Function at 0x140002557
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
xor r12d, r12d
xor r9d, r9d
mov eax, r12d
mov rbp, rdx
lea rdx, [rsp + 0x6c]
mov rsi, rcx
mov ecx, 5
mov rdi, rdx
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x68], 0x18
rep stosd dword [rdi], eax
lea rbx, [rsp + 0x53f]
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x58]
and rbx, 0xffffffffffffffe0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000262c
movabs rax, 0x48af685fb45a711a
movabs rdx, 0x21ff0d2bd53f0359
mov qword [rbx + 0x20], rax
movabs rax, 0xc8b54f6e5d62e9d6
mov qword [rbx], rdx
movabs rdx, 0xa1d4294e744a8ca6
mov qword [rbx + 0x28], rax
movabs rax, 0xb1c69015ae200177
mov qword [rbx + 8], rdx
movabs rdx, 0xb1c69015a444641b
mov qword [rbx + 0x30], rax
movabs rax, 0x467604e015de3468
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm1, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm1, ymmword [rbx]
jmp 0x1400027bd
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400026c0
movabs rax, 0x4d9b634a9d4b660a
mov qword [rbx + 0x20], rax
movabs rax, 0xc0b95b211224c5c3
mov qword [rbx + 0x28], rax
movabs rax, 0xd7e6b93dca2b0d6f
mov qword [rbx + 0x30], rax
movabs rax, 0x46760e8470b25d09
mov qword [rbx + 0x38], rax
vmovdqa ymm2, ymmword [rbx + 0x20]
movabs rax, 0x21ff0d2bd53f0359
mov qword [rbx], rax
movabs rax, 0xa1d4294e744a8ca6
mov qword [rbx + 8], rax
movabs rax, 0xb1c69015a444641b
mov qword [rbx + 0x10], rax
movabs rax, 0x467604e015de3468
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm2, ymmword [rbx]
jmp 0x1400027bd
lea rdx, [rsp + 0xbc]
mov eax, r12d
mov ecx, 0x15
xor r9d, r9d
mov rdi, rdx
lea r8, [rsp + 0xb8]
mov dword [rsp + 0xb8], 0x68
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rbp]
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400027d3
movabs rax, 0x53af685fb45a711a
movabs rdx, 0x21ff0d2bd53f0359
mov qword [rbx + 0x20], rax
movabs rax, 0x81fd013d072fefc9
mov qword [rbx], rdx
movabs rdx, 0xa1d4294e744a8ca6
mov qword [rbx + 0x28], rax
movabs rax, 0xb1ccf470c82d057d
mov qword [rbx + 8], rdx
movabs rdx, 0xb1c69015a444641b
mov qword [rbx + 0x30], rax
movabs rax, 0x467604e015de3468
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm3, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm3, ymmword [rbx]
vmovdqa ymmword [rbx + 0x20], ymm0
lea rdx, [rbx + 0x20]
mov rcx, rsi
call fcn.14000181c
jmp 0x140002883
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r12, [rsp + 0x54]
lea rbp, [rsp + 0x120]
call rbx
lea rax, [rsp + 0xa8]
xor edx, edx
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x98], rax
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], rdx
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov r9, r12
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rdx, rbp
lea rdi, [rsp + 0x98]
call r13
test eax, eax
je 0x140002855
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x140002855
mov rdx, rbp
mov rcx, rdi
call fcn.1400abb20
jmp 0x140002817
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, qword [rsp + 0x88]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov rcx, rsi
mov rdx, rdi
call fcn.1400ad310
mov rcx, rdi
call fcn.1400aa4f0
mov rax, rsi
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret