Function at 0x1400150b0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov rax, qword [0x1402f0eb8]
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [0x1402f0ea8]
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp + 0x90]
lea rdx, [rbp + 0x98]
lea r8, [rbp - 0x30]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140015343
xorps xmm6, xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x50], xmm6
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
mov qword [rbp + 0x70], 0
mov dword [rbp + 0x20], 0x68
mov dword [rbp + 0x5c], 0x101
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400153c4
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x400
call fcn.1402b475c
mov rdi, rax
movaps xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
lea r12, [rbp - 0x10]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
lea r15, [rbp + 0xa0]
jmp 0x14001520f
add rcx, rsi
mov rdx, rdi
call fcn.1402ba9f0
mov byte [rsi + rbx], 0
mov rcx, qword [rbp + 0x90]
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 8
mov r9, r12
call r13
test eax, eax
je 0x140015294
mov r8d, dword [rbp - 0x10]
test r8d, r8d
je 0x140015294
mov rcx, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xb8]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140015270
mov qword [rsp + 0x20], r8
mov rcx, r15
mov rdx, r8
mov r9, rdi
call fcn.1400024d0
jmp 0x14001520f
lea rbx, [rcx + r8]
mov qword [rbp + 0xb0], rbx
mov rsi, r15
cmp rax, 0x10
jb 0x140015200
mov rsi, qword [rbp + 0xa0]
jmp 0x140015200
mov rcx, rdi
call fcn.1402b4754
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov ecx, 0x20
call fcn.1402b4764
mov qword [r14], rax
movaps xmm0, xmmword [0x1402f0d90]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [str.Successfully_done]
movups xmmword [rax], xmm0
mov word [rax + 0x10], 0x65
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x140015818
mov rcx, qword [rbp + 0xa0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015813
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jb 0x140015809
call fcn.1402bfaa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ecx, 0xcccccccd
mov edx, eax
imul rdx, rcx
shr rdx, 0x23
lea ebx, [rdx + rdx]
lea ebx, [rbx + rbx*4]
mov edi, eax
sub edi, ebx
or dil, 0x30
mov byte [rbp + rsi + 0xb4], dil
dec rsi
cmp eax, 9
mov eax, edx
ja 0x140015350
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
test rsi, rsi
je 0x14001546d
mov rdi, rsi
neg rdi
js 0x140015836
lea r15, [rsi + rbp]
add r15, 0xb5
cmp rdi, 0xf
ja 0x140015528
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
lea rbx, [rbp + 0x20]
jmp 0x140015689
mov rcx, qword [rbp + 0x90]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x98]
call rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ecx, 0xcccccccd
nop word [rax + rax]
mov edx, eax
imul rdx, rcx
shr rdx, 0x23
lea ebx, [rdx + rdx]
lea ebx, [rbx + rbx*4]
mov edi, eax
sub edi, ebx
or dil, 0x30
mov byte [rbp + rsi + 4], dil
dec rsi
cmp eax, 9
mov eax, edx
ja 0x1400153f0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb0], xmm0
movaps xmmword [rbp + 0xa0], xmm0
test rsi, rsi
je 0x140015565
mov rdi, rsi
neg rdi
js 0x140015836
lea r15, [rsi + rbp]
add r15, 5
cmp rdi, 0xf
ja 0x140015633
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
lea rbx, [rbp + 0xa0]
jmp 0x14001575b
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov eax, reloc.WS2_32.dll_ntohs
xor r8d, r8d
mov rcx, rax
sub rcx, r8
cmp rcx, 0x15
jb 0x1400156b5
lea rcx, [r8 + 0x15]
mov qword [rbp + 0x30], rcx
cmp rax, 0x10
mov rcx, qword [rbp + 0x20]
lea rdi, [rbp + 0x20]
mov rsi, rdi
cmovae rsi, rcx
lea rdx, [0x1402f0ef5]
mov r15d, reloc.WS2_32.dll_setsockopt
mov ebx, reloc.WS2_32.dll_setsockopt
cmp rsi, rdx
jae 0x1400154de
lea rdx, [rsi + r8]
lea r9, str.CreatePipe___failed:
mov ebx, reloc.WS2_32.dll_setsockopt
cmp rdx, r9
jb 0x1400154de
mov rbx, rsi
sub rbx, r9
ja 0x1400154de
xor ebx, ebx
inc r8
cmp rax, 0x10
cmovb rcx, rdi
add rcx, 0x15
mov rdx, rsi
call fcn.1402ba9f0
lea r12, str.CreatePipe___failed:
mov rcx, rsi
mov rdx, r12
mov r8, rbx
call fcn.1402ba9f0
sub r15, rbx
lea rdx, [rbx + r12]
add rdx, 0x15
add rsi, rbx
mov rcx, rsi
mov r8, r15
call fcn.1402ba9f0
jmp 0x1400156de
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r12d, reloc.WS2_32.dll_shutdown
cmovae r12, rax
cmp r12, 0xfff
jb 0x140015670
lea rcx, [r12 + 0x28]
call fcn.1402b4764
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14001567d
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov eax, reloc.WS2_32.dll_ntohs
xor r8d, r8d
mov rcx, rax
sub rcx, r8
cmp rcx, 0x18
jb 0x14001578d
lea rcx, [rbp + 0xb8]
lea rdx, [r8 + 0x18]
mov qword [rbp + 0xb0], rdx
cmp rax, 0x10
mov rdx, qword [rbp + 0xa0]
lea rdi, [rbp + 0xa0]
mov rsi, rdi
cmovae rsi, rdx
lea r9, [0x1402f0e8e]
mov r15d, 0x18
mov ebx, 0x18
cmp rsi, r9
jae 0x1400155e9
lea r10, [rsi + r8]
lea r9, str.CreateProcess___failed:
mov ebx, 0x18
cmp r10, r9
jb 0x1400155e9
mov rbx, rsi
sub rbx, r9
ja 0x1400155e9
xor ebx, ebx
inc r8
add rdx, 0x18
cmp rax, 0x10
cmovae rcx, rdx
mov rdx, rsi
call fcn.1402ba9f0
lea r12, str.CreateProcess___failed:
mov rcx, rsi
mov rdx, r12
mov r8, rbx
call fcn.1402ba9f0
sub r15, rbx
lea rdx, [rbx + r12]
add rdx, 0x18
add rsi, rbx
mov rcx, rsi
mov r8, r15
call fcn.1402ba9f0
jmp 0x1400157b9
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r12d, reloc.WS2_32.dll_shutdown
cmovae r12, rax
cmp r12, 0xfff
jb 0x140015739
lea rcx, [r12 + 0x28]
call fcn.1402b4764
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140015746
lea rcx, [r12 + 1]
call fcn.1402b4764
mov rbx, rax
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r12
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call fcn.1402ba9f0
sub rbx, rsi
mov byte [rbx], 0
mov r8, qword [rbp + 0x30]
mov rax, qword [rbp + 0x38]
mov rcx, rax
sub rcx, r8
cmp rcx, 0x15
jae 0x14001548d
lea rax, str.CreatePipe___failed:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
lea rcx, [rbp + 0x20]
mov edx, reloc.WS2_32.dll_setsockopt
xor r9d, r9d
call fcn.14000a620
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x1402ef840]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
mov rax, qword [rbp + 0x38]
cmp rax, 0x10
jb 0x140015818
mov rcx, qword [rbp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015813
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jb 0x140015809
call fcn.1402bfaa4
lea rcx, [r12 + 1]
call fcn.1402b4764
mov rbx, rax
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], r12
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call fcn.1402ba9f0
sub rbx, rsi
mov byte [rbx], 0
mov r8, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xb8]
mov rcx, rax
sub rcx, r8
cmp rcx, 0x18
jae 0x140015588
lea rax, str.CreateProcess___failed:
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x18
lea rcx, [rbp + 0xa0]
mov edx, 0x18
xor r9d, r9d
call fcn.14000a620
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
movaps xmm0, xmmword [0x1402ef840]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x140015818
mov rcx, qword [rbp + 0xa0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015813
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14001583b
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1402b4754
mov rax, r14
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140002090
call fcn.1402bfaa4
int3