Function at 0x180003de0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1550
call fcn.18002b8c0
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x1590], rbx
mov rax, qword [0x18003f108]
xor rax, rsp
mov qword [rsp + 0x1540], rax
mov r13, r8
mov qword [rsp + 0x78], r8
mov r15, rdx
mov qword [rsp + 0xa8], r8
xor r14d, r14d
mov dword [rsp + 0x60], r14d
call fcn.18000659c
mov rcx, rax
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x180003e5a
mov ecx, 0x80004005
call fcn.180002680
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
call fcn.18000659c
mov rcx, rax
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x180003e89
mov ecx, 0x80004005
call fcn.180002680
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x140], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x141]
call fcn.18001bb30
mov byte [rsp + 0x540], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x541]
call fcn.18001bb30
mov dword [rsp + 0x88], 0x18
mov qword [rsp + 0x90], r14
mov dword [rsp + 0x98], 1
xor r9d, r9d
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180003f82
lea rdx, [0x180034ec2]
mov rcx, r15
call fcn.180002450
nop
lea rdx, [rbx - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003f3e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180003f5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180003f7a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
jmp 0x180004498
mov rdx, qword [r13]
lea rcx, [rdx - 0x18]
lea rbx, [rdi - 0x18]
or rsi, 0xffffffffffffffff
cmp rcx, rbx
je 0x180003fe4
cmp dword [rbx + 0x10], 0
jl 0x180003fd1
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x180003fd1
call fcn.180002010
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x180003fc6
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x50], rdi
jmp 0x180003fe4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.180002370
mov rdi, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
lea rdx, str.cmd.exe__c
lea rcx, [rsp + 0x80]
call fcn.1800039f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x180004057
cmp dword [rdi + 0x10], 0
jl 0x180004048
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x180004048
call fcn.180002010
mov rbx, rax
mov ecx, esi
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x18000403d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
jmp 0x180004057
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.180002370
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004079
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x50]
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
or eax, ecx
jge 0x1800040a0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180002620
mov r8, qword [rsp + 0x50]
mov edx, 0x400
lea rcx, [rsp + 0x140]
call fcn.18001a938
mov dword [rsp + 0xb0], 0x68
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x110], rdx
mov qword [rsp + 0x108], rdx
mov word [rsp + 0xf0], r14w
mov dword [rsp + 0xec], 0x101
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1800041cd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180034ec2]
mov rcx, r15
call fcn.180002450
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180004189
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800041a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1800041c5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
jmp 0x180004498
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, rsi
lea rdi, [0x180034ec2]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x180004255
mov rbx, qword [rsp + 0x58]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1800042d7
cmp dword [rdx + 0x10], eax
jge 0x180004228
cmp dword [rbx - 0xc], eax
jge 0x18000421d
mov ecx, 0x80070057
call fcn.180002680
int3
mov dword [rbx - 0x10], r14d
mov byte [rbx], al
jmp 0x1800042d7
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000423e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
jmp 0x1800042d7
mov rbx, qword [rsp + 0x58]
mov ebp, dword [rbx - 0x10]
lea r12, [0x180034ec2]
sub r12, rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180004289
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.180002620
mov rbx, qword [rsp + 0x58]
cmp r12, rbp
ja 0x1800042a6
movsxd rbp, edi
lea r8, [r12 + rbx]
movsxd rdx, dword [rbx - 0xc]
mov r9, rbp
mov rcx, rbx
call fcn.1800187a8
jmp 0x1800042bf
movsxd rbp, edi
movsxd rdx, dword [rbx - 0xc]
mov r9, rbp
lea r8, [0x180034ec2]
mov rcx, rbx
call fcn.180018710
test edi, edi
js 0x18000448d
cmp edi, dword [rbx - 0xc]
jg 0x18000448d
mov dword [rbx - 0x10], edi
mov byte [rbx + rbp], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
mov r8d, 0x1000
lea rdx, [rsp + 0x540]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180004420
nop dword [rax]
xor eax, eax
mov rcx, rsi
lea rdi, [rsp + 0x540]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rbp, rcx
lea r14, [rsp + 0x540]
lea r12, [rsp + 0x540]
sub r12, rbx
mov r13d, dword [rbx - 0x10]
test ecx, ecx
setns al
test eax, eax
je 0x180004415
cmp ecx, ecx
cmovg ebp, ebp
mov eax, 0x7fffffff
sub eax, ebp
xor ecx, ecx
cmp eax, r13d
setge cl
test ecx, ecx
je 0x18000440a
lea edi, [r13 + rbp]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x18000438f
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.180002620
mov rbx, qword [rsp + 0x58]
cmp r12, r13
ja 0x180004398
lea r14, [r12 + rbx]
movsxd rdx, ebp
lea rcx, [r13 + rbx]
mov r9, rdx
mov r8, r14
call fcn.180018710
test edi, edi
js 0x1800043ff
cmp edi, dword [rbx - 0xc]
jg 0x1800043ff
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, 0x1000
lea rdx, [rsp + 0x540]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180004310
mov r13, qword [rsp + 0x78]
jmp 0x180004420
mov ecx, 0x80070057
call fcn.180002680
int3
mov ecx, 0x80070057
call fcn.180002680
int3
mov ecx, 0x80070057
call fcn.180002680
int3
lea rcx, [rbx - 0x18]
call fcn.180002010
add rax, 0x18
mov qword [r15], rax
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x18000444c
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000446c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180004488
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r15
jmp 0x180004498
mov ecx, 0x80070057
call fcn.180002680
nop
mov rcx, qword [rsp + 0x1540]
xor rcx, rsp
call fcn.1800186f0
mov rbx, qword [rsp + 0x1590]
add rsp, 0x1550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret