Function at 0x14005ab30
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov r13, r8
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x50], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r14b
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x60], Ordinal_26
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], 1
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov dword [rbp - 0x80], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x44], 1
mov word [rbp - 0x40], r14w
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x30], rax
or dword [rbp - 0x44], 0x100
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.wmic_diskdrive_get_serialnumber
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14005ad33
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x168]
mov r8d, 0x80
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005ad10
mov eax, dword [rbp + 0x168]
test eax, eax
je 0x14005ad10
mov esi, eax
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14005acd1
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14005acb8
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x14005ace5
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.14006ac50
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x168]
mov r8d, 0x80
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14005ac81
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005ad60
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.CreateProcess_failed_
mov rcx, rdi
call fcn.140068ec0
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
mov r12, qword [rdi + 0x18]
cmp r12, 0x10
jb 0x14005ad74
mov rcx, qword [rdi]
mov qword [rsp + 0x20], send
lea r9, str.SerialNumber
xor r8d, r8d
mov rdx, rbx
call fcn.14006aa30
mov r14, rax
mov rsi, rbx
cmp rax, 0xffffffffffffffff
je 0x14005ae87
mov rcx, rdi
cmp r12, 0x10
jb 0x14005adab
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 1
lea r9, reloc.WS2_32.dll_ioctlsocket
mov r8, r14
mov rdx, rbx
call fcn.14006aa30
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14005ae87
mov rsi, rdi
cmp r12, 0x10
jb 0x14005addf
mov rsi, qword [rdi]
cmp r15, rbx
jae 0x14005ae42
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14011aeb8]
lea rdx, [0x14011aeba]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x10], 1
inc rcx
cmp rcx, rdx
jne 0x14005ae10
lea rcx, [rsi + rbx]
lea rdx, [rsi + r15]
cmp rdx, rcx
jae 0x14005ae42
nop dword [rax]
movzx eax, byte [rdx]
cmp byte [rbp + rax + 0x10], 0
je 0x14005ae9d
inc rdx
cmp rdx, rcx
jb 0x14005ae30
cmp rbx, r14
jb 0x14005afea
sub r15, r14
mov rax, rbx
sub rax, r14
cmp rax, r15
cmovb r15, rax
mov rsi, rbx
mov rax, rdi
cmp r12, 0x10
jb 0x14005ae6a
mov rax, qword [rdi]
lea rcx, [rax + r14]
sub rsi, r15
lea rdx, [rcx + r15]
mov r8, rsi
sub r8, r14
inc r8
call sub.VCRUNTIME140.dll_memmove
mov qword [rdi + 0x10], rsi
cmp qword [rdi + 0x18], 0x10
jb 0x14005aeda
mov r15, qword [rdi]
mov rbx, r15
lea r14, [rsi + r15]
add r15, rsi
jmp 0x14005aee5
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
je 0x14005ae42
cmp rbx, r14
jb 0x14005afea
sub rdx, r14
mov rax, rbx
sub rax, r14
cmp rax, rdx
cmovb rdx, rax
mov rsi, rbx
mov rax, rdi
cmp r12, 0x10
jb 0x14005aece
mov rax, qword [rdi]
lea rcx, [rax + r14]
sub rsi, rdx
add rdx, rcx
jmp 0x14005ae75
mov rbx, rdi
lea r14, [rdi + rsi]
lea r15, [rsi + rdi]
cmp rbx, r14
je 0x14005af30
nop word [rax + rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x14005af05
inc rbx
cmp rbx, r14
jne 0x14005aef0
cmp rbx, r14
je 0x14005af30
lea rsi, [rbx + 1]
cmp rsi, r14
je 0x14005af30
movsx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x14005af28
movzx eax, byte [rsi]
mov byte [rbx], al
inc rbx
inc rsi
cmp rsi, r14
jne 0x14005af13
sub r15, rbx
mov rsi, qword [rdi + 0x10]
mov rax, rsi
cmp qword [rdi + 0x18], 0x10
jb 0x14005af53
sub rbx, qword [rdi]
sub rax, rbx
cmp rax, r15
cmovb r15, rax
mov rax, qword [rdi]
jmp 0x14005af63
sub rbx, rdi
sub rax, rbx
cmp rax, r15
cmovb r15, rax
mov rax, rdi
lea rcx, [rax + rbx]
sub rsi, r15
mov r8, rsi
sub r8, rbx
inc r8
lea rdx, [rcx + r15]
call sub.VCRUNTIME140.dll_memmove
mov qword [rdi + 0x10], rsi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14005afb7
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14005afb2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005afe3
mov rcx, r8
call fcn.1400e2dc0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r13], 0
mov rax, rdi
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140069120
int3