Function at 0x140003d34
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov rsi, rcx
mov ebp, edx
mov r12, r8
mov qword [rsp + 0x4a8], r9
mov qword [rsp + 0x390], 0
mov qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], 0
mov dword [rsp + 0x390], 0x18
mov dword [rsp + 0x3a0], 1
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x388]
mov r9d, 0x100000
lea r8, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebx, 0
test eax, eax
je 0x140003f48
mov r8d, 0
mov edx, 1
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
lea rdx, [rsp + 0x3d0]
mov ecx, 0xb
mov eax, 0
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rsp + 0x3b0], 0
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x3c0], 0
mov dword [rsp + 0x3d0], 0x68
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x428], rax
mov dword [rsp + 0x40c], 0x100
mov rcx, r12
call fcn.1400028ad
mov rbx, rax
test rax, rax
je 0x140003f2d
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea r12, [rax + 0x401]
lea rcx, [r12 + r12]
call fcn.140004e20
mov rdi, rax
test rax, rax
je 0x140003f22
lea rcx, [0x140018708]
call fcn.140005cd5
mov r13, rax
mov r9, rbx
mov r8, rax
mov rdx, r12
mov rcx, rdi
call fcn.1400027f0
mov rcx, r13
call fcn.140005d5c
lea r12, [rsp + 0x170]
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rdi
mov ecx, 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r12d, 0
test eax, eax
jne 0x140003f5f
mov rcx, rdi
call fcn.140004e72
mov rdi, r12
mov rcx, rbx
call fcn.140004e72
mov rbx, rdi
mov rcx, qword [rsp + 0x380]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x388]
call rsi
mov rax, rbx
add rsp, 0x448
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x1388
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call fcn.140003bf0
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x37c], 0
lea r14, [rsp + 0x37c]
mov r13, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003fad
mov ecx, 0x64
call r15
add r12d, 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, qword [rsp + 0x388]
call r13
test eax, eax
je 0x140003feb
cmp dword [rsp + 0x37c], 0
jne 0x140003feb
cmp r12d, 0x32
jbe 0x140003fa1
mov eax, dword [rsp + 0x37c]
test eax, eax
jne 0x1400041d2
cmp dword [rsp + 0x5c], 0
jne 0x14000404c
mov dword [rsp + 0x37c], 0x14
mov ecx, 0x15
call fcn.140004e20
mov r12, rax
test rax, rax
je 0x14000429b
lea rcx, [0x14001872d]
call fcn.140005c50
mov r13, rax
mov rdx, rax
mov rcx, r12
call sub.msvcrt.dll_strcpy
mov rcx, r13
call fcn.140005d5c
mov r13, r12
jmp 0x140004213
lea r12, [rsp + 0x170]
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r12
call fcn.14000292d
mov r12, rax
test rax, rax
je 0x1400040c8
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 3]
mov dword [rsp + 0x37c], edx
lea ecx, [rax + 4]
call fcn.140004e20
mov r13, rax
test rax, rax
je 0x1400040c0
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r13
call sub.msvcrt.dll_strlen
add rax, r13
mov word [rax], 0xa0d
mov byte [rax + 2], 0
mov rcx, r12
call fcn.140004e72
jmp 0x140004213
mov r12, rax
jmp 0x14000429b
mov dword [rsp + 0x37c], 1
mov ecx, 2
call fcn.140004e20
mov r13, rax
test rax, rax
jne 0x140004213
mov r12, rax
jmp 0x14000429b
mov eax, eax
lea rcx, [rax + rax + 0x402]
call fcn.140004e20
mov r15, rax
test rax, rax
je 0x140004280
mov eax, dword [rsi]
mov dword [r15 + 4], eax
mov eax, dword [rsi + 4]
mov dword [r15 + 8], eax
mov dword [r15 + 0xc], 2
mov dword [r15 + 0x10], 4
mov dword [r15 + 0x14], ebp
mov rcx, r14
call sub.msvcrt.dll_strlen
lea rcx, [r15 + 0x24]
mov r8d, eax
mov rdx, r14
call fcn.14000159e
mov dword [r15 + 0x18], 0x24
mov dword [r15 + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea edx, [rax + 0x24]
mov dword [rsp + 0x37c], edx
lea edx, [rax + 0x20]
lea rcx, [r15 + 4]
mov r8d, 0
call fcn.1400021d0
mov dword [r15], eax
cmp dword [rsp + 0x4b0], 0
jne 0x140004195
mov rax, qword [rsp + 0x4b8]
mov edx, dword [rsp + 0x37c]
mov dword [rax], edx
jmp 0x140004280
mov rcx, qword [rsp + 0x4a8]
call sub.msvcrt.dll_strlen
mov r8, rax
lea rsi, [rsp + 0x60]
mov rdx, qword [rsp + 0x4a8]
mov rcx, rsi
call fcn.140005210
mov r9d, dword [rsp + 0x37c]
mov r8, r15
mov rdx, r15
mov rcx, rsi
call fcn.14000527c
jmp 0x14000417f
lea ecx, [rax + 1]
call fcn.140004e20
mov r12, rax
test rax, rax
je 0x14000429b
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x378]
mov r8d, dword [rsp + 0x37c]
mov rdx, r12
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r13, r12
mov eax, dword [rsp + 0x37c]
lea rcx, [rax + rax + 2]
call fcn.140004e20
mov r12, rax
test rax, rax
je 0x140004293
mov eax, dword [rsp + 0x37c]
add eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, 0xffffffff
mov r8, r13
mov edx, 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r12
call fcn.14000280d
mov r14, rax
mov r15, rax
test rax, rax
je 0x140004288
mov eax, dword [rsp + 0x37c]
mov r15d, 0
test eax, eax
jne 0x1400040f1
mov rcx, r14
call fcn.140004e72
mov rcx, r12
call fcn.140004e72
mov r12, r15
mov rcx, r13
call fcn.140004e72
mov edx, 0
mov rcx, qword [rsp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x3b0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x3b8]
call rsi
jmp 0x140003f17