Function at 0x14000dc40
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1400890d8]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rdi, rcx
mov qword [rbp - 0x80], rcx
xor r13d, r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov dword [rbp + 0xc0], eax
mov dword [rbp - 0x60], 0x18
mov qword [rbp - 0x58], r13
mov dword [rbp - 0x50], 1
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
je 0x14000e12c
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp - 0x40], 0x68
mov rax, qword [rbp - 0x80]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x18], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x10], rax
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 0x101
mov dword [rbp - 4], eax
mov word [rbp], r13w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
movups xmm1, xmmword [str.wmic_csproduct_get_uuid]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [0x14007a5a0]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [0x14007a5b0]
movups xmmword [rbp + 0xf0], xmm1
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000ddbb
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
jmp 0x14000e123
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x50]
mov r8d, 0x63
lea rdx, [rbp + 0x60]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000e100
cmp dword [rbp + 0x50], r13d
je 0x14000e100
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
lea rax, [rbp + 0x60]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x14000de40
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.14001fe40
nop
lea rbx, [rbp + 0x30]
mov r15, qword [rbp + 0x30]
mov r12, qword [rbp + 0x48]
cmp r12, 0x10
cmovae rbx, r15
mov rsi, qword [rbp + 0x40]
cmp rsi, 4
jb 0x14000deed
lea r13, [rsi + rbx]
lea r8, [r13 - 3]
sub r8, rbx
mov edx, 0x55
mov rcx, rbx
call fcn.14003f290
mov r9, rax
test rax, rax
je 0x14000deed
lea rdx, str.UUID
nop dword [rax]
xor ecx, ecx
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14000deba
cmp rcx, 4
jne 0x14000dea2
xor eax, eax
jmp 0x14000debf
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000e0f8
inc r9
lea r8, [r13 - 3]
sub r8, r9
mov edx, 0x55
mov rcx, r9
call fcn.14003f290
mov r9, rax
test rax, rax
lea rdx, str.UUID
jne 0x14000dea0
mov r9, r14
cmp r9, 0xffffffffffffffff
je 0x14000dfa4
add r9, 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
cmp rsi, r9
jb 0x14000e182
sub rsi, r9
cmp rsi, 0xffffffffffffffff
cmovb r14, rsi
lea rdx, [rbp + 0x30]
cmp r12, 0x10
cmovae rdx, r15
add rdx, r9
mov r8, r14
lea rcx, [rsp + 0x58]
call fcn.14001fe40
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000df7a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e17c
call fcn.14003c8e0
movups xmm2, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x30], xmm2
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r12, xmm0
movq rsi, xmm1
movq r15, xmm2
lea r14, [rbp + 0x30]
cmp r12, 0x10
cmovae r14, r15
add r14, rsi
lea rbx, [rbp + 0x30]
cmp r12, 0x10
cmovae rbx, r15
cmp rbx, r14
je 0x14000dfeb
movzx esi, byte [rbx]
mov ecx, esi
call fcn.14004d100
test eax, eax
jne 0x14000dfd7
test sil, sil
jne 0x14000dfdf
inc rbx
cmp rbx, r14
jne 0x14000dfc4
mov r12, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x40]
mov r15, qword [rbp + 0x30]
lea rcx, [rbp + 0x30]
cmp r12, 0x10
cmovae rcx, r15
lea rax, [rbp + 0x30]
cmovae rax, r15
mov rdx, rcx
sub rdx, rax
sub rbx, rcx
mov rax, rsi
sub rax, rdx
cmp rax, rbx
cmovb rbx, rax
lea rcx, [rbp + 0x30]
cmp r12, 0x10
cmovae rcx, r15
add rcx, rdx
sub rsi, rbx
mov r8, rsi
sub r8, rdx
inc r8
lea rdx, [rcx + rbx]
call fcn.14003e790
mov qword [rbp + 0x40], rsi
lea r12, [rbp + 0x30]
mov rcx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x48]
cmp r8, 0x10
cmovae r12, rcx
add r12, rsi
lea r15, [rbp + 0x30]
cmp r8, 0x10
cmovae r15, rcx
lea rbx, [rbp + 0x30]
cmovae rbx, rcx
add rbx, rsi
cmp rbx, r15
je 0x14000e09c
lea r14, [rbx - 1]
movzx esi, byte [r14]
mov ecx, esi
call fcn.14004d100
test eax, eax
jne 0x14000e088
test sil, sil
jne 0x14000e090
mov rbx, r14
cmp r14, r15
jne 0x14000e070
mov r8, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x30]
cmp r8, 0x10
cmovae rax, rcx
mov rdx, rbx
sub rdx, rax
sub r12, rbx
mov rax, rsi
sub rax, rdx
cmp rax, r12
cmovb r12, rax
lea rax, [rbp + 0x30]
cmp r8, 0x10
cmovae rax, rcx
lea rcx, [rax + rdx]
sub rsi, r12
mov r8, rsi
sub r8, rdx
inc r8
lea rdx, [rcx + r12]
call fcn.14003e790
mov qword [rbp + 0x40], rsi
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rdi + 0x10], xmm1
jmp 0x14000e149
sub r9, rbx
jmp 0x14000def0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
xor r8d, r8d
lea rdx, [0x140079f6d]
mov rcx, rdi
call fcn.14001fe40
mov rax, rdi
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14003c8c0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004dd00
nop
call fcn.14001b1c0
int3