Function at 0x1400db48a
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x220
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x198], 0xfffffffffffffffe
mov rdi, rdx
xor eax, eax
lea rcx, [rbp + 0x158]
mov qword [rcx], rax
lea rdx, [rbp + 0x160]
mov qword [rdx], rax
xorps xmm0, xmm0
lea r8, [rbp + 0x20]
movaps xmmword [r8], xmm0
mov qword [r8 + 0x10], rax
mov dword [r8], 0x18
mov dword [r8 + 0x10], 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400db4f7
mov rcx, qword [rbp + 0x158]
jmp 0x1400db50c
mov rcx, 0xffffffffffffffff
mov qword [rbp + 0x158], rcx
mov qword [rbp + 0x160], rcx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400db54c
mov rcx, qword [rbp + 0x158]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x160]
call rsi
mov rax, 0xffffffffffffffff
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], rax
xor eax, eax
lea rcx, [rbp + 0x168]
mov qword [rcx], rax
lea rdx, [rbp + 0x170]
mov qword [rdx], rax
xorps xmm0, xmm0
lea rsi, [rbp + 0x20]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi], 0x18
mov dword [rsi + 0x10], 1
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400db596
mov rcx, qword [rbp + 0x170]
jmp 0x1400db5ab
mov rcx, 0xffffffffffffffff
mov qword [rbp + 0x168], rcx
mov qword [rbp + 0x170], rcx
mov edx, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x1400db5eb
mov rcx, qword [rbp + 0x168]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rbp + 0x170]
call rbx
mov rax, 0xffffffffffffffff
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x88]
mov rcx, rdi
call fcn.140049682
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
mov dword [rbp + 0x20], 0x68
mov dword [rbp + 0x5c], 0x101
mov word [rbp + 0x60], 0
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x70], rax
xor eax, eax
lea rcx, [rbp + 0x128]
mov qword [rcx], rax
mov qword [rbp + 0x140], rax
movaps xmmword [rbp + 0x130], xmm0
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call fcn.1400cd706
mov rcx, rax
call fcn.1400f867e
test eax, eax
je 0x1400db775
call fcn.1400cd706
mov rcx, rax
call fcn.1400f8896
call fcn.1400cd706
mov rcx, rax
call fcn.1400f871c
mov rcx, rax
call fcn.1400f838e
mov rdi, rax
lea rcx, [rbp + 0x178]
mov qword [rcx], 0
mov rdx, rax
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
je 0x1400db841
mov rbx, qword [rbp + 0x178]
lea rcx, [rbp + 0x88]
call fcn.140052b28
lea r14, [rbp + 0x130]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rsi
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x8004404
mov dword [rsp + 0x28], 1
mov rcx, rdi
xor edx, edx
mov r8, rax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1400db766
mov rbx, qword [rbp + 0x178]
lea rcx, [rbp + 0x88]
call fcn.140052b28
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x8004404
mov rcx, rdi
mov edx, 1
xor r8d, r8d
mov r9, rax
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
test eax, eax
je 0x1400db957
call fcn.1400cd706
mov rcx, rax
call fcn.1400f87a0
jmp 0x1400db7c3
lea rcx, [rbp + 0x88]
call fcn.140052b28
lea rcx, [rbp + 0x130]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8004004
mov dword [rsp + 0x20], 1
xor ecx, ecx
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400db8cc
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov rcx, qword [rbp + 0x160]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x168]
call rsi
mov rcx, qword [rbp + 0x170]
call rsi
mov ecx, 0x48
call fcn.1401281b8
mov r9, qword [rbp + 0x158]
mov rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x138]
mov qword [rbp + 0x150], rax
mov rcx, rax
call fcn.1400ddd1a
lea rcx, [rbp + 0x88]
call fcn.140003d86
mov rax, qword [rbp + 0x150]
add rsp, 0x220
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0xe8]
mov edx, eax
call fcn.1400e0e71
lea rcx, [rbp + 0xe8]
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14014c7cc]
lea rcx, [rbp + 0xa8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp + 0xa8]
call fcn.1400496a0
lea rcx, vtable.std::exception.0
lea rdx, [rbp - 0x20]
mov qword [rdx - 8], rcx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
lea rcx, [rbp + 0x180]
mov qword [rcx], rax
mov byte [rcx + 8], 1
call fcn.14012bf08
lea rdx, [0x140166b18]
lea rcx, [rbp - 0x28]
call fcn.14012b400
jmp 0x1400db9dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0xe8]
mov edx, eax
call fcn.1400e0e71
lea rcx, [rbp + 0xe8]
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14014c8ba]
lea rcx, [rbp + 0xa8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp + 0xa8]
call fcn.1400496a0
lea rcx, vtable.std::exception.0
lea rdx, [rbp + 0x10]
mov qword [rdx - 8], rcx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
lea rcx, [rbp + 0x180]
mov qword [rcx], rax
mov byte [rcx + 8], 1
call fcn.14012bf08
lea rdx, [0x140166b18]
lea rcx, [rbp + 8]
call fcn.14012b400
jmp 0x1400db9dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0xe8]
mov edx, eax
call fcn.1400e0e71
lea rcx, [rbp + 0xe8]
call fcn.140049776
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x14014c842]
lea rcx, [rbp + 0xa8]
mov r8d, eax
mov r9, rsi
call fcn.14004788a
lea rcx, [rbp + 0xa8]
call fcn.1400496a0
lea rcx, vtable.std::exception.0
lea rdx, [rbp - 8]
mov qword [rdx - 8], rcx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
lea rcx, [rbp + 0x180]
mov qword [rcx], rax
mov byte [rcx + 8], 1
call fcn.14012bf08
lea rdx, [0x140166b18]
lea rcx, [rbp - 0x10]
call fcn.14012b400
int3