Function at 0x18005bc50
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1290]
mov eax, 0x1390
call fcn.18008f2e0
sub rsp, rax
mov rax, qword [0x1800a3d18]
xor rax, rsp
mov qword [rbp + 0x1280], rax
mov r14d, dword [rbp + 0x1300]
xor ebx, ebx
mov rax, qword [rbp + 0x12f8]
mov r10, r8
mov r15, qword [rbp + 0x12f0]
mov r12d, r14d
mov rdi, qword [rbp - 0x78]
lea r13d, [r14 + 0x15]
mov qword [rbp - 0x50], r9
mov r9d, dword [rsp + 0x70]
mov qword [rbp - 0x70], r8
mov r8, rcx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x58], rcx
mov dword [rsp + 0x54], r9d
cmp r14d, r13d
jae 0x18005c2b7
mov ecx, dword [rsp + 0x70]
lea r8d, [rbx + 0x6c]
mov qword [rsp + 0x68], rax
add r14d, 0xffffff67
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x50], ecx
lea rdx, [0x180000000]
mov r11d, 0x5f
lea esi, [r11 + 0x18]
cmp r14d, 0x59
ja case.0x18005bd3d.21
movzx eax, byte [rdx + r14 + 0x5c878]
mov ecx, dword [rdx + rax*4 + 0x5c820]
add rcx, rdx
jmp rcx
mov word [rbp + 0x82], r8w
jmp case.0x18005bd3d.21
cmp qword [r10], rbx
jne case.0x18005bd3d.21
mov esi, 0xf4
cmp esi, 0xf4
je 0x18005bd6b
cmp esi, 0x4964
jne 0x18005bda0
mov rax, rbx
jmp 0x18005c002
lea rax, [rsp + 0x78]
mov dword [rsp + 0x78], 1
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r8, [0x180092c27]
mov dword [rbp - 0x80], 6
lea rdx, [rbp - 0x68]
mov dword [rbp - 0x68], ebx
mov ecx, 0xe3
call fcn.18000a640
add esi, 0x4870
cmp esi, 0x90e0
jbe 0x18005bd53
mov r9d, dword [rsp + 0x54]
mov r8d, 0x6c
mov r10, qword [rbp - 0x70]
mov r11, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
inc r12d
inc r14d
cmp r12d, r13d
jb 0x18005bd0f
mov r14d, dword [rbp + 0x1300]
mov r8, qword [rbp - 0x58]
lea r12d, [r14 + 0x4c4]
cmp r14d, r12d
jae 0x18005bfff
mov r13, qword [rbp - 0x50]
nop
cmp r14d, 0x1e1
ja 0x18005c43e
je 0x18005c418
cmp r14d, 0x113
ja 0x18005c39f
je 0x18005c391
mov eax, r14d
sub eax, 0x99
je 0x18005c372
sub eax, 0x2a
je 0x18005c346
sub eax, 0x13
je 0x18005c2fd
sub eax, 0x17
je 0x18005c2eb
cmp eax, 0x13
jne 0x18005c7f8
mov dword [rsp + 0x70], r9d
lea rdx, [rsp + 0x70]
mov r9d, reloc.SHLWAPI.dll_StrCmpICA
xor r8d, r8d
mov rcx, rsi
call fcn.180018080
mov rdi, rsi
jmp 0x18005c7e5
mov dword [rbp + 0x78], 0x320033
jmp case.0x18005bd3d.21
movsxd rcx, r9d
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x68], rax
mov rsi, rax
test rax, rax
jne 0x18005c29e
mov esi, 0x109
nop dword [rax + rax]
mov eax, esi
sub eax, 0x108
je 0x18005bd63
cmp eax, 1
jne 0x18005bef3
mov dword [rbp - 0x68], eax
lea r9, [rbp - 0x80]
lea rax, [rbp - 0x68]
mov dword [rbp - 0x80], 7
lea r8, [0x180092c27]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov ecx, 0xe3
call fcn.18000a640
dec esi
cmp esi, 0x107
ja 0x18005beb0
jmp 0x18005bdae
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
mov qword [rbp + 0x60], rax
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
jmp case.0x18005bd3d.21
mov r9d, 3
mov word [rbp + 0x84], bx
lea rax, [rbp + 0x70]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1a]
call fcn.180010940
mov r10, qword [rbp - 0x70]
mov r11, rax
mov r9d, dword [rsp + 0x54]
mov r8d, 0x6c
mov qword [rsp + 0x60], rax
jmp 0x18005bdc2
mov dword [rbp + 0x7c], 0x64002e
mov word [rbp + 0x80], r8w
jmp case.0x18005bd3d.21
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x53
xor edx, edx
xor ecx, ecx
call fcn.18001c240
jmp 0x18005bdae
mov rcx, qword [r15]
mov edx, dword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
test rcx, rcx
je 0x18005bdcb
mov rax, qword [r15 + 8]
mov qword [rcx + 8], rax
jmp 0x18005bdcb
mov r8d, 2
lea rdx, [0x180093bb6]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18005bdae
mov r9d, 0x57
nop dword [rax]
cmp r9d, 0x57
je 0x18005c02c
cmp r9d, 0x1c8c
jne 0x18005c05c
mov rax, rdi
mov rcx, qword [rbp + 0x1280]
xor rcx, rsp
call fcn.18008f350
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x1390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r15]
test rax, rax
je 0x18005c05c
mov r8d, ebx
cmp dword [rax + 0x18], ebx
jle 0x18005c05c
mov rdx, rbx
nop
mov rcx, qword [rax + 0x20]
lea rdx, [rdx + 8]
mov rax, qword [r10]
inc r8d
mov qword [rdx + rcx - 8], rax
mov rax, qword [r15]
cmp r8d, dword [rax + 0x18]
jl 0x18005c040
add r9d, 0x1c35
cmp r9d, 0x386a
jbe 0x18005bff0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r10, qword [rbp - 0x70]
mov edx, 3
mov rsi, qword [rsp + 0x68]
mov rcx, rax
mov r9d, dword [rsp + 0x54]
mov r11, qword [rsp + 0x60]
lea r8d, [rdx + 0x69]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], edx
jmp 0x18005bdd0
cmp qword [r15], rbx
jne case.0x18005bd3d.21
mov esi, 0x29
nop dword [rax]
cmp esi, 0x29
je 0x18005c0d0
cmp esi, 0xee
je 0x18005c0cb
cmp esi, 0x1b3
je 0x18005bfff
jmp 0x18005c105
mov rdi, rbx
jmp 0x18005c105
lea rax, [rbp - 0x68]
mov dword [rbp - 0x68], 1
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r8, [0x180092c27]
mov dword [rbp - 0x80], 6
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov ecx, 0xe3
call fcn.18000a640
add esi, 0xc5
cmp esi, 0x278
jb 0x18005c0b0
jmp 0x18005bdae
mov r8d, 3
lea rdx, [0x180093c88]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 4
lea rdx, [0x180093d20]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18005bdae
mov r8, qword [r15]
lea rdx, [rsp + 0x70]
mov rax, qword [r10]
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], rax
mov r9d, 0x1d
mov eax, dword [r8]
mov dword [rsp + 0x70], eax
mov r8, qword [r8 + 8]
call fcn.18001b5b0
mov qword [rbp - 0x60], rax
test rax, rax
jne 0x18005bdae
mov esi, 0xbb
nop dword [rax]
cmp esi, 0xbb
je 0x18005c1a6
cmp esi, 0x61e2
je 0x18005bd63
jmp 0x18005c1e6
lea rax, [rbp - 0x68]
mov dword [rbp - 0x68], 1
lea r9, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r8, [0x180092c27]
mov dword [rbp - 0x80], 3
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x78], ebx
mov ecx, 0xe3
call fcn.18000a640
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esi, 0x6127
cmp esi, 0xc24e
jbe 0x18005c190
jmp 0x18005bdae
mov word [rbp + 0x88], bx
jmp case.0x18005bd3d.21
mov dword [rbp + 0x72], 0x320073
mov word [rbp + 0x76], r11w
jmp case.0x18005bd3d.21
mov word [rbp + 0x70], si
jmp case.0x18005bd3d.21
mov rcx, qword [r15 + 8]
test rcx, rcx
jne 0x18005c23f
mov rcx, qword [r15 + 0x18]
mov rax, qword [r15]
mov qword [rcx], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je case.0x18005bd3d.21
mov rax, qword [r15]
mov qword [rcx], rax
jmp case.0x18005bd3d.21
mov r8d, 1
lea rdx, [0x180093d4c]
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r9d, 3
lea rax, [rbp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call fcn.180010940
mov qword [rbp - 0x78], rax
jmp 0x18005bdae
mov rax, qword [r10]
mov r9d, dword [rax + 0x18]
mov dword [rsp + 0x54], r9d
jmp case.0x18005bd3d.21
mov r10, qword [rbp - 0x70]
mov r8d, 0x6c
mov r9d, dword [rsp + 0x54]
mov r11, qword [rsp + 0x60]
jmp 0x18005bdc7
mov rsi, qword [rbp - 0x78]
mov r11, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x78]
mov edx, dword [rsp + 0x70]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x50], edx
jmp 0x18005bdea
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
jmp 0x18005c7f8
mov qword [rsp + 0x30], rbx
lea r8, [r15 + 0x40]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov edx, 0x119
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call fcn.180042520
mov qword [rsp + 0x30], rbx
lea r8, [r15 + 0x58]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov edx, 0x119
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call fcn.180042520
jmp 0x18005c7e5
mov rax, qword [r10]
lea r8, [rsp + 0x70]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x68]
mov rax, qword [rbp - 0x60]
mov r9d, 0xb9
mov rdx, rsi
mov qword [rsp + 0x70], rax
call fcn.180019890
jmp 0x18005c7e5
cmp qword [r15 + 0x20], 0xffffffffffffffff
je 0x18005c7f8
mov rcx, qword [r15 + 0x20]
call r11
mov qword [r15 + 0x20], 0xffffffffffffffff
jmp 0x18005c7e5
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18005c7e5
mov eax, r14d
sub eax, 0x12a
je 0x18005c405
sub eax, 0x13
je 0x18005bfff
sub eax, 0x2a
je 0x18005c3ed
cmp eax, 0x3d
jne 0x18005c7f8
xor r9d, r9d
lea rdx, [rbp - 0x30]
xor r8d, r8d
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea rdx, [rbp - 0x40]
xor r8d, r8d
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x18005c7e5
mov ecx, 0xfffffff4
mov word [rbp + 0x40], bx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x60], rax
jmp 0x18005c7e5
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 0x101
jmp 0x18005c7f8
mov dword [rsp + 0x30], edx
lea r9, [rbp + 0x50]
mov rdx, qword [rbp - 0x38]
mov r8, rcx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x18005c7e5
cmp r14d, 0x312
ja 0x18005c7b0
je 0x18005c696
mov eax, r14d
sub eax, 0x21e
je 0x18005c670
sub eax, 0x3d
je 0x18005c568
sub eax, 0x3d
je 0x18005c518
cmp eax, 0x3d
jne 0x18005c7f8
mov r9, r8
mov qword [rsp + 0x70], 0x1f4
lea r8, [rbp + 0xaa0]
mov edx, 0xe0
lea rcx, [rsp + 0x70]
call fcn.180005b40
test r15, r15
je 0x18005c4f4
mov r9d, IUnknown_GetWindow
mov qword [rsp + 0x70], 0x1f4
lea r8, [rbp + 0x6a0]
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.18008ad40
lea rax, [rbp + 0x2a0]
mov edx, 0x1f4
lea r9, [rbp + 0x6a0]
mov qword [rsp + 0x20], rax
lea r8, str._s___s_
lea rcx, [rbp + 0x4a0]
call fcn.18008e040
jmp 0x18005c7e5
lea r9, [rbp + 0x2a0]
mov edx, 0x1f4
lea r8, str.__s_
lea rcx, [rbp + 0x4a0]
call fcn.18008e040
jmp 0x18005c7e5
mov r9d, IUnknown_GetWindow
mov qword [rsp + 0x70], 0x1f4
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.18008ad40
mov rdx, qword [rbp - 0x58]
lea r8, [rbp + 0x8a0]
mov r9d, IUnknown_GetWindow
mov qword [rsp + 0x70], 0x1f4
lea rcx, [rsp + 0x70]
call fcn.18008ad40
jmp 0x18005c7e5
test r15, r15
jne 0x18005c646
lea rdx, [0x180093db0]
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
test rax, rax
je 0x18005c63f
mov esi, 0xed
cmp esi, 0xed
je 0x18005c624
cmp esi, 0x187
je 0x18005c60d
cmp esi, 0x221
je 0x18005c604
cmp esi, 0x2bb
jne 0x18005c62d
cmp byte [rbp + 0xa0], 0x23
jne 0x18005c5f9
cmp byte [rbp + 0xa1], 0x21
jne 0x18005c5f9
movzx eax, byte [rbp + 0xa2]
lea r15, [rbp + 0xa2]
test al, al
je 0x18005c5f9
nop word [rax + rax]
movzx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18005c5f9
movzx eax, byte [r15 + 1]
inc r15
test al, al
jne 0x18005c5e0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18005c62d
mov byte [rbp + 0x293], 0
jmp 0x18005c62d
mov r8, r14
lea rcx, [rbp + 0xa0]
mov edx, 0x1f4
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
jmp 0x18005c62d
mov word [rbp + 0xa0], 0
add esi, 0x9a
cmp esi, 0x355
jb 0x18005c592
mov r14d, dword [rbp + 0x1300]
mov rax, qword [rbp - 0x70]
lea r8, str._s__s
mov r9, qword [rbp - 0x58]
lea rcx, [rbp + 0xa0]
mov edx, 0x1f4
mov qword [rsp + 0x20], rax
call fcn.18008e040
jmp 0x18005c7e5
mov dword [rsp + 0x30], edx
lea r9, [rbp + 0x58]
mov rdx, qword [rbp - 0x40]
mov r8, rcx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
jmp 0x18005c7e5
lea r9, [rbp + 0x4a0]
mov qword [rsp + 0x70], 0x1f4
lea r8, [rbp + 0xe90]
mov edx, 0xe0
lea rcx, [rsp + 0x70]
call fcn.180005b40
lea rax, [rbp - 0x20]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0xe90]
lea rax, [rbp]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
lea rax, [rbp + 0xaa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18005c769
mov rax, qword [rbp - 0x30]
lea r9, [rsp + 0x70]
mov rsi, qword [rbp - 0x50]
lea r8, [rbp - 0x68]
mov qword [rsp + 0x70], rax
lea rcx, [0x180070f40]
mov edx, 9
mov rax, qword [rsi]
mov qword [rbp - 0x68], rax
call fcn.18004dac0
mov rax, qword [rbp - 0x48]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x70], rax
lea r8, [rbp - 0x68]
mov rax, qword [rsi]
lea rcx, [0x180070f10]
mov edx, 9
mov qword [rbp - 0x68], rax
call fcn.18004dac0
mov r13, rsi
jmp 0x18005c7e5
mov rbx, qword [rbp - 0x78]
mov esi, 0xc5
cmp esi, 0xc5
je 0x18005c794
cmp esi, 0x4c2f
jne 0x18005c79e
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13]
call rbx
jmp 0x18005c79e
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0x4b6a
cmp esi, 0x96d4
jbe 0x18005c772
xor ebx, ebx
jmp 0x18005c7e5
mov eax, r14d
sub eax, 0x34f
je 0x18005c7db
sub eax, 0x3d
je 0x18005c7d5
sub eax, 0x3d
je 0x18005c7cf
cmp eax, 0x3d
je 0x18005bfff
jmp 0x18005c7f8
mov rdi, qword [rbp - 0x20]
jmp 0x18005c7f8
mov rcx, qword [rbp + 0x50]
jmp 0x18005c7df
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
mov r11, qword [rsp + 0x60]
add r14d, 0x3d
mov dword [rbp + 0x1300], r14d
cmp r14d, r12d
jae 0x18005bfff
mov r10, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x68]
mov r8, qword [rbp - 0x58]
jmp 0x18005be00