Function at 0x259e526ad
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x578
xor r12d, r12d
xor r9d, r9d
mov eax, r12d
mov rbp, rdx
lea rdx, [rsp + 0x6c]
mov rsi, rcx
mov ecx, 5
mov rdi, rdx
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x68], 0x18
rep stosd dword [rdi], eax
lea rbx, [rsp + 0x53f]
mov dword [rsp + 0x78], 1
lea rcx, [rsp + 0x58]
and rbx, 0xffffffffffffffe0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x259e52782
movabs rax, 0x79a0c8a2407ddfa0
movabs rdx, 0x10f0add62118ade3
mov qword [rbx + 0x20], rax
movabs rax, 0x2f067e1362eb1384
mov qword [rbx], rdx
movabs rdx, 0x466718334bc376f4
mov qword [rbx + 0x28], rax
movabs rax, 0x377e57586ae0a9a9
mov qword [rbx + 8], rdx
movabs rdx, 0x377e57586084ccc5
mov qword [rbx + 0x30], rax
movabs rax, 0xdea2891563c5d8c6
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm1, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm1, ymmword [rbx]
jmp 0x259e52913
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x259e52816
movabs rax, 0x7c94c3b7696cc8b0
mov qword [rbx + 0x20], rax
movabs rax, 0x270a6a5c2dad3f91
mov qword [rbx + 0x28], rax
movabs rax, 0x515e7e700eeba5b1
mov qword [rbx + 0x30], rax
movabs rax, 0xdea2837106a9b1a7
mov qword [rbx + 0x38], rax
vmovdqa ymm2, ymmword [rbx + 0x20]
movabs rax, 0x10f0add62118ade3
mov qword [rbx], rax
movabs rax, 0x466718334bc376f4
mov qword [rbx + 8], rax
movabs rax, 0x377e57586084ccc5
mov qword [rbx + 0x10], rax
movabs rax, 0xdea2891563c5d8c6
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm2, ymmword [rbx]
jmp 0x259e52913
lea rdx, [rsp + 0xbc]
mov eax, r12d
mov ecx, 0x15
xor r9d, r9d
mov rdi, rdx
lea r8, [rsp + 0xb8]
mov dword [rsp + 0xb8], 0x68
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov rdx, qword [rbp]
mov dword [rsp + 0xf4], 0x100
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x259e52929
movabs rax, 0x62a0c8a2407ddfa0
movabs rdx, 0x10f0add62118ade3
mov qword [rbx + 0x20], rax
movabs rax, 0x664e304038a6159b
mov qword [rbx], rdx
movabs rdx, 0x466718334bc376f4
mov qword [rbx + 0x28], rax
movabs rax, 0x3774333d0cedada3
mov qword [rbx + 8], rdx
movabs rdx, 0x377e57586084ccc5
mov qword [rbx + 0x30], rax
movabs rax, 0xdea2891563c5d8c6
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x38], rax
vmovdqa ymm3, ymmword [rbx + 0x20]
mov qword [rbx + 0x18], rax
vpxor ymm0, ymm3, ymmword [rbx]
vmovdqa ymmword [rbx + 0x20], ymm0
lea rdx, [rbx + 0x20]
mov rcx, rsi
call fcn.259e516f2
jmp 0x259e529ee
mov rcx, qword [rsp + 0x60]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r12, [rsp + 0x54]
lea rbp, [rsp + 0x120]
call rdi
lea rax, [rsp + 0xa8]
xor edx, edx
mov byte [rsp + 0xa8], 0
mov qword [rsp + 0x98], rax
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0xa0], rdx
xor eax, eax
mov rcx, qword [rsp + 0x58]
mov r9, r12
mov r8d, 0x400
mov qword [rsp + 0x20], rax
mov rdx, rbp
lea rbx, [rsp + 0x98]
call r13
test eax, eax
je 0x259e529ab
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x259e529ab
mov rdx, rbp
mov rcx, rbx
call fcn.259efd410
jmp 0x259e5296d
mov rcx, qword [rsp + 0x80]
call rdi
mov rcx, qword [rsp + 0x88]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov rcx, rsi
mov rdx, rbx
call fcn.259efec00
mov rcx, rbx
call fcn.259efbe80
jmp 0x259e529ee
mov rax, rsi
add rsp, 0x578
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret