Function at 0x14002bcc0
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x140045028]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
mov rdi, rcx
xor r14d, r14d
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x80]
call fcn.140003d30
nop
lea rdx, str.powershell.exe
lea rcx, [rbp + 0x80]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._ExecutionPolicy_Bypass
lea rcx, [rbp + 0x80]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._Command___Get_WmiObject_Win32_VideoController_.Name_
lea rcx, [rbp + 0x80]
call fcn.140004150
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
mov dword [rbp + 0x1c], 1
mov word [rbp + 0x20], r14w
mov dword [rbp - 0x58], 0x18
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], 1
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
or dword [rbp + 0x1c], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x88]
call fcn.140003ec0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002be6f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002be6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002be6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
test ebx, ebx
je 0x14002c189
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x170], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x171], xmm0
movups xmmword [rbp + 0x181], xmm0
movups xmmword [rbp + 0x191], xmm0
movups xmmword [rbp + 0x1a1], xmm0
movups xmmword [rbp + 0x1b1], xmm0
movups xmmword [rbp + 0x1c1], xmm0
movups xmmword [rbp + 0x1d1], xmm0
mov qword [rbp + 0x1e1], rax
mov dword [rbp + 0x1e9], eax
mov word [rbp + 0x1ed], ax
mov byte [rbp + 0x1ef], al
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
xor r8d, r8d
lea rdx, [0x140034d50]
lea rcx, [rbp + 0x58]
call fcn.1400027e0
nop
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov r8d, 0x80
lea rdx, [rbp + 0x170]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002bf92
nop
cmp dword [rbp + 0x50], 0
jbe 0x14002bf92
lea rax, [rbp + 0x170]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002bf54
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x58]
call fcn.140003f70
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov r8d, 0x80
lea rdx, [rbp + 0x170]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002bf40
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rbp + 0x58]
mov r8, qword [rbp + 0x58]
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
cmovae rsi, r8
add rsi, qword [rbp + 0x68]
lea rbx, [rbp + 0x58]
cmp rdx, 0x10
cmovae rbx, r8
add rbx, qword [rbp + 0x68]
lea rcx, [rbp + 0x58]
cmp rdx, 0x10
cmovae rcx, r8
mov r8b, 0xa
mov rdx, rbx
call fcn.14002e8f0
mov r8, rax
cmp rax, rbx
je 0x14002c006
inc rax
cmp rax, rbx
je 0x14002c006
nop dword [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14002bffe
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x14002bff0
lea rax, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rax, qword [rbp + 0x58]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rbp + 0x68]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x68], rbx
test rbx, rbx
jne 0x14002c09a
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r8d, [rbx + 0x14]
lea rdx, str.Computer::GetGPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_GPU_name
lea rcx, [rsp + 0x50]
call fcn.14001dc60
jmp 0x14002c149
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400024d0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14002dd80
mov rdx, rax
mov rcx, rdi
call fcn.140018820
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002c100
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c0fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002c0fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x14
lea rdx, str.Computer::GetGPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
cmp qword [rdi + 0x18], 0x10
jb 0x14002c133
mov rdi, qword [rdi]
mov r8, rdi
lea rdx, str.Got_GPU_Name__s
lea rcx, [rsp + 0x50]
call fcn.14001da20
mov bl, 1
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14002c1c5
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002c182
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
jmp 0x14002c1c5
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x14
lea rdx, str.Computer::GetGPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_GPU_name
lea rcx, [rsp + 0x50]
call fcn.14001dc60
xor bl, bl
mov rcx, qword [rbp + 0x80]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rdx + 0x80], rax
mov rcx, qword [rbp + 0x80]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rbp + rdx + 0x7c], r8d
lea rcx, [rbp + 0x88]
call fcn.140003c70
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
movzx eax, bl
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14002eb10
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret