Function at 0x180004500
Capabilities:
Create pipe
Create process on windows
Create two anonymous pipes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x180045068]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r13, rcx
xor esi, esi
mov qword [rbp + 0xa0], rsi
mov ebx, 0xf
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xb0], rsi
mov byte [rbp + 0xa0], sil
mov qword [rbp + 0x40], rsi
mov r15d, ebx
mov qword [rbp + 0x58], rbx
mov r14d, esi
mov qword [rbp + 0x50], rsi
mov byte [rbp + 0x40], r14b
mov qword [rbp + 0x98], rbx
mov r12d, 0xe
mov qword [rbp + 0x90], r12
movsd xmm0, qword [str.chcp_437___NUL]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [0x180030880]
mov dword [rbp + 0x88], eax
movzx eax, word [0x180030884]
mov word [rbp + 0x8c], ax
mov byte [rbp + 0x8e], sil
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x78], 0x18
mov qword [rbp - 0x80], rsi
mov dword [rbp - 0x78], 1
mov r9d, 0xdcd8
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1800049e4
mov r9d, 0xa00000
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1800049e4
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 0x100
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp], rax
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.C:WindowsSystem32cmd.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800049e4
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
lea rdi, [rbp + 0x80]
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rbx
lea r8, [rbp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.180008b60
test al, al
je 0x1800049e4
lea rcx, [r13 + 8]
call fcn.18000e900
mov rbx, qword [rbp + 0x40]
test eax, eax
je 0x1800048a8
lea rdx, [rbp + 0x20]
lea rcx, [r13 + 8]
call fcn.18000e460
mov rdi, rax
lea rax, [rbp + 0x40]
cmp rax, rdi
je 0x180004798
cmp r15, 0x10
jb 0x18000476e
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180004766
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004adc
mov rcx, rbx
call fcn.180010918
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov r15, qword [rbp + 0x58]
mov r14, qword [rbp + 0x50]
mov rbx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1800047d3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800047ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004adc
call fcn.180010918
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
lea rsi, [rbp + 0x40]
cmp r15, 0x10
cmovae rsi, rbx
cmp r14, 0x10
jae 0x180004802
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x38], 0xf
jmp 0x18000487b
mov rdi, r14
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180004856
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004ae8
mov rcx, rax
call fcn.1800108dc
mov rcx, rax
test rax, rax
je 0x180004ae2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180004864
test rcx, rcx
je 0x180004862
call fcn.1800108dc
jmp 0x180004864
xor eax, eax
mov qword [rbp + 0x20], rax
lea r8, [r14 + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1800129f0
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x30], r14
lea r8, [rbp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.180008b60
test al, al
je 0x1800049e8
lea rcx, [r13 + 8]
call fcn.18000e900
xor esi, esi
jmp 0x180004716
mov qword [rbp + 0x20], rsi
mov r14d, 0xf
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x30], 4
mov dword [rbp + 0x20], 0x74697865
mov byte [rbp + 0x24], 0
lea r8, [rbp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call fcn.180008b60
test al, al
je 0x1800049ee
mov edx, 0x75300
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x78], r14
mov qword [rbp + 0x70], rsi
mov byte [rbp + 0x60], 0
lea r8, [rbp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.180008300
test al, al
jne 0x180004927
xor dil, dil
jmp 0x18000499b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x60]
lea rdx, [0x1800308a4]
lea rcx, [rbp + 0x20]
call fcn.1800016f0
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18000495f
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp + 0xa0]
call fcn.180009430
nop
lea rcx, [rbp + 0x20]
call fcn.1800035c0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call fcn.180002680
lea rcx, [r13 + 0xf8]
mov rdx, rax
call fcn.18000a970
mov dil, 1
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1800049d6
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800049d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004aee
call fcn.180010918
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], r14
mov byte [rbp + 0x60], 0
jmp 0x1800049f1
mov rbx, qword [rbp + 0x40]
mov r14d, 0xf
xor dil, dil
cmp r14, 0x10
jb 0x180004a2d
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004af4
call fcn.180010918
nop
cmp r15, 0x10
jb 0x180004a65
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180004a5c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004afa
mov rcx, rbx
call fcn.180010918
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x180004aa2
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004ad6
call fcn.180010918
movzx eax, dil
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1800110b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180016e8c
nop
call fcn.180016e8c
nop
call fcn.180016e8c
int3
call fcn.180009250
int3
call fcn.180016e8c
nop
call fcn.180016e8c
nop
call fcn.180016e8c
int3