Function at 0x10004ed0
Capabilities:
Check if file exists
Create pipe
Create process on windows
Get common file path
Impersonate user
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12b0
call fcn.1000e330
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x206
mov dword [ebp - 0x123c], ecx
mov dword [ebp - 0x1238], eax
lea ecx, [ebp - 0x212]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x1240], edx
mov dword [ebp - 0x1218], ebx
mov dword [ebp - 0x1228], ebx
mov dword [ebp - 0x1230], ebx
mov word [ebp - 0x214], ax
call fcn.1000a660
xor eax, eax
add esp, 0xc
push 0xffff
mov dword [ebp - 0x1250], eax
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1248], eax
mov dword [ebp - 0x1244], eax
lea eax, [ebp - 0x1260]
lea edx, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x1224]
mov dword [ebp - 0x1234], edx
push ecx
lea edx, [ebp - 0x1220]
push edx
mov dword [ebp - 0x1220], ebx
mov dword [ebp - 0x1224], ebx
mov dword [ebp - 0x121c], ebx
mov dword [ebp - 0x122c], ebx
xor esi, esi
mov dword [ebp - 0x1260], 0xc
mov dword [ebp - 0x125c], ebx
mov dword [ebp - 0x1258], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x10005294
mov eax, dword [ebp - 0x1224]
push 1
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x10005294
mov ecx, dword [ebp - 0x1220]
push ebx
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x10005294
push 0x44
lea edx, [ebp - 0x12ac]
push ebx
push edx
call fcn.1000a660
mov ecx, dword [ebp - 0x1220]
xor eax, eax
mov word [ebp - 0x127c], ax
mov eax, dword [ebp - 0x1224]
add esp, 0xc
mov dword [ebp - 0x12ac], 0x44
mov dword [ebp - 0x1280], 0x181
mov dword [ebp - 0x1274], ecx
mov dword [ebp - 0x1270], eax
mov dword [ebp - 0x126c], eax
cmp edi, ebx
je 0x10005133
cmp dword [ebp - 0x123c], ebx
jne 0x1000504e
mov dword [ebp - 0x123c], 0x10010e44
cmp dword [ebp - 0x1238], ebx
jne 0x10005060
mov dword [ebp - 0x1238], 0x10010e50
mov eax, dword [ebp - 0x123c]
mov ecx, dword [ebp - 0x1238]
lea edx, [ebp - 0x1228]
push edx
push ebx
push 2
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x10005294
mov edx, dword [ebp - 0x1228]
push 1
push edx
lea eax, [ebp - 0x1230]
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x10005294
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1254]
push ecx
lea edx, [ebp - 0x214]
push edx
push eax
mov dword [ebp - 0x1254], 0x104
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100050ef
call edi
mov dword [ebp - 0x1218], eax
cmp eax, 2
jne 0x100052a0
mov dword [ebp - 0x1218], ebx
xor eax, eax
jmp 0x100050f5
mov eax, dword [ebp - 0x1234]
lea ecx, [ebp - 0x1250]
push ecx
mov ecx, dword [ebp - 0x1240]
lea edx, [ebp - 0x12ac]
push edx
mov edx, dword [ebp - 0x1228]
push eax
mov eax, dword [ebp - 0x1230]
push eax
push 0x8000400
push ebx
push ebx
push ebx
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x10005162
call edi
jmp 0x1000529a
mov edx, dword [ebp - 0x1240]
lea eax, [ebp - 0x1250]
push eax
lea ecx, [ebp - 0x12ac]
push ecx
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10005294
mov eax, dword [ebp - 0x1224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1220]
push ebx
lea ecx, [ebp - 0x122c]
push ecx
push 0x1000
lea edx, [ebp - 0x1214]
push edx
push eax
mov dword [ebp - 0x1224], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10005257
mov edi, edi
mov eax, dword [ebp - 0x122c]
cmp eax, ebx
je 0x10005257
cmp esi, ebx
jne 0x1000521f
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x1000524d
mov edx, dword [ebp - 0x122c]
mov edi, dword [ebp - 0x121c]
push edx
lea eax, [ebp - 0x1214]
push eax
lea ecx, [esi + edi]
push ecx
call fcn.1000b320
add edi, dword [ebp - 0x122c]
mov ecx, dword [ebp - 0x1220]
add esp, 0xc
push ebx
lea edx, [ebp - 0x122c]
push edx
push 0x1000
lea eax, [ebp - 0x1214]
push eax
push ecx
mov dword [ebp - 0x121c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100051a0
jmp 0x10005257
add eax, dword [ebp - 0x121c]
mov edi, esi
push eax
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
cmp esi, ebx
jne 0x100051cc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x1218], 8
mov edx, dword [ebp - 0x1250]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x1250]
lea eax, [ebp - 0x1218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x1250]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x124c]
push eax
call edi
jmp 0x100052a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1218], eax
mov eax, dword [ebp - 0x1230]
cmp eax, ebx
je 0x100052b1
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [ebp - 0x1228]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x100052c4
push eax
call edi
mov eax, dword [ebp - 0x1220]
cmp eax, ebx
je 0x100052d1
push eax
call edi
mov eax, dword [ebp - 0x1224]
cmp eax, ebx
je 0x100052de
push eax
call edi
mov eax, dword [ebp - 0x121c]
mov ecx, dword [ebp - 0x1218]
add eax, 0x1c
push eax
push 8
mov dword [ebp - 0x1234], ecx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x10005353
mov edx, dword [0x1001461c]
mov ecx, dword [ebp + 8]
mov dword [edi], edx
mov eax, dword [0x10014620]
mov edx, dword [ebp - 0x1234]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x121c]
add eax, 4
mov dword [edi + 8], ecx
mov dword [edi + 0x10], eax
mov dword [edi + 0xc], 0x1f5
mov dword [edi + 0x18], edx
cmp esi, ebx
je 0x10005366
mov eax, dword [ebp - 0x121c]
push eax
lea ecx, [edi + 0x1c]
push esi
push ecx
call fcn.1000b320
add esp, 0xc
cmp esi, ebx
je 0x10005366
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006570
mov esp, ebp
pop ebp
ret