Function at 0x6df9db08
Capabilities:
Create pipe
Create process on windows
Create process suspended
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1cc
lea eax, [ebp - 0x90]
lea edx, [ebp - 0x76]
mov dword [esp], edx
mov ecx, eax
call method.AntiVirtualMachine.CheckForVMwareAndVirtualBox__::lambda__1::operator___abi:cxx11____const
sub esp, 4
lea eax, [ebp - 0x90]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x90]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x9c], 0xc
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 1
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x9c]
mov dword [esp + 8], eax
lea eax, [ebp - 0xa4]
mov dword [esp + 4], eax
lea eax, [ebp - 0xa0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0xe8]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0xe8], 0x44
mov eax, dword [ebp - 0xbc]
or ah, 1
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0xf8]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0xf8]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0xe8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x6df9de92
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
lea eax, [ebp - 0x75]
mov ecx, eax
call fcn.6dfe8430
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x75]
mov dword [esp + 4], edx
mov dword [esp], 0x6e040118
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 0x75]
mov ecx, eax
call sym.std::allocator_char_::allocator__
jmp 0x6df9dcd8
mov byte [ebp - 0x111], 0
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x190]
mov dword [esp], edx
mov ecx, eax
call fcn.6e01f3d0
sub esp, 4
mov eax, dword [ebp - 0xa0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7f
lea edx, [ebp - 0x190]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
test eax, eax
setne al
test al, al
jne 0x6df9dcb8
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xf8]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0xf8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xf4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
lea eax, [ebp - 0x110]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin__
mov esi, eax
lea eax, [ebp - 0x110]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end__
mov ebx, eax
lea eax, [ebp - 0x110]
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin__
mov edx, dword [sym.imp.msvcrt.dll_tolower]
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call method.__gnu_cxx::__normal_iterator_char__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______std::transform___gnu_cxx::__normal_iterator_char__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___
mov ebx, 0
mov byte [ebp - 0x199], 0
lea eax, [ebp - 0x74]
lea edx, [ebp - 0x59]
mov dword [esp], edx
mov ecx, eax
call method.AntiVirtualMachine.CheckForVMwareAndVirtualBox__::lambda__2::operator___abi:cxx11____const
sub esp, 4
mov ebx, 1
lea eax, [ebp - 0x110]
mov dword [esp + 4], 0
lea edx, [ebp - 0x74]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__unsigned_int__const
sub esp, 8
cmp eax, 0xffffffff
jne 0x6df9de33
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x3d]
mov dword [esp], edx
mov ecx, eax
call method.AntiVirtualMachine.CheckForVMwareAndVirtualBox__::lambda__3::operator___abi:cxx11____const
sub esp, 4
mov byte [ebp - 0x199], 1
lea eax, [ebp - 0x110]
mov dword [esp + 4], 0
lea edx, [ebp - 0x58]
mov dword [esp], edx
mov ecx, eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__unsigned_int__const
sub esp, 8
cmp eax, 0xffffffff
je 0x6df9de3c
mov byte [ebp - 0x19a], 1
jmp 0x6df9de43
mov byte [ebp - 0x19a], 0
cmp byte [ebp - 0x199], 0
je 0x6df9de56
lea eax, [ebp - 0x58]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
test bl, bl
je 0x6df9de64
lea eax, [ebp - 0x74]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp byte [ebp - 0x19a], 0
je 0x6df9de79
mov edi, 1
mov ebx, 0
jmp 0x6df9de7e
mov ebx, 1
lea eax, [ebp - 0x110]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp ebx, 1
jne 0x6df9dedf
jmp 0x6df9deda
lea eax, [ebp - 0x3c]
lea edx, [ebp - 0x21]
mov dword [esp], edx
mov ecx, eax
call method.AntiVirtualMachine.CheckForVMwareAndVirtualBox__::lambda__4::operator___abi:cxx11____const
sub esp, 4
lea eax, [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp], 0x6e03f0e0
call method.std::basic_ostream_char__std::char_traits_char____std::operator____char__std::char_traits_char___std.allocator_char____std::basic_ostream_char__std::char_traits_char_____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char
mov dword [esp], method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call method.std::ostream.operator___std::ostream____std::ostream__
sub esp, 4
lea eax, [ebp - 0x3c]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov edi, 0
jmp 0x6df9dedf
mov edi, 0
mov eax, edi
jmp 0x6df9df4f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret