Function at 0x140056f80
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x1401bb040]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov r14, rdx
mov rbx, rcx
mov qword [rbp - 0x60], rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov dword [rsp + 0x50], edi
cmp qword [0x1401bb108], rdi
je 0x14005700e
cmp qword [0x1401bbf20], rdi
je 0x14005700e
cmp qword [0x1401bbf60], rdi
je 0x14005700e
cmp qword [0x1401bbf40], rdi
je 0x14005700e
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov r8d, 0x18
lea rdx, str.Serials_already_fetched.
call fcn.140036f60
jmp 0x1400572b2
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x140057024
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp - 0x30], 0x18
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 1
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
jne 0x140057077
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call fcn.140036f60
jmp 0x1400572b2
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x10], xmm1
movups xmmword [rbp], xmm1
movups xmmword [rbp + 0x10], xmm1
movaps xmmword [rbp + 0x20], xmm1
movups xmmword [rbp + 0x30], xmm1
movups xmmword [rbp + 0x40], xmm1
mov dword [rbp - 0x10], 0x68
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
psrldq xmm1, 0xc
movd eax, xmm1
or eax, 0x101
mov dword [rbp + 0x2c], eax
mov word [rbp + 0x30], di
mov r12, qword [r14 + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r12
cmp rax, 0xb
jb 0x1400578ce
cmp qword [r14 + 0x18], 0xf
jbe 0x1400570ec
mov r14, qword [r14]
movups xmmword [rbp + 0x88], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x98], xmm1
lea r15, [r12 + 0xb]
mov edi, 0xf
lea rsi, [rbp + 0x88]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r15, rdi
jbe 0x140057190
mov rdi, r15
or rdi, 0xf
cmp rdi, r13
jbe 0x140057155
mov rdi, r13
add rax, 0x27
mov rcx, rax
call fcn.1400702a8
test rax, rax
je 0x1400578b5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140057189
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140057169
xor esi, esi
jmp 0x140057189
cmp rcx, 0x1000
jb 0x140057181
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400578c2
jmp 0x140057136
call fcn.1400702a8
mov rsi, rax
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], rdi
movsd xmm0, qword [str.cmd.exe__C]
movsd qword [rsi], xmm0
movzx ecx, word [0x1401a9578]
mov word [rsi + 8], cx
movzx eax, byte [0x1401a957a]
mov byte [rsi + 0xa], al
lea rcx, [rsi + 0xb]
mov r8, r12
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r15], 0
mov r15d, 8
mov dword [rsp + 0x50], r15d
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400572df
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call fcn.140036f60
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400572b2
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400572ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400578b5
call fcn.140070060
mov rax, rbx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14006fc80
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], dil
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x80]
mov r8d, 0x7f
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400573a1
nop word [rax + rax]
mov eax, dword [rbp + 0x80]
test eax, eax
je 0x1400573a1
cmp rax, 0x80
jae 0x1400578d4
mov byte [rbp + rax + 0x1b0], 0
lea rax, [rbp + 0x1b0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140057360
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x60]
call fcn.14005fcd0
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x80]
mov r8d, 0x7f
lea rdx, [rbp + 0x1b0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140057330
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x78]
mov qword [rsp + 0x58], rdx
cmp rdx, 0xf
cmova rdi, r12
mov rsi, qword [rbp + 0x70]
cmp rsi, 0xc
jb 0x140057433
lea r14, [rdi + rsi]
lea r8, [r14 - 0xb]
sub r8, rdi
mov rcx, rdi
mov edx, 0x53
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14005742f
movabs rcx, 0x754e6c6169726553
cmp qword [rax], rcx
jne 0x140057417
cmp dword [rax + 8], 0x7265626d
je 0x140057426
inc rax
lea r8, [r14 - 0xb]
sub r8, rax
mov rcx, rax
jmp 0x1400573f0
sub rax, rdi
mov rdx, qword [rbp + 0x78]
jmp 0x14005743a
mov rdx, qword [rbp + 0x78]
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x140057502
lea rcx, [rax + 0xd]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
cmp rsi, rcx
jb 0x1400578da
sub rsi, rcx
mov r8, 0xffffffffffffffff
cmp rsi, r8
cmovb r8, rsi
lea rax, [rbp + 0x60]
cmp rdx, 0xf
cmova rax, r12
lea rdx, [rax + rcx]
lea rcx, [rsp + 0x60]
call fcn.140036f60
mov r15d, 0x18
mov dword [rsp + 0x50], r15d
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x1400574d3
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057816
call fcn.140070060
movups xmm2, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x60], xmm2
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdx, xmm0
mov qword [rsp + 0x58], rdx
movq rsi, xmm1
movq r12, xmm2
lea r14, [rbp + 0x60]
cmp rdx, 0xf
cmova r14, r12
lea rdi, str.__n_r_t
test rsi, rsi
je 0x14005757c
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
lea rbx, [0x1401a95a0]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0xb0], 1
inc rcx
cmp rcx, rbx
jne 0x140057540
lea rcx, [r14 + rsi]
mov rdx, r14
cmp r14, rcx
mov rbx, qword [rbp - 0x60]
jae 0x14005757c
movzx eax, byte [rdx]
cmp byte [rbp + rax + 0xb0], 0
je 0x14005762f
inc rdx
cmp rdx, rcx
jb 0x140057563
mov rdx, 0xffffffffffffffff
cmp rsi, rdx
cmovb rdx, rsi
lea rcx, [rbp + 0x60]
cmp qword [rsp + 0x58], 0xf
cmova rcx, r12
sub rsi, rdx
lea r8, [rsi + 1]
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x70], rsi
lea r14, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r14, r12
test rsi, rsi
je 0x140057637
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1401a95a0]
nop dword [rax]
movzx eax, byte [rdi]
mov byte [rbp + rax + 0xb0], 1
inc rdi
cmp rdi, rcx
jne 0x1400575e0
lea rax, [rsi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, r14
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0xb0], 0
je 0x14005762a
cmp rcx, r14
je 0x140057637
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0xb0], 0
jne 0x140057615
sub rcx, r14
jmp 0x14005763e
sub rdx, r14
jmp 0x140057583
mov rcx, 0xffffffffffffffff
inc rcx
cmp rsi, rcx
jb 0x1400578da
mov qword [rbp + 0x70], rcx
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rax, r12
mov byte [rax + rcx], 0
mov rdi, qword [rbp + 0x70]
xorps xmm0, xmm0
test rdi, rdi
jne 0x14005769e
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r8d, 7
lea rdx, str.Unknown
lea rcx, [rsp + 0x60]
call fcn.140036f60
lea rax, [rsp + 0x60]
or r15d, 2
jmp 0x140057770
movups xmmword [rbp - 0x80], xmm0
lea rsi, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rsi, qword [rbp + 0x60]
cmp rdi, r13
ja 0x1400578bc
cmp rdi, 0xf
ja 0x1400576d7
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
jmp 0x140057768
mov rax, rdi
or rax, 0xf
cmp rax, r13
jbe 0x140057713
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400702a8
mov rcx, rax
test rax, rax
je 0x140057816
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14005774d
mov r13, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x140057730
xor eax, eax
jmp 0x14005774d
cmp rcx, 0x1000
jb 0x140057748
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400578c8
jmp 0x1400576f1
call fcn.1400702a8
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], r13
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x80]
or r15d, 4
xor edi, edi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
or r15d, 1
test r15b, 4
je 0x1400577dc
and r15d, 0xfffffffb
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400577dc
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400577d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400577d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140070060
nop
test r15b, 2
je 0x140057823
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140057823
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005781d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005781d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140070060
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140057861
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005785c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005785c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140070060
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400572b2
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400572ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400572ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400335a0
nop
call fcn.140024a10
nop
call fcn.140024a10
nop
call fcn.1400335a0
nop
call fcn.14006fec8
int3
call fcn.140040180
int3