Function at 0x14002b170
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1180]
mov eax, 0x1280
call fcn.14002fa50
sub rsp, rax
mov rax, qword [0x140045028]
xor rax, rsp
mov qword [rbp + 0x1170], rax
mov rsi, rcx
xor r14d, r14d
xor edx, edx
mov r8d, 0xe8
lea rcx, [rbp + 0x80]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x80]
call fcn.140003d30
nop
lea rdx, str.powershell.exe
lea rcx, [rbp + 0x80]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._ExecutionPolicy_Bypass
lea rcx, [rbp + 0x80]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
lea rdx, str._Command___Get_WmiObject__Class_Win32_Processor_.Name_
lea rcx, [rbp + 0x80]
call fcn.140004150
mov rcx, rax
lea rdx, [0x140034dd8]
call fcn.140004150
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x1c], 1
mov word [rbp + 0x20], r14w
mov dword [rbp - 0x58], 0x18
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], 1
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
or dword [rbp + 0x1c], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x88]
call fcn.140003ec0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002b333
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b32e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b32e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
test ebx, ebx
je 0x14002b69b
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x170], 0
xor edx, edx
mov r8d, 0xfff
lea rcx, [rbp + 0x171]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
xor r8d, r8d
lea rdx, [0x140034d50]
lea rcx, [rbp + 0x50]
call fcn.1400027e0
nop
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x70]
mov r8d, 0x1000
lea rdx, [rbp + 0x170]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002b422
nop word [rax + rax]
cmp dword [rbp + 0x70], 0
jbe 0x14002b422
lea rax, [rbp + 0x170]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14002b3e4
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x50]
call fcn.140003f70
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x70]
mov r8d, 0x1000
lea rdx, [rbp + 0x170]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002b3d0
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.1400024d0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14002dd80
mov rbx, rax
lea rax, [rbp + 0x50]
cmp rax, rbx
je 0x14002b4b9
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x14002b48a
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b485
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b4ed
call fcn.14002ec3c
movdqa xmm0, xmmword [0x140039ca0]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002b4f9
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b4f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b4f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
lea rdi, [rbp + 0x50]
mov r8, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
cmovae rdi, r8
add rdi, qword [rbp + 0x60]
lea rbx, [rbp + 0x50]
cmp rdx, 0x10
cmovae rbx, r8
add rbx, qword [rbp + 0x60]
lea rcx, [rbp + 0x50]
cmp rdx, 0x10
cmovae rcx, r8
mov r8b, 0xa
mov rdx, rbx
call fcn.14002e8f0
mov r8, rax
cmp rax, rbx
je 0x14002b55e
inc rax
cmp rax, rbx
je 0x14002b55e
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x14002b556
mov byte [r8], cl
inc r8
inc rax
cmp rax, rbx
jne 0x14002b548
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rax, qword [rbp + 0x50]
mov r9, r8
sub r9, rax
sub rdi, r8
mov rbx, qword [rbp + 0x60]
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rcx, qword [rbp + 0x50]
add rcx, r9
sub rbx, rdi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x60], rbx
test rbx, rbx
jne 0x14002b5ef
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea r8d, [rbx + 0x14]
lea rdx, str.Computer::GetCPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_CPU_Name
lea rcx, [rsp + 0x50]
call fcn.14001dc60
jmp 0x14002b65b
lea rax, [rbp + 0x50]
cmp rsi, rax
je 0x14002b611
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdx, qword [rbp + 0x50]
mov r8, rbx
mov rcx, rsi
call fcn.140003ff0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x14
lea rdx, str.Computer::GetCPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae r8, qword [rbp + 0x50]
lea rdx, str.Got_CPU_Name__s
lea rcx, [rsp + 0x50]
call fcn.14001da20
mov bl, 1
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x14002b6d7
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002b694
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ec3c
jmp 0x14002b6d7
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov r8d, 0x14
lea rdx, str.Computer::GetCPUName
lea rcx, [rsp + 0x50]
call fcn.1400027e0
lea rdx, str.Failed_to_get_CPU_Name
lea rcx, [rsp + 0x50]
call fcn.14001dc60
xor bl, bl
mov rcx, qword [rbp + 0x80]
movsxd rdx, dword [rcx + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rdx + 0x80], rax
mov rcx, qword [rbp + 0x80]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rbp + rdx + 0x7c], r8d
lea rcx, [rbp + 0x88]
call fcn.140003c70
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
movzx eax, bl
mov rcx, qword [rbp + 0x1170]
xor rcx, rsp
call fcn.14002eb10
lea r11, [rsp + 0x1280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret