Function at 0x180008580
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1140]
mov eax, 0x1240
call fcn.18009f700
sub rsp, rax
mov rax, qword [0x18011e900]
xor rax, rsp
mov qword [rbp + 0x1130], rax
mov rdi, rcx
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov dword [rbp - 0x70], 0x18
mov esi, 1
mov dword [rbp - 0x60], esi
mov qword [rbp - 0x68], r12
xor r9d, r9d
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x180008ad7
xor r8d, r8d
mov edx, esi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x180008ad7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp], xmm1
mov dword [rbp - 0x50], 0x68
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
mov dword [rbp - 0x14], 0x101
mov word [rbp - 0x10], r12w
mov dword [rbp + 0x28], 0x6320432f
mov dword [rbp + 0x22], 0x78652e64
mov dword [rbp + 0x34], 0x6565647a
mov word [rbp + 0x20], 0x6d63
mov dword [rbp + 0x2f], 0x756b6e71
mov word [rbp + 0x38], 0x7876
mov word [rbp + 0x2c], 0x64
mov word [rbp + 0x26], 0x2065
mov byte [rbp + 0x33], 0x62
mov byte [rbp + 0x2e], 0x62
mov word [rbp + 0x108], 0x7472
mov word [rbp + 0x105], 0x636e
mov dword [rbp + 0x12c], 0x76727566
mov dword [rbp + 0x100], 0x67202626
mov dword [rbp + 0x114], 0x6b657472
mov word [rbp + 0x119], 0x6d63
mov dword [rbp + 0x126], 0x73656f72
mov dword [rbp + 0x110], 0x65632066
mov word [rbp + 0x12a], 0x7864
mov dword [rbp + 0x121], 0x666a6274
mov byte [rbp + 0x107], 0x65
mov dword [rbp + 0x10a], 0x6578652e
mov word [rbp + 0x10e], 0x2d20
mov word [rbp + 0x11f], 0x7267
mov word [rbp + 0x11c], 0x646c
mov byte [rbp + 0x11b], 0x66
mov byte [rbp + 0x104], 0x65
mov byte [rbp + 0x125], 0x78
mov byte [rbp + 0x11e], WSAGetLastError
mov byte [rbp + 0x118], r12b
movups xmmword [rbp + 0xe0], xmm0
movdqu xmmword [rbp + 0xf0], xmm1
lea rax, [rbp + 0x100]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x180008770
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xe0]
call fcn.180002820
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x1800087a5
mov rdx, rdi
lea rcx, [rbp + 0xc0]
call fcn.180002820
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x90], xmm1
lea rax, [rbp + 0x20]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800087e0
mov r8, rbx
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.180002820
nop
mov r8, rsi
lea rdx, [0x180106c60]
lea rcx, [rbp + 0x80]
call fcn.1800025b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rbp + 0xc0]
lea r8, [rbp + 0x100]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0xa0]
call fcn.1800120c0
nop
mov r8, rsi
lea rdx, [0x180106c60]
lea rcx, [rbp + 0xa0]
call fcn.1800025b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x20]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x60]
call fcn.1800120c0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1800088e1
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800088db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008de9
call fcn.18009e9ac
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x180008922
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000891d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008def
call fcn.18009e9ac
movdqa xmm0, xmmword [0x180108a10]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x18000897b
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008975
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008df5
call fcn.18009e9ac
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x1800089bc
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800089b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dfb
call fcn.18009e9ac
movdqa xmm0, xmmword [0x180108a10]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x180008a15
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e01
call fcn.18009e9ac
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x180008a56
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008a51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e07
call fcn.18009e9ac
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180008b09
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180008ad7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008ad2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e0d
call fcn.18009e9ac
xor eax, eax
mov rcx, qword [rbp + 0x1130]
xor rcx, rsp
call fcn.18009e950
lea r11, [rsp + 0x1240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x180008a9c
xor sil, sil
mov r14d, r12d
lea r15, str.100_
movabs r13, 0x4e94914f0000
nop
cmp r14d, 0x1e
jg 0x180008d9e
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x130]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180008d3c
mov eax, dword [rsp + 0x54]
test eax, eax
je 0x180008d3c
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x40]
call fcn.180002820
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
lea rcx, [0x180123b40]
call fcn.1800157c0
lea rdi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdi, qword [rbp + 0x40]
mov rax, qword [rbp + 0x50]
cmp rax, 4
jb 0x180008c53
lea rbx, [rax + rdi]
lea r8, [rbx - 3]
sub r8, rdi
mov edx, 0x31
mov rcx, rdi
call fcn.1800daea0
test rax, rax
je 0x180008c53
nop word [rax + rax]
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + rcx]
inc rcx
cmp dl, byte [r15 + rcx - 1]
jne 0x180008c19
cmp rcx, 4
jne 0x180008c00
mov ecx, r12d
jmp 0x180008c1e
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x180008c40
inc rax
lea r8, [rbx - 3]
sub r8, rax
mov edx, 0x31
mov rcx, rax
call fcn.1800daea0
test rax, rax
jne 0x180008bf0
jmp 0x180008c53
sub rax, rdi
movzx esi, sil
cmp rax, 0xffffffffffffffff
mov eax, 1
cmovne esi, eax
inc r14d
lea rcx, [rsp + 0x70]
call fcn.180003940
mov rbx, qword [rsp + 0x70]
movabs rax, 0x7fffffffc46535ff
cmp rbx, rax
jge 0x180008c7d
add rbx, 0x3b9aca00
jmp 0x180008c87
movabs rbx, 0x7fffffffffffffff
lea rcx, [rsp + 0x68]
call fcn.180003940
mov rax, qword [rsp + 0x68]
cmp rax, rbx
jge 0x180008cf8
movabs r12, 0x431bde82d7b634db
mov rcx, rbx
sub rcx, rax
cmp rcx, r13
jl 0x180008cb7
mov ecx, 0x5265c00
jmp 0x180008cdc
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x180008cda
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rsp + 0x68]
call fcn.180003940
mov rax, qword [rsp + 0x68]
cmp rax, rbx
jl 0x180008ca5
xor r12d, r12d
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x180008d33
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008ddd
call fcn.18009e9ac
test sil, sil
je 0x180008b30
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ebx, sil
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180008d97
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008e0d
call fcn.18009e9ac
mov eax, ebx
jmp 0x180008ad9
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x180008ad7
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008ad2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008de3
jmp 0x180008ad2
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
nop
call fcn.1800aebe0
int3