Function at 0x1800ad08b
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
jmp 0x1800ca350
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x3050
call fcn.1800ad6c6
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xa80
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3078]
mov rax, qword [0x18027a640]
xor rax, rbp
mov qword [rbp + 0x2ff8], rax
lea rcx, reloc.WSOCK32.dll_accept
call fcn.1800b4197
mov dword [rbp + 4], 0x2710
lea rax, [rbp + 0x28]
lea rcx, str.ipconfig__all
mov rdi, rax
mov rsi, rcx
mov ecx, recvfrom
rep movsb byte [rdi], byte [rsi]
lea rdx, str.Physical_Address._._._._._._._._._:
lea rcx, [rbp + 0x58]
call fcn.1800afaf2
mov r8d, 8
xor edx, edx
mov rcx, qword [rbp + 0x3020]
call fcn.1800b203b
mov dword [rbp + 0xb8], 0x18
mov qword [rbp + 0xc0], 0
mov dword [rbp + 0xc8], 1
xor r9d, r9d
lea r8, [rbp + 0xb8]
lea rdx, [rbp + 0x108]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0
jne 0x1800ca44b
mov byte [rbp + 0x2f84], 0
lea rcx, [rbp + 0x58]
call fcn.1800ad739
movzx eax, byte [rbp + 0x2f84]
jmp 0x1800ca5ef
mov dword [rbp + 0x130], WSAGetLastError
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x188], rax
xor eax, eax
mov word [rbp + 0x170], ax
mov dword [rbp + 0x16c], 0x101
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x28]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 0
jne 0x1800ca508
mov byte [rbp + 0x2fa4], 0
lea rcx, [rbp + 0x58]
call fcn.1800ad739
movzx eax, byte [rbp + 0x2fa4]
jmp 0x1800ca5ef
lea rcx, [rbp + 0x2928]
call fcn.1800b410b
mov edx, 0x12c
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8d, 0x2711
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.1800b203b
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x2964]
mov r8d, 0x2710
lea rdx, [rbp + 0x1f0]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x94], eax
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x94], 0
jne 0x1800ca5cc
mov byte [rbp + 0x2fc4], 0
lea rcx, [rbp + 0x2928]
call fcn.1800ad739
lea rcx, [rbp + 0x58]
call fcn.1800ad739
movzx eax, byte [rbp + 0x2fc4]
jmp 0x1800ca5ef
mov byte [rbp + 0x2fe4], 1
lea rcx, [rbp + 0x2928]
call fcn.1800ad739
lea rcx, [rbp + 0x58]
call fcn.1800ad739
movzx eax, byte [rbp + 0x2fe4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WSOCK32.dll_inet_addr
call fcn.1800b29eb
mov rax, rdi
mov rcx, qword [rbp + 0x2ff8]
xor rcx, rbp
call fcn.1800afed5
lea rsp, [rbp + 0x3000]
pop rdi
pop rsi
pop rbp
ret