Function at 0x14002b760
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140045028]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
xor r14d, r14d
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x60]
call fcn.140003d30
nop
lea rdx, str.powershell.exe
lea rcx, [rbp + 0x60]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._ExecutionPolicy_Bypass
lea rcx, [rbp + 0x60]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._Command___Get_WmiObject__Class_Win32_Processor__Select_Object_NumberOfCores_.NumberOfCores_
lea rcx, [rbp + 0x60]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
mov dword [rbp - 4], 1
mov word [rbp], r14w
mov dword [rbp - 0x78], 0x18
mov qword [rbp - 0x70], r14
mov dword [rbp - 0x68], 1
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
or dword [rbp - 4], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x68]
call fcn.140003ec0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002b90c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b907
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b907
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
test ebx, ebx
je 0x14002bc11
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x150], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x151], xmm0
movups xmmword [rbp + 0x161], xmm0
movups xmmword [rbp + 0x171], xmm0
movups xmmword [rbp + 0x181], xmm0
movups xmmword [rbp + 0x191], xmm0
movups xmmword [rbp + 0x1a1], xmm0
movups xmmword [rbp + 0x1b1], xmm0
mov qword [rbp + 0x1c1], rax
mov dword [rbp + 0x1c9], eax
mov word [rbp + 0x1cd], ax
mov byte [rbp + 0x1cf], al
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
xor r8d, r8d
lea rdx, [0x140034d50]
lea rcx, [rbp + 0x38]
call fcn.1400027e0
nop
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x30]
mov r8d, 0x80
lea rdx, [rbp + 0x150]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002ba33
nop dword [rax]
cmp dword [rbp + 0x30], 0
jbe 0x14002ba33
lea rax, [rbp + 0x150]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002b9f4
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x38]
call fcn.140003f70
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x30]
mov r8d, 0x80
lea rdx, [rbp + 0x150]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b9e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbp + 0x38]
mov r8, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
cmovae rdi, r8
add rdi, qword [rbp + 0x48]
lea rbx, [rbp + 0x38]
cmp rdx, 0x10
cmovae rbx, r8
add rbx, qword [rbp + 0x48]
lea rcx, [rbp + 0x38]
cmp rdx, 0x10
cmovae rcx, r8
mov r8b, 0xa
mov rdx, rbx
call fcn.14002e8f0
mov r8, rax
cmp rax, rbx
je 0x14002baa6
inc rax
cmp rax, rbx
je 0x14002baa6
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14002ba9e
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x14002ba90
lea rax, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rax, qword [rbp + 0x38]
mov r9, r8
sub r9, rax
sub rdi, r8
mov rbx, qword [rbp + 0x48]
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rcx, qword [rbp + 0x38]
add rcx, r9
sub rbx, rdi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x48], rbx
test rbx, rbx
jne 0x14002bb3a
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r8d, [rbx + 0x19]
lea rdx, str.Computer::GetCPUCoreCount
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_CPU_core_count
lea rcx, [rsp + 0x50]
call fcn.14001dc60
jmp 0x14002bbd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rbx, qword [rbp + 0x38]
mov dword [rax], r14d
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
cmp rbx, qword [rsp + 0x70]
jne 0x14002bb7d
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x14002bb90
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov dword [rsi], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x19
lea rdx, str.Computer::GetCPUCoreCount
lea rcx, [rsp + 0x50]
call fcn.1400027e0
mov r8d, dword [rsi]
lea rdx, str.Got_CPU_core_count__d
lea rcx, [rsp + 0x50]
call fcn.14001da20
mov bl, 1
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x14002bc4d
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bc0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002bc0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
jmp 0x14002bc4d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x19
lea rdx, str.Computer::GetCPUCoreCount
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_CPU_core_count
lea rcx, [rsp + 0x50]
call fcn.14001dc60
xor bl, bl
mov rcx, qword [rbp + 0x60]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rdx + 0x60], rax
mov rcx, qword [rbp + 0x60]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rbp + rdx + 0x5c], r8d
lea rcx, [rbp + 0x68]
call fcn.140003c70
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
movzx eax, bl
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14002eb10
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret