Function at 0x14003f2d0
Capabilities:
Create pipe
Create process on windows
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xe8]
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov rdi, rcx
mov dword [rbp + 0x130], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor ebx, ebx
mov qword [rcx + 0x10], 3
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1400e9404]
mov word [rcx], ax
movzx eax, byte [0x1400e9406]
mov byte [rcx + 2], al
mov byte [rcx + 3], bl
mov dword [rbp + 0x130], 1
movups xmm0, xmmword [str.u_rdnSUXRIL]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [0x1400f3468]
movups xmmword [rbp - 0x70], xmm1
mov eax, dword [0x1400f3478]
mov dword [rbp - 0x60], eax
movzx eax, word [0x1400f347c]
mov word [rbp - 0x5c], ax
mov r8d, ebx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14003f497
movdqa xmm4, xmmword [0x1400f7a70]
movdqa xmm3, xmmword [0x1400f80a0]
movdqa xmm5, xmmword [0x1400f7af0]
movdqa xmm0, xmmword [0x1400f7b60]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rbp - 0x7c]
movdqa xmm6, xmmword [0x1400f7b00]
mov edx, dword [rsp + 0x70]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x14003f3b0
cmp r8d, 0x26
jge 0x14003f4e2
movsxd rax, r8d
lea r9, [rbp - 0x80]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x36
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x26
jl 0x14003f4b0
mov dword [rbp - 0x58], Ordinal_30
mov qword [rbp - 0x50], rbx
mov dword [rbp - 0x48], 1
xor r9d, r9d
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14003f870
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x14003f870
mov dword [rbp - 0x20], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
mov dword [rbp + 0x1c], 0x100
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14003f857
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x128]
mov r8d, 0x7f
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003f65f
nop dword [rax + rax]
mov eax, dword [rbp + 0x128]
test eax, eax
je 0x14003f65f
mov byte [rbp + rax + 0x50], 0
lea rax, [rbp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14003f620
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.14003aee0
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x128]
mov r8d, 0x7f
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003f600
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp rbx, 6
jb 0x14003f800
lea r14, [rbx + rsi]
lea r8, [r14 - 5]
sub r8, rsi
mov edx, 0x55
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14003f800
nop dword [rax]
cmp dword [rax], 0x44495555
jne 0x14003f6c0
cmp word [rax + 4], 0x203a
je 0x14003f6e1
inc rax
lea r8, [r14 - 5]
sub r8, rax
mov edx, 0x55
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x14003f6b0
jmp 0x14003f800
sub rax, rsi
cmp rax, 0xffffffffffffffff
je 0x14003f800
lea rsi, [rax + 6]
lea r14, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r14, qword [rsp + 0x50]
cmp rbx, 1
jb 0x14003f758
lea rax, [rbx - 1]
cmp rsi, rax
ja 0x14003f758
lea r15, [rax + r14]
lea rcx, [r14 + rsi]
lea r8, [r15 + 1]
sub r8, rcx
mov edx, reloc.WLDAP32.dll_Ordinal_41
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
je 0x14003f758
cmp byte [rcx], 0x29
je 0x14003f7f3
inc rcx
lea r8, [r15 + 1]
sub r8, rcx
mov edx, reloc.WLDAP32.dll_Ordinal_41
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
jne 0x14003f733
mov rcx, 0xffffffffffffffff
cmp rcx, 0xffffffffffffffff
je 0x14003f800
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
cmp rbx, rsi
jb 0x14003f88b
sub rcx, rsi
sub rbx, rsi
cmp rbx, rcx
cmovb rcx, rbx
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
add rdx, rsi
mov r8, rcx
lea rcx, [rbp - 0x80]
call fcn.14003ed00
lea rdx, [rbp - 0x80]
mov rcx, rdi
call fcn.140037ff0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14003f800
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f7fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f7fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, r14
jmp 0x14003f75f
call fcn.140084f34
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14003f870
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003f850
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140084f34
jmp 0x14003f870
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14003afa0
nop
int3