Function at 0x403821
Capabilities:
Create pipe
Create process on windows
Get common file path
Read file on windows
Read pipe
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x428
xor r15d, r15d
xor r12d, r12d
mov eax, r15d
mov r13, r8
lea r8, [rsp + 0x90]
mov rbx, rcx
mov ecx, 6
mov rdi, r8
mov dword [rsp + 0x478], edx
lea rdx, [rsp + 0x70]
rep stosd dword [rdi], eax
mov qword [rsp + 0x488], r9
lea rcx, [rsp + 0x68]
mov r9d, 0x100000
mov dword [rsp + 0x90], 0x18
mov dword [rsp + 0xa0], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x403cd3
lea rsi, [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rdi, rsi
mov eax, r15d
mov ecx, 0x16
rep stosd dword [rdi], eax
lea rbp, [rsp + 0x78]
mov ecx, 6
mov dword [rsp + 0xa8], 0x68
mov dword [rsp + 0xe4], 0x100
mov rdi, rbp
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x70]
mov rcx, r13
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x100], rax
call fcn.004023a5
mov r12, rax
test rax, rax
je 0x403cbe
mov rcx, rax
call sub.msvcrt.dll_wcslen
lea r15, [rax + 0x401]
lea rcx, [r15 + r15]
call fcn.00404f00
mov r13, rax
test rax, rax
je 0x403cb3
lea rcx, [0x0040a5c0]
call fcn.00405bb0
mov r9, r12
mov rdx, r15
mov rcx, r13
mov r8, rax
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x218]
call fcn.004022f0
mov r8, qword [rsp + 0x58]
mov rcx, r8
call fcn.00405c32
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x48], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rdx, r13
xor ecx, ecx
xor ebp, ebp
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403ca8
mov rcx, qword [rsp + 0x78]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, r12
call fcn.0040371e
mov dword [rsp + 0x60], 0
mov rdi, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov esi, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
je 0x403a2e
cmp dword [rsp + 0x60], 0
jne 0x403a2e
cmp ebp, 0x33
je 0x403a2e
mov ecx, 0x64
inc ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4039ed
xor edi, edi
cmp dword [rsp + 0x60], 0
jne 0x403a8a
test esi, esi
je 0x403a7d
mov rdx, r15
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r15
call fcn.0040241e
mov r14, rax
test rax, rax
je 0x403a73
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasb al, byte [rdi]
mov rax, rcx
not rax
add eax, 2
mov dword [rsp + 0x60], eax
jmp 0x403a85
mov dword [rsp + 0x60], 1
jmp 0x403a85
mov dword [rsp + 0x60], 0x14
mov edi, 1
mov eax, dword [rsp + 0x60]
lea ecx, [rax + 1]
call fcn.00404f00
mov rbp, rax
test rax, rax
je 0x403c83
test edi, edi
je 0x403af7
test esi, esi
je 0x403ad3
test r14, r14
je 0x403b18
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rcx, rbp
lea rdx, [0x0040a5e5]
call sub.msvcrt.dll_strcat
mov rcx, r14
call fcn.00404f58
jmp 0x403b18
lea rcx, [0x0040a5e8]
call fcn.00405b30
mov rcx, rbp
mov r14, rax
mov rdx, rax
call sub.msvcrt.dll_strcpy
mov rcx, r14
call fcn.00405c32
jmp 0x403b18
mov r8d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov rdx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x60]
inc rcx
add rcx, rcx
call fcn.00404f00
mov r14, rax
test rax, rax
je 0x403c78
mov eax, dword [rsp + 0x60]
or r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 1
mov qword [rsp + 0x20], r14
inc eax
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, r14
call fcn.0040230e
mov r15, rax
test rax, rax
je 0x403c6d
mov ecx, dword [rsp + 0x60]
test ecx, ecx
jne 0x403b79
xor esi, esi
jmp 0x403c62
add rcx, 0x201
add rcx, rcx
call fcn.00404f00
mov rsi, rax
test rax, rax
je 0x403b72
mov eax, dword [rbx]
or rcx, 0xffffffffffffffff
mov rdi, r15
lea r9, [rsi + 0x24]
mov rdx, r15
mov dword [rsi + 4], eax
mov eax, dword [rbx + 4]
xor ebx, ebx
mov dword [rsi + 8], eax
movabs rax, 0x400000002
mov qword [rsi + 0xc], rax
mov eax, dword [rsp + 0x478]
mov dword [rsi + 0x14], eax
mov eax, ebx
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, r9
call fcn.004015b5
mov dword [rsi + 0x18], 0x24
xor r8d, r8d
lea rcx, [rsi + 4]
mov dword [rsi + 0x1c], eax
lea edx, [rax + 3]
and edx, 0xfffffffc
lea eax, [rdx + 0x24]
add edx, 0x20
mov dword [rsp + 0x60], eax
call fcn.00401d90
cmp dword [rsp + 0x490], 0
mov dword [rsi], eax
je 0x403c54
mov rdi, qword [rsp + 0x488]
mov eax, ebx
or rcx, 0xffffffffffffffff
lea r11, [rsp + 0x116]
mov rdx, qword [rsp + 0x488]
repne scasb al, byte [rdi]
mov qword [rsp + 0x58], r11
not rcx
lea r8, [rcx - 1]
mov rcx, r11
call fcn.00405270
mov r11, qword [rsp + 0x58]
mov r8, rsi
mov rdx, rsi
mov r9d, dword [rsp + 0x60]
mov rcx, r11
call fcn.004052c5
mov rax, qword [rsp + 0x498]
mov edx, dword [rsp + 0x60]
mov dword [rax], edx
mov rcx, r15
mov r15, rsi
call fcn.00404f58
mov rcx, r14
mov r14, r15
call fcn.00404f58
mov rcx, rbp
mov rbp, r14
call fcn.00404f58
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x80]
call rbx
mov rcx, r13
mov r13, rbp
call fcn.00404f58
mov rcx, r12
mov r12, r13
call fcn.00404f58
mov rcx, qword [rsp + 0x70]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rax, r12
add rsp, 0x428
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret