Function at 0x1400bf610
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1120
call fcn.1400edbb0
sub rsp, rax
mov rbx, rdx
mov rax, qword [0x140121d20]
mov qword [rsp + 0x110], rax
movups xmm0, xmmword [0x140121d10]
movaps xmmword [rsp + 0x100], xmm0
xor edi, edi
mov qword [rsp + 0xf0], rdi
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x80], rdi
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
call fcn.140103e10
test rax, rax
je 0x1400bf8bb
mov r15, rax
lea r14, [rsp + 0xe8]
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x100]
xor edi, edi
mov rdx, r14
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400bf8b3
mov rcx, qword [rsp + 0x60]
xor esi, esi
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rsp + 0x90], Ordinal_113
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
or byte [rsp + 0xcd], 1
test rbx, rbx
je 0x1400bf735
lea rcx, [rsp + 0x68]
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1400bf881
mov rsi, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x8000400
mov dword [rsp + 0x28], 1
mov rcx, rbx
xor edx, edx
mov r8, r15
xor r9d, r9d
call qword [sym.imp.advapi32.dll_CreateProcessAsUserW]
mov edi, eax
test eax, eax
je 0x1400bf85c
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x120]
lea r9, [rsp + 0x5c]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bf835
cmp dword [rsp + 0x5c], 0
je 0x1400bf835
xor esi, esi
lea rbx, [0x140165f40]
lea r14, [rsp + 0x120]
lea r12, [rsp + 0x5c]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
movzx edx, byte [rsp + rsi + 0x120]
mov rcx, rbx
call fcn.140016430
inc rsi
mov eax, dword [rsp + 0x5c]
cmp rsi, rax
jb 0x1400bf7ec
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8d, 0x1000
mov r9, r12
call r13
test eax, eax
je 0x1400bf835
cmp dword [rsp + 0x5c], 0
mov esi, 0
jne 0x1400bf7ec
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x70]
call rsi
jmp 0x1400bf870
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140165f50]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400bf895
call sub.USERENV.dll_DestroyEnvironmentBlock
jmp 0x1400bf895
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140165fa0]
mov edx, eax
call fcn.140016430
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x1400bf8b3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.1401062bc
mov eax, edi
add rsp, 0x1120
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret