Function at 0x14006fe50
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create thread
Create two anonymous pipes
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
vmovaps xmmword [rsp + 0x230], xmm8
vmovaps xmmword [rsp + 0x220], xmm7
vmovaps xmmword [rsp + 0x210], xmm6
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.14006b2e0
lea rdx, [rsi + 0x50]
lea rcx, [rsp + 0x80]
call fcn.14006cc50
movzx r12d, byte [0x140178b9d]
mov r14, qword [rbx + 8]
shl r14, 2
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r13, [0x1400c67c0]
nop dword [rax]
mov ecx, dword [r13 + r15*4 + 0x10]
cmp ecx, eax
je 0x14006ff07
mov ecx, dword [r13 + r15*4 + 0x14]
cmp ecx, eax
je 0x14006fef8
mov ecx, dword [r13 + r15*4 + 0x18]
cmp ecx, eax
je 0x14006fefd
mov ecx, dword [r13 + r15*4 + 0x1c]
cmp ecx, eax
je 0x14006ff03
add r15, 4
cmp r15, 0x80
jne 0x14006fec0
mov eax, 0xffffffff
jmp 0x14006ff0a
inc r15
jmp 0x14006ff07
add r15, 2
jmp 0x14006ff07
add r15, 3
mov eax, r15d
shl rax, 4
mov rcx, qword [rax + r13 + 0x210]
mov rdx, qword [rax + r13 + 0x218]
add r14, rdx
mov qword [rax + r13 + 0x218], r14
lea r8, [rcx + rdx]
add r8, 2
lea rcx, [rsp + 0x138]
mov rdx, rbx
call fcn.1400030a0
mov rbx, qword [rdi + 8]
shl rbx, 2
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop word cs:[rax + rax]
mov ecx, dword [r13 + r14*4 + 0x10]
cmp ecx, eax
je 0x14006ffa7
mov ecx, dword [r13 + r14*4 + 0x14]
cmp ecx, eax
je 0x14006ff98
mov ecx, dword [r13 + r14*4 + 0x18]
cmp ecx, eax
je 0x14006ff9d
mov ecx, dword [r13 + r14*4 + 0x1c]
cmp ecx, eax
je 0x14006ffa3
add r14, 4
cmp r14, 0x80
jne 0x14006ff60
mov eax, 0xffffffff
jmp 0x14006ffaa
inc r14
jmp 0x14006ffa7
add r14, 2
jmp 0x14006ffa7
add r14, 3
mov eax, r14d
shl rax, 4
mov rcx, qword [rax + r13 + 0x210]
mov rdx, qword [rax + r13 + 0x218]
add rbx, rdx
mov qword [rax + r13 + 0x218], rbx
lea r8, [rcx + rdx]
add r8, 2
lea rcx, [rsp + 0x128]
mov rdx, rdi
call fcn.1400030a0
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov byte [rax + rcx], 0x5c
lea rax, [rcx + 1]
mov qword [rsp + 0x88], rax
lea rbx, [rcx*4 + 4]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov qword [rsp + 0xf8], rdi
nop word [rax + rax]
mov ecx, dword [r13 + r14*4 + 0x10]
cmp ecx, eax
je 0x140070067
mov ecx, dword [r13 + r14*4 + 0x14]
cmp ecx, eax
je 0x140070058
mov ecx, dword [r13 + r14*4 + 0x18]
cmp ecx, eax
je 0x14007005d
mov ecx, dword [r13 + r14*4 + 0x1c]
cmp ecx, eax
je 0x140070063
add r14, 4
cmp r14, 0x80
jne 0x140070020
mov eax, 0xffffffff
jmp 0x14007006a
inc r14
jmp 0x140070067
add r14, 2
jmp 0x140070067
add r14, 3
mov eax, r14d
xor ebp, ebp
cmp r12b, 1
setne bpl
shl rax, 4
mov rcx, qword [rax + r13 + 0x210]
mov rdx, qword [rax + r13 + 0x218]
add rbx, rdx
mov qword [rax + r13 + 0x218], rbx
lea r8, [rcx + rdx]
add r8, 2
lea rcx, [rsp + 0x118]
lea rdx, [rsp + 0x80]
call fcn.1400030a0
mov dword [rsp + 0x148], 0x18
mov qword [rsp + 0x150], 0
mov dword [rsp + 0x158], ebp
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x50], 0xffffffffffffffff
lea rbx, [rsi + 0x30]
mov rdi, qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rdx, [rsp + 0x58]
lea r15, [rsp + 0x148]
mov rcx, rbx
mov r8, r15
xor r9d, r9d
call rdi
lea r14, [rsi + 0x40]
lea rcx, [rsp + 0x50]
mov rdx, r14
mov r8, r15
xor r9d, r9d
call rdi
cmp r12b, 1
je 0x14007016d
mov rdi, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
call rdi
mov rcx, r14
mov edx, 1
xor r8d, r8d
call rdi
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x160], ymm0
vmovups ymmword [rsp + 0x178], ymm0
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x100], xmm0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
jmp 0x140070194
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x160], ymm0
vmovups ymmword [rsp + 0x178], ymm0
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0x100], xmm0
xor eax, eax
xor ecx, ecx
mov dword [rsp + 0x1a0], 0x70
vmovups ymm0, ymmword [rsp + 0x160]
vmovups ymm1, ymmword [rsp + 0x178]
vmovups ymmword [rsp + 0x1a4], ymm0
vmovups ymmword [rsp + 0x1bc], ymm1
mov dword [rsp + 0x1dc], 0x100
vmovdqa xmm0, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0
mov qword [rsi + 0x48], 0xffffffffffffffff
cmp r12b, 1
je 0x14007021e
xor ebx, ebx
mov eax, 0x8080204
jmp 0x140070498
lea r14, [rsi + 0x48]
vpbroadcastq xmm0, qword [0x1400a9ea8]
vpmovzxdq xmm1, qword [0x1400c7340]
vpor xmm1, xmm1, xmm0
vsubpd xmm0, xmm1, xmm0
vcvtpd2ps xmm6, xmm0
movzx eax, byte [0x140178b9c]
lea rcx, [0x1400aef5d]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rcx
lea rcx, [0x1400aef5e]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], 0
movzx eax, al
vcvtsi2ss xmm0, xmm2, eax
vmovss dword [rsp + 0xb0], xmm0
vxorps xmm0, xmm0, xmm0
vmovlps qword [rsp + 0xb4], xmm0
lea rcx, [0x1400daa00]
mov qword [rsp + 0xc0], rcx
lea r9, [rsp + 0xc8]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0xc8], ymm0
mov qword [rsp + 0xe8], 0
xor edx, edx
xor r8d, r8d
vzeroupper
call fcn.14000ce50
mov qword [rsp + 0xd8], rax
lea rcx, [rsp + 0x90]
call fcn.14000d250
test rax, rax
je 0x14007031c
vxorps xmm8, xmm8, xmm8
lea rbx, [rsp + 0x90]
vxorps xmm7, xmm7, xmm7
nop
vaddss xmm7, xmm8, xmm7
vmovss xmm8, dword [rsp + 0xb8]
mov rcx, rbx
call fcn.14000d250
test rax, rax
jne 0x140070300
jmp 0x140070320
vxorps xmm7, xmm7, xmm7
mov rax, qword [rsp + 0xe8]
vmovss xmm0, dword [rax + 0x18]
vcmpltss xmm1, xmm0, dword [0x1400a9ed4]
vmovss xmm2, dword [rsp + 0xb8]
vblendvps xmm0, xmm0, xmm2, xmm1
vaddss xmm0, xmm0, dword [rax + 0x10]
vaddss xmm0, xmm7, xmm0
vcvtsi2ss xmm1, xmm3, dword [0x1400daa00]
vinsertps xmm0, xmm0, xmm1, 0x10
vdivps xmm0, xmm6, xmm0
mov r8, qword [rsp + 0x58]
vaddps xmm0, xmm0, xmmword [0x1400aa060]
mov rdx, qword [rsp + 0x50]
vcvttps2dq xmm0, xmm0
vpextrd eax, xmm0, 1
shl eax, 0x10
vmovd ecx, xmm0
movzx ecx, cx
or ecx, eax
mov qword [rsp + 0x20], r14
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePseudoConsole]
test eax, eax
je 0x1400703aa
lea r8, str.WIN32:_failed_to_create_a_pseudo_console.
xor ecx, ecx
xor edx, edx
call fcn.140007a90
mov qword [rsp + 0x90], 0
xor ebx, ebx
lea r9, [rsp + 0x90]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r15, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop
mov ecx, dword [r13 + rbx*4 + 0x10]
cmp ecx, eax
je 0x140070427
mov ecx, dword [r13 + rbx*4 + 0x14]
cmp ecx, eax
je 0x140070418
mov ecx, dword [r13 + rbx*4 + 0x18]
cmp ecx, eax
je 0x14007041d
mov ecx, dword [r13 + rbx*4 + 0x1c]
cmp ecx, eax
je 0x140070423
add rbx, 4
cmp rbx, 0x80
jne 0x1400703e0
mov eax, 0xffffffff
jmp 0x140070429
inc rbx
jmp 0x140070427
add rbx, 2
jmp 0x140070427
add rbx, 3
mov eax, ebx
shl rax, 4
mov rcx, qword [rax + r13 + 0x218]
mov rbx, qword [rax + r13 + 0x210]
add rbx, rcx
add r15, rcx
mov qword [rax + r13 + 0x218], r15
lea r9, [rsp + 0x90]
mov rcx, rbx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov r9, qword [r14]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 8
mov r8d, 0x20016
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov qword [rsp + 0x208], rbx
mov eax, 0x80204
vpxor xmm0, xmm0, xmm0
vmovdqa xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
mov r8, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
mov word [r8 + rcx], 0
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
mov word [rdx + rcx], 0
mov rcx, qword [rsp + 0x138]
mov r9, qword [rsp + 0x140]
mov word [rcx + r9], 0
lea r9, [rsp + 0x90]
mov qword [rsp + 0x48], r9
lea r9, [rsp + 0x1a0]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x30], 0
xor r8d, r8d
xor r9d, r9d
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, eax
test bpl, bpl
je 0x1400706bc
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov qword [rsi + 0x18], rax
mov rdx, qword [rsp + 0x90]
mov qword [rsi + 0x20], rdx
mov eax, dword [rsp + 0xa0]
mov dword [rsi + 0x28], eax
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov rax, qword [rsp + 0xf8]
vmovups xmm0, xmmword [rax]
vmovaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400706e0
mov rcx, qword [rsi + 0x30]
mov qword [rax + 8], rcx
mov rcx, qword [rsi + 0x38]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsi + 0x40]
mov qword [rax + 0x18], rcx
or byte [rax + 0x122], 0x1c
mov qword [rsi + 0x4500], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
lea rdi, [rsi + 8]
vmovdqu xmm0, xmmword [0x1400a89f0]
vmovdqa xmmword [rsp + 0x60], xmm0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x14006fa80]
lea r9, [rsp + 0x70]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140070613
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsp + 0x6c], 0
mov rax, qword [rsp + 0x60]
mov qword [rdi], rax
mov eax, dword [rsp + 0x68]
mov dword [rdi + 8], eax
movzx eax, byte [rsp + 0x6c]
mov byte [rdi + 0xc], al
movzx eax, word [rsp + 0x6d]
mov word [rdi + 0xd], ax
movzx eax, byte [rsp + 0x6f]
mov byte [rdi + 0xf], al
nop dword [rax + rax]
movzx eax, byte [rsi + 0x451d]
test al, 2
je 0x140070640
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12b, 1
jne 0x140070676
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x50]
call rsi
mov eax, ebp
vmovaps xmm6, xmmword [rsp + 0x210]
vmovaps xmm7, xmmword [rsp + 0x220]
vmovaps xmm8, xmmword [rsp + 0x230]
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.Win32:_failed_to_launch_a_process_from_the_terminal.
xor ecx, ecx
xor edx, edx
call fcn.140007a90
cmp r12b, 1
je 0x14007066d
jmp 0x140070676