Function at 0x140023080
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x14011e900]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x60], rdx
xor r15d, r15d
mov dword [rbp - 0x80], 0x18
mov qword [rbp - 0x78], r15
mov dword [rbp - 0x70], 1
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140023114
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x140023139
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
xor r8d, r8d
lea rdx, [0x140108950]
mov rcx, rbx
call fcn.1400081b0
jmp 0x14002345e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
xorps xmm1, xmm1
movups xmmword [rbp - 0x5c], xmm1
movups xmmword [rbp - 0x4c], xmm1
movups xmmword [rbp - 0x3c], xmm1
movups xmmword [rbp - 0x2c], xmm1
mov qword [rbp - 0x1c], rax
mov dword [rbp - 0x14], eax
mov dword [rbp - 0x60], 0x68
psrldq xmm1, 8
movd eax, xmm1
bts eax, 8
mov dword [rbp - 0x24], eax
mov qword [rbp - 0x10], r15
mov rax, qword [rsp + 0x60]
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov rcx, qword [rdi + 0x10]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rcx
cmp rax, 0xb
jb 0x140023495
cmp qword [rdi + 0x18], 0xf
jbe 0x1400231b2
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], select
lea r9, str.cmd.exe__c
lea rcx, [rbp + 0x28]
call fcn.140009f50
nop
xorps xmm0, xmm0
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rdx, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x38]
add rdi, rdx
lea r14, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r14, qword [rbp + 0x28]
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r15
sub rdi, r14
mov rsi, r15
je 0x140023271
cmp rdi, r12
ja 0x14002349b
cmp rdi, 0x1000
jb 0x14002324b
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400234a1
call fcn.1400b21dc
mov rcx, rax
test rax, rax
je 0x1400234ad
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140023253
mov rcx, rdi
call fcn.1400b21dc
mov qword [rbp + 0x10], rax
lea rsi, [rax + rdi]
mov qword [rbp + 0x20], rsi
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1400e2b10
mov qword [rbp + 0x18], rsi
mov byte [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.140013830
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdi, qword [rbp + 0x10]
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400233b6
mov edx, 0x1388
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x48]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x58]
lea rdx, [rbp + 0x50]
call fcn.140022f00
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movups xmm0, xmmword [rbp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x60]
movups xmmword [rbx + 0x10], xmm1
test rdi, rdi
je 0x140023373
mov rdx, qword [rbp + 0x20]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002336a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400234a7
mov rcx, rdi
call fcn.1400b20f0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14002345e
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002348f
jmp 0x140023459
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
xor r8d, r8d
lea rdx, [0x140108950]
mov rcx, rbx
call fcn.1400081b0
nop
test rdi, rdi
je 0x140023427
mov rdx, qword [rbp + 0x20]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002341e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400234ad
mov rcx, rdi
call fcn.1400b20f0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14002345e
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023489
call fcn.1400b20f0
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1400b20d0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400c1c38
int3
call fcn.1400c1c38
int3
call fcn.1400014a0
nop
call fcn.1400072e0
nop
call fcn.140001400
int3
call fcn.1400c1c38
int3
call fcn.1400c1c38
int3