Function at 0x140057020
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov r13, r8
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r14b
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x60], Ordinal_26
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], 1
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [rbp - 0x80], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x44], 1
mov word [rbp - 0x40], r14w
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x30], rax
or dword [rbp - 0x44], 0x100
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.wmic_diskdrive_get_serialnumber
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140057222
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x158]
mov r8d, 0x80
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400571ff
nop
mov eax, dword [rbp + 0x158]
test eax, eax
je 0x1400571ff
mov esi, eax
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1400571c0
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1400571a7
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
lea rdx, [rbp + 0x10]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x1400571d4
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.1400645d0
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x158]
mov r8d, 0x80
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140057170
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005724f
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.CreateProcess_failed_
mov rcx, rbx
call fcn.1400634b0
mov r15, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140057260
mov rcx, qword [rbx]
mov qword [rsp + 0x20], sendto
lea r9, str.SerialNumber
xor r8d, r8d
mov rdx, r15
call fcn.140064500
mov rdi, rax
mov rsi, r15
cmp rax, 0xffffffffffffffff
je 0x140057378
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140057298
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 1
lea r9, reloc.WS2_32.dll_ioctlsocket
mov r8, rdi
mov rdx, r15
call fcn.140064500
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140057378
mov rsi, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400572cd
mov rsi, qword [rbx]
cmp r14, r15
jae 0x140057332
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14010bd50]
lea rdx, [0x14010bd52]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x10], 1
inc rcx
cmp rcx, rdx
jne 0x140057300
lea rcx, [r15 + rsi]
lea rdx, [rsi + r14]
cmp rdx, rcx
jae 0x140057332
nop dword [rax]
movzx eax, byte [rdx]
cmp byte [rbp + rax + 0x10], 0
je 0x14005738e
inc rdx
cmp rdx, rcx
jb 0x140057320
mov rsi, r15
cmp r15, rdi
jb 0x1400574d8
sub r14, rdi
mov rax, rsi
sub rax, rdi
cmp rax, r14
cmovb r14, rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14005735b
mov rax, qword [rbx]
lea rcx, [rax + rdi]
sub rsi, r14
lea rdx, [rcx + r14]
mov r8, rsi
sub r8, rdi
inc r8
call sub.VCRUNTIME140.dll_memmove
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 0xf
jbe 0x1400573cc
mov r15, qword [rbx]
mov rdi, r15
lea r14, [rsi + r15]
add r15, rsi
jmp 0x1400573d7
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
je 0x140057332
mov rsi, r15
cmp r15, rdi
jb 0x1400574d8
sub rdx, rdi
mov rax, r15
sub rax, rdi
cmp rax, rdx
cmovb rdx, rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400573c0
mov rax, qword [rbx]
lea rcx, [rax + rdi]
sub rsi, rdx
add rdx, rcx
jmp 0x140057366
mov rdi, rbx
lea r14, [rsi + rbx]
lea r15, [rsi + rbx]
cmp rdi, r14
je 0x140057420
nop dword [rax]
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x1400573f5
inc rdi
cmp rdi, r14
jne 0x1400573e0
cmp rdi, r14
je 0x140057420
lea rsi, [rdi + 1]
cmp rsi, r14
je 0x140057420
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x140057418
movzx eax, byte [rsi]
mov byte [rdi], al
inc rdi
inc rsi
cmp rsi, r14
jne 0x140057403
sub r15, rdi
mov rsi, qword [rbx + 0x10]
mov rax, rsi
cmp qword [rbx + 0x18], 0xf
jbe 0x140057443
sub rdi, qword [rbx]
sub rax, rdi
cmp rax, r15
cmovb r15, rax
mov rax, qword [rbx]
jmp 0x140057453
sub rdi, rbx
sub rax, rdi
cmp rax, r15
cmovb r15, rax
mov rax, rbx
lea rcx, [rax + rdi]
sub rsi, r15
mov r8, rsi
sub r8, rdi
inc r8
lea rdx, [rcx + r15]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbx + 0x10], rsi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x1400574a7
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x1400574a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400574d1
mov rcx, r8
call fcn.1400d3fd0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rax, rbx
add rsp, 0x210
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400636a0
int3