Function at 0x140010c78
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5d0
mov rax, qword [0x14019b100]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
lea r15d, [r13 + 0xf]
mov qword [rcx + 0x18], r15
mov byte [rcx], r13b
mov dword [rsp + 0x50], 1
xor eax, eax
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
mov word [rbp + 0xb8], ax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x40], r13b
test edx, edx
je 0x140010d76
sub edx, 1
je 0x140010d6d
cmp edx, 1
jne 0x140010dd2
lea r8, str.wmic_cpu_get_processorid
lea edx, [rax + 0x32]
lea rcx, [rbp + 0x88]
call fcn.1400a4b30
lea edx, [r13 + 0xb]
cmp qword [rbp + 0x58], rdx
jb 0x140010d64
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova rbx, qword [rbp + 0x40]
mov qword [rbp + 0x50], rdx
mov r8d, edx
lea rdx, str.ProcessorId
mov rcx, rbx
call fcn.1400cc230
mov byte [rbx + 0xb], r13b
jmp 0x140010dd2
lea r9, str.ProcessorId
jmp 0x140010dc9
lea r8, str.wmic_bios_get_serialnumber
jmp 0x140010d7d
lea r8, str.wmic_BaseBoard_get_SerialNumber
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.1400a4b30
mov edx, 0xc
cmp qword [rbp + 0x58], rdx
jb 0x140010dc2
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
mov qword [rbp + 0x50], rdx
mov r8d, edx
cmova rbx, qword [rbp + 0x40]
lea rdx, str.SerialNumber
mov rcx, rbx
call fcn.1400cc230
mov byte [rbx + 0xc], r13b
jmp 0x140010dd2
lea r9, str.SerialNumber
lea rcx, [rbp + 0x40]
call fcn.14001b510
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x70], r13
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400cc970
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov dword [rbp + 0x80], r13d
mov ecx, ebx
call fcn.1400a709c
mov r14, rax
mov qword [rsp + 0x58], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400cc970
mov qword [rbp - 0x38], r13
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x2c]
call fcn.1400cc970
mov qword [rbp - 0x60], 0x18
mov qword [rbp - 0x50], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x30], 0x68
mov qword [rbp - 0x58], r13
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140011162
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
mov word [rbp + 0x10], r13w
mov dword [rbp + 0xc], 0x101
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140011162
lea edx, [rbx - 0x15]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x80]
lea r8d, [rbx - 1]
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011162
lea rax, [rbp + 0xc0]
or rdi, 0xffffffffffffffff
mov r14, rdi
inc r14
cmp byte [rax + r14], r13b
jne 0x140010f25
cmp r14, qword [rbp + 0x78]
ja 0x140010f5d
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova rbx, qword [rbp + 0x60]
mov qword [rbp + 0x70], r14
mov r8, r14
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call fcn.1400cc230
mov byte [rbx + r14], r13b
jmp 0x140010f70
lea r9, [rbp + 0xc0]
mov rdx, r14
lea rcx, [rbp + 0x60]
call fcn.14001b510
lea r13, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova r13, qword [rbp + 0x40]
lea r14, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r14, qword [rbp + 0x60]
mov r15, qword [rbp + 0x50]
mov r12, qword [rbp + 0x70]
cmp r15, r12
ja 0x140010ff6
mov rax, r12
sub rax, r15
test r15, r15
jne 0x140010faa
xor r13d, r13d
mov ebx, r13d
jmp 0x140010ffc
inc rax
add rax, r14
mov qword [rsp + 0x60], rax
mov r8, rax
sub r8, r14
mov rcx, r14
jmp 0x140010fe4
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1400ccd10
test eax, eax
je 0x14001114c
inc rbx
mov r8, qword [rsp + 0x60]
sub r8, rbx
mov rcx, rbx
movsx edx, byte [r13]
call fcn.1400cc8b0
test rax, rax
mov rbx, rax
jne 0x140010fc0
mov rbx, rdi
xor r13d, r13d
lea rcx, [r15 + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
cmp r12, rcx
jb 0x140011248
sub r12, rcx
mov r8, rdi
cmp r12, rdi
cmovb r8, r12
lea rdx, [rbp + 0x60]
mov r15d, 0xf
cmp qword [rbp + 0x78], r15
cmova rdx, qword [rbp + 0x60]
add rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140002bac
mov dword [rsp + 0x50], 3
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.140019454
mov rdx, qword [rbp - 0x80]
cmp rdx, r15
jbe 0x140011098
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011093
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001124e
call fcn.14009cfe0
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400cc970
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r8, qword [rbp + 0x60]
mov edx, ebx
lea rcx, [rbp + 0xc0]
call fcn.1400a4b30
lea rax, [rbp + 0xc0]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], r13b
jne 0x1400110d3
mov rdx, r13
mov r14, qword [rsp + 0x58]
test rcx, rcx
je 0x140011119
mov r9, r14
movsx r8, byte [rbp + rdx + 0xc0]
cmp r8b, 0x20
ja 0x14001110b
movabs r10, 0x100002400
bt r10, r8
jb 0x140011111
mov byte [r9], r8b
inc r9
inc rdx
cmp rdx, rcx
jb 0x1400110ec
inc rdi
cmp byte [r14 + rdi], r13b
jne 0x140011119
cmp rdi, qword [rsi + 0x18]
ja 0x140011154
mov rbx, rsi
cmp qword [rsi + 0x18], r15
jbe 0x140011134
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400cc230
mov byte [rbx + rdi], r13b
jmp 0x140011162
sub rbx, r14
jmp 0x140010ff9
mov r9, r14
mov rdx, rdi
mov rcx, rsi
call fcn.14001b510
mov rcx, r14
call fcn.1400a6794
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r15
jbe 0x1400111cd
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011254
call fcn.14009cfe0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov rdx, qword [rbp + 0x58]
cmp rdx, r15
jbe 0x14001120f
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001120a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011242
call fcn.14009cfe0
mov rax, rsi
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14009cfc0
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400a7024
nop
call fcn.14001a148
int3
call fcn.1400a7024
nop
call fcn.1400a7024
int3