Function at 0x180003d60
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x1800fc040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x90], rcx
xor esi, esi
mov dword [rsp + 0x70], esi
movabs r15, 0x284c7e93e0a45309
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
movabs r14, 0xb617665ac46d7c7e
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1e8], rax
movdqa xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
lea rax, [rsp + 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], sil
jne 0x180003e30
lea rdx, [rsp + 0x80]
call fcn.180003970
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x130], 0x18
mov qword [rsp + 0x138], rsi
mov dword [rsp + 0x140], 1
xor r9d, r9d
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x180004042
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
movups xmmword [rsp + 0x180], xmm0
movups xmmword [rsp + 0x190], xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], rax
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], rax
mov dword [rsp + 0x150], 0x68
mov dword [rsp + 0x18c], 0x101
mov word [rsp + 0x190], si
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x110]
test eax, eax
je 0x1800040f0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov dword [rsp + 0x1c0], esi
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x1c0]
mov r8d, 0x80
lea rdx, [rsp + 0x200]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180003fec
mov eax, dword [rsp + 0x1c0]
test eax, eax
je 0x180003fec
cmp rax, 0x80
jae 0x1800041b2
mov byte [rsp + rax + 0x200], 0
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003fd0
lea rdx, [rsp + 0x200]
mov rcx, rbx
call fcn.180012b30
jmp 0x180003f70
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18001e390
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
movabs rax, 0x15094cc98ec83e6b
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x1e0]
call fcn.180003930
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x98]
call fcn.18001d2b0
nop
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.180001770
lea rdx, [0x1800f8d10]
lea rcx, [rsp + 0xb8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x15094cc98ec83e6b
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x50], r14
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1d8], rax
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.180003930
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xe8]
call fcn.18001d2b0
nop
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.180001770
lea rdx, [0x1800f8d10]
lea rcx, [rsp + 0xd0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.18001e4c0
int3