Function at 0x140018e4c
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5d0
mov rax, qword [0x1401af100]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
lea r15d, [r13 + 0xf]
mov qword [rcx + 0x18], r15
mov byte [rcx], r13b
mov dword [rsp + 0x50], 1
xor eax, eax
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
mov word [rbp + 0xb8], ax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x40], r13b
test edx, edx
je 0x140018f4a
sub edx, 1
je 0x140018f41
cmp edx, 1
jne 0x140018fa6
lea r8, str.wmic_cpu_get_processorid
lea edx, [rax + 0x32]
lea rcx, [rbp + 0x88]
call fcn.1400b11c0
lea edx, [r13 + 0xb]
cmp qword [rbp + 0x58], rdx
jb 0x140018f38
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova rbx, qword [rbp + 0x40]
mov qword [rbp + 0x50], rdx
mov r8d, edx
lea rdx, str.ProcessorId
mov rcx, rbx
call fcn.1400da940
mov byte [rbx + 0xb], r13b
jmp 0x140018fa6
lea r9, str.ProcessorId
jmp 0x140018f9d
lea r8, str.wmic_bios_get_serialnumber
jmp 0x140018f51
lea r8, str.wmic_BaseBoard_get_SerialNumber
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.1400b11c0
mov edx, 0xc
cmp qword [rbp + 0x58], rdx
jb 0x140018f96
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
mov qword [rbp + 0x50], rdx
mov r8d, edx
cmova rbx, qword [rbp + 0x40]
lea rdx, str.SerialNumber
mov rcx, rbx
call fcn.1400da940
mov byte [rbx + 0xc], r13b
jmp 0x140018fa6
lea r9, str.SerialNumber
lea rcx, [rbp + 0x40]
call fcn.140023df0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x70], r13
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400db080
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov dword [rbp + 0x80], r13d
mov ecx, ebx
call fcn.1400b372c
mov r14, rax
mov qword [rsp + 0x58], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400db080
mov qword [rbp - 0x38], r13
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x2c]
call fcn.1400db080
mov qword [rbp - 0x60], 0x18
mov qword [rbp - 0x50], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x30], 0x68
mov qword [rbp - 0x58], r13
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140019336
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
mov word [rbp + 0x10], r13w
mov dword [rbp + 0xc], 0x101
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140019336
lea edx, [rbx - 0x15]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x80]
lea r8d, [rbx - 1]
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140019336
lea rax, [rbp + 0xc0]
or rdi, 0xffffffffffffffff
mov r14, rdi
inc r14
cmp byte [rax + r14], r13b
jne 0x1400190f9
cmp r14, qword [rbp + 0x78]
ja 0x140019131
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova rbx, qword [rbp + 0x60]
mov qword [rbp + 0x70], r14
mov r8, r14
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call fcn.1400da940
mov byte [rbx + r14], r13b
jmp 0x140019144
lea r9, [rbp + 0xc0]
mov rdx, r14
lea rcx, [rbp + 0x60]
call fcn.140023df0
lea r13, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova r13, qword [rbp + 0x40]
lea r14, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r14, qword [rbp + 0x60]
mov r15, qword [rbp + 0x50]
mov r12, qword [rbp + 0x70]
cmp r15, r12
ja 0x1400191ca
mov rax, r12
sub rax, r15
test r15, r15
jne 0x14001917e
xor r13d, r13d
mov ebx, r13d
jmp 0x1400191d0
inc rax
add rax, r14
mov qword [rsp + 0x60], rax
mov r8, rax
sub r8, r14
mov rcx, r14
jmp 0x1400191b8
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1400db420
test eax, eax
je 0x140019320
inc rbx
mov r8, qword [rsp + 0x60]
sub r8, rbx
mov rcx, rbx
movsx edx, byte [r13]
call fcn.1400dafc0
test rax, rax
mov rbx, rax
jne 0x140019194
mov rbx, rdi
xor r13d, r13d
lea rcx, [r15 + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
cmp r12, rcx
jb 0x14001941c
sub r12, rcx
mov r8, rdi
cmp r12, rdi
cmovb r8, r12
lea rdx, [rbp + 0x60]
mov r15d, 0xf
cmp qword [rbp + 0x78], r15
cmova rdx, qword [rbp + 0x60]
add rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140002bc8
mov dword [rsp + 0x50], 3
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.140021988
mov rdx, qword [rbp - 0x80]
cmp rdx, r15
jbe 0x14001926c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019422
call fcn.1400a94f0
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400db080
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r8, qword [rbp + 0x60]
mov edx, ebx
lea rcx, [rbp + 0xc0]
call fcn.1400b11c0
lea rax, [rbp + 0xc0]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], r13b
jne 0x1400192a7
mov rdx, r13
mov r14, qword [rsp + 0x58]
test rcx, rcx
je 0x1400192ed
mov r9, r14
movsx r8, byte [rbp + rdx + 0xc0]
cmp r8b, 0x20
ja 0x1400192df
movabs r10, 0x100002400
bt r10, r8
jb 0x1400192e5
mov byte [r9], r8b
inc r9
inc rdx
cmp rdx, rcx
jb 0x1400192c0
inc rdi
cmp byte [r14 + rdi], r13b
jne 0x1400192ed
cmp rdi, qword [rsi + 0x18]
ja 0x140019328
mov rbx, rsi
cmp qword [rsi + 0x18], r15
jbe 0x140019308
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400da940
mov byte [rbx + rdi], r13b
jmp 0x140019336
sub rbx, r14
jmp 0x1400191cd
mov r9, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140023df0
mov rcx, r14
call fcn.1400b2e24
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r15
jbe 0x1400193a1
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001939c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019428
call fcn.1400a94f0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov rdx, qword [rbp + 0x58]
cmp rdx, r15
jbe 0x1400193e3
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400193de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140019416
call fcn.1400a94f0
mov rax, rsi
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.1400a94d0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b36b4
nop
call fcn.1400226c0
int3
call fcn.1400b36b4
nop
call fcn.1400b36b4
int3