Function at 0x14006f57f
Capabilities:
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov eax, 0x10338
call fcn.140072b30
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10300], rcx
mov byte [rbp + 0x1029f], 0
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8d, 5
mov edx, 0
mov rcx, rax
call sym.__new_array_with_default
mov rax, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x28]
mov qword [rbp + 0x10230], rax
mov qword [rbp + 0x10238], rdx
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x38]
mov qword [rbp + 0x10240], rax
mov qword [rbp + 0x10248], rdx
mov byte [rbp + 0x1029f], 1
mov rdi, qword [rbp + 0x10300]
lea rcx, [rbp + 0x10]
mov rax, qword [rbp + 0x10300]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, rbp
mov rdx, rax
call sym.os__abs_path
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
lea rax, [rbp + 0x1d0]
mov edx, 0x10040
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x1d0]
mov edx, 0x10040
mov rcx, rax
call sym.memdup
mov qword [rbp + 0x10290], rax
mov rax, qword [rbp + 0x10300]
mov rdx, qword [rbp + 0x10290]
mov qword [rax + 0x98], rdx
lea rdx, [rbp + 0x160]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x160], 0x68
mov rax, qword [rbp + 0x10300]
movzx eax, byte [rax + 0x88]
test al, al
je 0x14006f949
mov dword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov byte [rbp + 0x80], 0
mov dword [rbp + 0x70], 0x18
mov byte [rbp + 0x80], 1
mov rax, qword [rbp + 0x10290]
lea rdx, [rax + 0x10028]
mov rax, qword [rbp + 0x10290]
lea rcx, [rax + 0x10020]
lea rax, [rbp + 0x70]
mov r9d, 0
mov r8, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
mov byte [rbp + 0x1028f], al
lea rax, str.CreatePipe_stdout
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp - 8]
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0x11
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov qword [rbp - 8], rax
movzx eax, byte [rbp + 0x1028f]
movdqu xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x10], xmm1
lea rdx, [rbp + 0x10]
mov ecx, eax
call sym.os__failed_cfn_report_error
mov rax, qword [rbp + 0x10290]
mov rax, qword [rax + 0x10020]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
mov byte [rbp + 0x1028e], al
lea rax, str.SetHandleInformation
mov qword [rbp - 0x20], rax
mov rdx, qword [rbp - 0x18]
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0x14
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov qword [rbp - 0x18], rax
movzx eax, byte [rbp + 0x1028e]
movdqu xmm2, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x10], xmm2
lea rdx, [rbp + 0x10]
mov ecx, eax
call sym.os__failed_cfn_report_error
mov rax, qword [rbp + 0x10290]
lea rdx, [rax + 0x10038]
mov rax, qword [rbp + 0x10290]
add rax, 0x10030
lea rcx, [rbp + 0x70]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
mov byte [rbp + 0x1028d], al
lea rax, str.CreatePipe_stderr
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x28]
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0x11
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov qword [rbp - 0x28], rax
movzx eax, byte [rbp + 0x1028d]
movdqu xmm3, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x10], xmm3
lea rdx, [rbp + 0x10]
mov ecx, eax
call sym.os__failed_cfn_report_error
mov rax, qword [rbp + 0x10290]
mov rax, qword [rax + 0x10030]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
mov byte [rbp + 0x1028c], al
lea rbx, str.SetHandleInformation_stderr
mov rdx, rsi
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0x1b
mov rsi, rax
mov rax, rsi
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov rsi, rax
movzx eax, byte [rbp + 0x1028c]
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 0x10]
mov ecx, eax
call sym.os__failed_cfn_report_error
mov rax, qword [rbp + 0x10290]
mov rax, qword [rax + 0x10018]
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x10290]
mov rax, qword [rax + 0x10028]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x10290]
mov rax, qword [rax + 0x10038]
mov qword [rbp + 0x1c0], rax
mov dword [rbp + 0x19c], 0x100
lea r14, [0x140088edd]
mov rdx, r15
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 1
mov r15, rax
mov rax, r15
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov r15, rax
lea r9, [rbp + 0x10250]
mov rcx, qword [rbp + 0x10300]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rcx + 0x38]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
mov rax, qword [rcx + 0x40]
mov rdx, qword [rcx + 0x48]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r15
lea rdx, [rbp + 0x10]
lea rax, [rbp + 0x20]
mov r8, rdx
mov rdx, rax
mov rcx, r9
call sym.Array_string_join
pxor xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
lea rax, [0x140088256]
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x9c], 1
mov dword [rbp + 0xa0], 0xfe10
mov rax, qword [rbp + 0x10300]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rdx
lea rax, [0x140088edd]
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xc0], 1
mov dword [rbp + 0xc4], 1
lea rax, [rbp + 0x10260]
lea rdx, [rbp + 0x90]
mov r8, rdx
mov edx, 2
mov rcx, rax
call sym.str_intp
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 0x10260]
mov rdx, qword [rbp + 0x10268]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10250]
mov rdx, qword [rbp + 0x10258]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rdx, rbp
lea rax, [rbp + 0x10]
mov r8, rdx
mov rdx, rax
call sym.string__plus
mov rax, qword [rbp + 0xe0]
mov rdx, qword [rbp + 0xe8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
lea rax, [rbp + 0x10]
mov rcx, rax
call sym.string_to_wide
mov qword [rbp + 0x10280], rax
mov rax, qword [rbp + 0x10280]
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x88]
lea rax, [rbp + 0x10230]
mov rcx, rax
call sym.array_push
mov rax, qword [rbp + 0x10290]
lea rdx, [rax + 0x18]
mov rax, qword [rbp + 0x10280]
mov r8d, 0x8000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call rax
mov rax, qword [rbp + 0x10300]
movzx eax, byte [rax + 0xa0]
test al, al
je 0x14006fb3c
mov eax, 0x8000000
jmp 0x14006fb41
mov eax, 0x20
mov dword [rbp + 0x102a8], eax
mov rax, qword [rbp + 0x10300]
movzx eax, byte [rax + 0x89]
test al, al
je 0x14006fb63
or dword [rbp + 0x102a8], 0x200
mov qword [rbp + 0x102a0], 0
mov rax, qword [rbp + 0x10300]
mov eax, dword [rax + 0x58]
test eax, eax
je 0x14006fbc4
mov rax, qword [rbp + 0x10300]
mov rdx, qword [rax + 0x58]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
lea rax, [rbp + 0x10]
mov rcx, rax
call sym.string_to_wide
mov qword [rbp + 0x102a0], rax
mov rax, qword [rbp + 0x102a0]
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x48]
lea rax, [rbp + 0x10230]
mov rcx, rax
call sym.array_push
mov rcx, qword [rbp + 0x10290]
mov edx, dword [rbp + 0x102a8]
mov rax, qword [rbp + 0x10290]
add rax, 0x18
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp + 0x102a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
mov byte [rbp + 0x1027f], al
lea r12, str.CreateProcess
mov rdx, r13
movabs rax, 0xffffffff00000000
and rax, rdx
or rax, 0xd
mov r13, rax
mov rax, r13
mov edx, eax
movabs rax, 0x100000000
or rax, rdx
mov r13, rax
movzx eax, byte [rbp + 0x1027f]
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r13
lea rdx, [rbp + 0x10]
mov ecx, eax
call sym.os__failed_cfn_report_error
mov rax, qword [rbp + 0x10300]
movzx eax, byte [rax + 0x88]
test al, al
je 0x14006fcba
mov rax, qword [rbp + 0x10290]
add rax, 0x10028
mov rcx, rax
call sym.os__close_valid_handle
mov rax, qword [rbp + 0x10290]
add rax, 0x10038
mov rcx, rax
call sym.os__close_valid_handle
mov rax, qword [rbp + 0x10290]
mov eax, dword [rax + 0x10]
mov edx, eax
mov rax, qword [rbp + 0x10300]
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10300]
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x10278], eax
cmp byte [rbp + 0x1029f], 0
je 0x14006fd62
mov eax, dword [rbp + 0x1023c]
sub eax, 1
mov dword [rbp + 0x102ac], eax
jmp 0x14006fd4a
mov rax, qword [rbp + 0x10230]
mov rdx, qword [rbp + 0x10238]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
mov rax, qword [rbp + 0x10240]
mov rdx, qword [rbp + 0x10248]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
mov edx, dword [rbp + 0x102ac]
lea rax, [rbp + 0x20]
mov rcx, rax
call sym.array_get
mov rax, qword [rax]
mov rcx, rax
call sym._v_free
sub dword [rbp + 0x102ac], 1
cmp dword [rbp + 0x102ac], 0
jns 0x14006fcfa
lea rax, [rbp + 0x10230]
mov rcx, rax
call sym.array_free
mov eax, dword [rbp + 0x10278]
add rsp, 0x10338
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret