Function at 0x180008c90
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x1800f4040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x90], rcx
xor esi, esi
mov dword [rsp + 0x70], esi
movabs r15, 0x340df92ae9dae193
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
movabs r14, 0xedb025e723ad42b8
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1e8], rax
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], sil
jne 0x180008d60
lea rdx, [rsp + 0x80]
call fcn.180002220
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x130], 0x18
mov qword [rsp + 0x138], rsi
mov dword [rsp + 0x140], 1
xor r9d, r9d
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x180008f72
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
movups xmmword [rsp + 0x180], xmm0
movups xmmword [rsp + 0x190], xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x150], 0x68
mov dword [rsp + 0x18c], 0x101
mov word [rsp + 0x190], si
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x110]
test eax, eax
je 0x180009020
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp + 0x1c0], esi
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1c0]
mov r8d, 0x80
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180008f1c
mov eax, dword [rsp + 0x1c0]
test eax, eax
je 0x180008f1c
cmp rax, 0x80
jae 0x1800090e2
mov byte [rsp + rax + 0x200], 0
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180008f00
lea rdx, [rsp + 0x200]
mov rcx, rbx
call fcn.180014cb0
jmp 0x180008ea0
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800182e0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movabs rax, 0x948cb7087b68cf1
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1e0]
call fcn.1800020a0
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x98]
call fcn.1800017e0
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180002520
lea rdx, [0x1800f15a0]
lea rcx, [rsp + 0xb8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x948cb7087b68cf1
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.1800020a0
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe8]
call fcn.1800017e0
nop
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180002520
lea rdx, [0x1800f15a0]
lea rcx, [rsp + 0xd0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.180018528
int3