rax
mov rax, qword [rbp + 0x750]
mov qword [rbp + 0x750], rax
mov rax, qword [rbp + 0x750]
mov qword [rbx + 0x128], rax
movabs rax, 0xaa6dcb1c40b751e5
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbx + 0x130], rax
mov qword [rbp + 0x740], rdx
mov rax, qword [rbp + 0x740]
mov qword [rbp + 0x740], rax
mov rax, qword [rbp + 0x740]
mov qword [rbx + 0x138], rax
lea rax, [rbx + 0x120]
mov qword [rbp + 0x738], rax
mov rax, qword [rbp + 0x738]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x140]
mov qword [rbp + 0x730], rax
mov rax, qword [rbp + 0x730]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x100], ymm0
vmovdqa ymmword [rbx + 0xe0], ymm1
vmovdqa ymm1, ymmword [rbx + 0x100]
vmovdqa ymm0, ymmword [rbx + 0xe0]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x140]
mov qword [rbp + 0x728], rax
vmovdqa ymmword [rbx + 0xc0], ymm0
mov rax, qword [rbp + 0x728]
vmovdqa ymm0, ymmword [rbx + 0xc0]
vmovdqa ymmword [rax], ymm0
nop
lea rdx, [rbx + 0x140]
lea rcx, [rbp + 0x63d]
mov rax, qword [rbp + 0x780]
mov r8, rcx
mov rcx, rax
call fcn.1400b8ec0
nop
lea rax, [rbp + 0x63d]
mov rcx, rax
call fcn.1400a8ec0
jmp 0x140006a8a
mov rax, qword [rbp + 0x630]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
test eax, eax
sete al
test al, al
je 0x140006637
lea rax, [rbp + 0x63e]
mov qword [rbp + 0x6a0], rax
nop
nop
movabs rax, 0xba6eabef55119990
mov qword [rbp + 0x6c0], rax
mov rax, qword [rbp + 0x6c0]
mov qword [rbp + 0x6c0], rax
mov rax, qword [rbp + 0x6c0]
mov qword [rbx + 0x140], rax
movabs rax, 0x66c6bc941c1b727d
mov qword [rbp + 0x6b8], rax
mov rax, qword [rbp + 0x6b8]
mov qword [rbp + 0x6b8], rax
mov rax, qword [rbp + 0x6b8]
mov qword [rbx + 0x148], rax
movabs rax, 0xcc4de2342ed83891
mov qword [rbp + 0x6b0], rax
mov rax, qword [rbp + 0x6b0]
mov qword [rbp + 0x6b0], rax
mov rax, qword [rbp + 0x6b0]
mov qword [rbx + 0x150], rax
movabs rax, 0xfc56cad828ffdab
mov qword [rbp + 0x6a8], rax
mov rax, qword [rbp + 0x6a8]
mov qword [rbp + 0x6a8], rax
mov rax, qword [rbp + 0x6a8]
mov qword [rbx + 0x158], rax
nop
movabs rax, 0xd60ac58e1d65fcc3
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbp + 0x6f8], rax
mov rax, qword [rbp + 0x6f8]
mov qword [rbx + 0x120], rax
movabs rax, 0x7abcefb7a753b18
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov qword [rbx + 0x128], rax
movabs rax, 0xaa6dcb1c40b751e5
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp + 0x6e8]
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp + 0x6e8]
mov qword [rbx + 0x130], rax
movabs rax, 0xfc566c9e7e394ca
mov qword [rbp + 0x6e0], rax
mov rax, qword [rbp + 0x6e0]
mov qword [rbp + 0x6e0], rax
mov rax, qword [rbp + 0x6e0]
mov qword [rbx + 0x138], rax
lea rax, [rbx + 0x120]
mov qword [rbp + 0x6d8], rax
mov rax, qword [rbp + 0x6d8]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x140]
mov qword [rbp + 0x6d0], rax
mov rax, qword [rbp + 0x6d0]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0xa0], ymm0
vmovdqa ymmword [rbx + 0x80], ymm1
vmovdqa ymm1, ymmword [rbx + 0xa0]
vmovdqa ymm0, ymmword [rbx + 0x80]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x140]
mov qword [rbp + 0x6c8], rax
vmovdqa ymmword [rbx + 0x60], ymm0
mov rax, qword [rbp + 0x6c8]
vmovdqa ymm0, ymmword [rbx + 0x60]
vmovdqa ymmword [rax], ymm0
nop
lea rdx, [rbx + 0x140]
lea rcx, [rbp + 0x63e]
mov rax, qword [rbp + 0x780]
mov r8, rcx
mov rcx, rax
call fcn.1400b8ec0
nop
lea rax, [rbp + 0x63e]
mov rcx, rax
call fcn.1400a8ec0
jmp 0x140006a8a
lea rax, [rbp + 0x580]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rbp + 0x580], 0x68
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x5e0], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x5d8], rax
mov eax, dword [rbp + 0x5bc]
or ah, 1
mov dword [rbp + 0x5bc], eax
mov rax, qword [rbp + 0x788]
mov rcx, rax
call fcn.14003d160
mov rdx, rax
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x580]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x14000691d
lea rax, [rbp + 0x63f]
mov qword [rbp + 0x640], rax
nop
nop
movabs rax, 0xa45aa0fa7c008e80
mov qword [rbp + 0x660], rax
mov rax, qword [rbp + 0x660]
mov qword [rbp + 0x660], rax
mov rax, qword [rbp + 0x660]
mov qword [rbx + 0x140], rax
movabs rax, 0x2782e68809105877
mov qword [rbp + 0x658], rax
mov rax, qword [rbp + 0x658]
mov qword [rbp + 0x658], rax
mov rax, qword [rbp + 0x658]
mov qword [rbx + 0x148], rax
movabs rax, 0xaa67af792cde3083
mov qword [rbp + 0x650], rax
mov rax, qword [rbp + 0x650]
mov qword [rbp + 0x650], rax
mov rax, qword [rbp + 0x650]
mov qword [rbx + 0x150], rax
movabs rdx, 0xfc566c9e7e394ca
mov qword [rbp + 0x648], rdx
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov qword [rbx + 0x158], rax
nop
movabs rax, 0xd60ac58e1d65fcc3
mov qword [rbp + 0x698], rax
mov rax, qword [rbp + 0x698]
mov qword [rbp + 0x698], rax
mov rax, qword [rbp + 0x698]
mov qword [rbx + 0x120], rax
movabs rax, 0x7abcefb7a753b18
mov qword [rbp + 0x690], rax
mov rax, qword [rbp + 0x690]
mov qword [rbp + 0x690], rax
mov rax, qword [rbp + 0x690]
mov qword [rbx + 0x128], rax
movabs rax, 0xaa6dcb1c40b751e5
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
mov qword [rbx + 0x130], rax
mov qword [rbp + 0x680], rdx
mov rax, qword [rbp + 0x680]
mov qword [rbp + 0x680], rax
mov rax, qword [rbp + 0x680]
mov qword [rbx + 0x138], rax
lea rax, [rbx + 0x120]
mov qword [rbp + 0x678], rax
mov rax, qword [rbp + 0x678]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x140]
mov qword [rbp + 0x670], rax
mov rax, qword [rbp + 0x670]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x40], ymm0
vmovdqa ymmword [rbx + 0x20], ymm1
vmovdqa ymm1, ymmword [rbx + 0x40]
vmovdqa ymm0, ymmword [rbx + 0x20]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x140]
mov qword [rbp + 0x668], rax
vmovdqa ymmword [rbx], ymm0
mov rax, qword [rbp + 0x668]
vmovdqa ymm0, ymmword [rbx]
vmovdqa ymmword [rax], ymm0
nop
lea rdx, [rbx + 0x140]
lea rcx, [rbp + 0x63f]
mov rax, qword [rbp + 0x780]
mov r8, rcx
mov rcx, rax
call fcn.1400b8ec0
nop
lea rax, [rbp + 0x63f]
mov rcx, rax
call fcn.1400a8ec0
jmp 0x140006a8a
mov rax, qword [rbp + 0x628]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400b8c00
jmp 0x140006962
mov eax, dword [rbp + 0x17c]
mov ecx, eax
lea rdx, [rbp + 0x180]
lea rax, [rbp + 0x150]
mov r8, rcx
mov rcx, rax
call fcn.1400b6ee0
mov rax, qword [rbp + 0x630]
lea rcx, [rbp + 0x17c]
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x1400069aa
mov eax, dword [rbp + 0x17c]
test eax, eax
je 0x1400069aa
mov eax, 1
jmp 0x1400069af
mov eax, 0
test al, al
jne 0x140006941
mov rax, qword [rbp + 0x5f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x5f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x630]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [rbp + 0x150]
mov rax, qword [rbp + 0x780]
mov rcx, rax
call fcn.1400b86d0
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.1400b9710
jmp 0x140006a8a
mov rax, qword [rbp + 0x780]
add rsp, 0x7e8
pop rbx
pop rbp
ret