Function at 0x140037490
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1150]
mov eax, 0x1250
call fcn.14003e6b0
sub rsp, rax
mov rax, qword [0x140087048]
xor rax, rsp
mov qword [rbp + 0x1140], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov r13d, edi
mov qword [rbp + 0x98], rdi
mov r15d, 0xf
mov qword [rbp + 0xa0], r15
mov byte [rbp + 0x88], dil
xor eax, eax
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rax
lea rdx, str.__.__
lea rcx, [rbp + 0xa8]
call fcn.1400103c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0xd0], rdi
mov byte [rbp + 0xd8], dil
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
mov qword [rbp + 0x100], rdi
mov byte [rbp + 0x108], dil
movdqa xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x120], dil
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x130], rdi
mov byte [rbp + 0x138], dil
cmp qword [rbx + 0x18], 0x10
jb 0x1400375b6
mov rdx, qword [rbx]
mov r11, rdx
mov r10, rdx
add r11, qword [rbx + 0x10]
jmp 0x1400375c3
mov r11, qword [rbx + 0x10]
add r11, rbx
mov r10, rbx
mov rdx, rbx
mov qword [rsp + 0x28], rdx
lea r9, [rbp + 0xa8]
lea r8, [rbp + 0xd0]
mov rdx, r11
mov rcx, r10
call fcn.140010d90
test al, al
je 0x1400376b4
mov rcx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xe0]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
ja 0x14003762b
lea rax, [rbp + 0x128]
lea r8, [rbp + 0x138]
jmp 0x140037633
lea rax, [r8 + 0x18]
add r8, 0x28
cmp byte [r8], 0
je 0x140037643
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
jmp 0x14003764c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
cmp rdx, r8
jne 0x14003767c
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
jmp 0x140037689
sub r8, rdx
lea rcx, [rsp + 0x60]
call fcn.140007670
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x98], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r15, xmm0
movq r13, xmm1
mov dword [rbp - 0x50], 0x18
mov dword [rbp - 0x40], 1
mov qword [rbp - 0x48], rdi
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
test eax, eax
jne 0x140037789
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rdi
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
lea rcx, [rbp + 0xe0]
call fcn.1400102a0
nop
lea rcx, [rbp + 0xa8]
call fcn.1400106c0
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140037746
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140037746
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0x10
jb 0x140037db2
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037dad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037deb
jmp 0x140037dad
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp - 0x2c], xmm1
movups xmmword [rbp - 0x1c], xmm1
movups xmmword [rbp - 0xc], xmm1
movups xmmword [rbp + 4], xmm1
movups xmmword [rbp + 0x14], xmm1
mov dword [rbp + 0x24], eax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x30], 0x68
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
psrldq xmm1, 8
movd eax, xmm1
bts eax, 8
mov dword [rbp + 0xc], eax
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x18
jb 0x140037df1
lea rax, [rbp + 0x88]
mov r14, qword [rbp + 0x88]
cmp r15, 0x10
cmovae rax, r14
mov qword [rsp + 0x50], rax
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
lea r12, [r13 + 0x18]
mov ebx, 0xf
lea rdi, [rbp + 0x48]
lea rdx, [rbx - 0x10]
lea r8d, [rbx + 7]
cmp r12, rbx
jbe 0x1400378a2
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x14003783c
mov rbx, rcx
jmp 0x140037843
cmp rbx, r8
cmovb rbx, r8
mov rcx, rbx
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140037888
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140037df7
mov rcx, rax
call fcn.14003dd78
test rax, rax
je 0x140037dfd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x14003789e
test rcx, rcx
je 0x14003789c
call fcn.14003dd78
mov rdi, rax
mov rax, qword [rsp + 0x50]
jmp 0x14003789e
xor edi, edi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], rbx
movups xmm0, xmmword [str.powershell.exe__Command]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x14007a398]
movsd qword [rdi + 0x10], xmm0
lea rcx, [rdi + 0x18]
mov r8, r13
mov rdx, rax
call fcn.1400401b0
mov byte [rdi + r12], 0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae rdx, qword [rbp + 0x48]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140037a22
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
xor r8d, r8d
lea rdx, [0x1400775f0]
mov rcx, rsi
call fcn.140007670
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140037993
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003798e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037dfd
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
lea rcx, [rbp + 0xe0]
call fcn.1400102a0
nop
lea rcx, [rbp + 0xa8]
call fcn.1400106c0
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x1400379e6
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400379e6
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0x10
jb 0x140037db2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140037daa
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037deb
jmp 0x140037daa
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], bl
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov r8d, 0xfff
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037ade
nop dword [rax]
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x140037ade
cmp rax, 0x1000
jae 0x140037e09
mov byte [rbp + rax + 0x140], 0
lea rax, [rbp + 0x140]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140037aa0
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x68]
call fcn.140006e40
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
mov r8d, 0xfff
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140037a70
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rbp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x140037e03
lea rax, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae rax, qword [rbp + 0x68]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r13 + 1]
mov edi, 0xf
lea rbx, [rsp + 0x60]
cmp r12, rdi
jbe 0x140037bec
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x140037b78
mov rdi, rcx
jmp 0x140037b85
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140037bd1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140037e0f
mov rcx, rax
call fcn.14003dd78
test rax, rax
je 0x140037e15
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rsp + 0x50]
jmp 0x140037be7
test rcx, rcx
je 0x140037be5
call fcn.14003dd78
mov rbx, rax
mov rax, qword [rsp + 0x50]
jmp 0x140037be7
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rdi
mov byte [rbx], 0x60
lea rcx, [rbx + 1]
mov r8, r13
mov rdx, rax
call fcn.1400401b0
mov byte [rbx + r12], 0
mov r8d, 1
lea rdx, [0x140079e0c]
lea rcx, [rsp + 0x60]
call fcn.140006e40
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140037c8d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037c88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e15
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140037cde
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037cd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e1b
call fcn.14003dd70
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140037d2c
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e21
call fcn.14003dd70
movdqa xmm0, xmmword [0x14007a5f0]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
lea rcx, [rbp + 0xe0]
call fcn.1400102a0
nop
lea rcx, [rbp + 0xa8]
call fcn.1400106c0
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x140037d7f
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140037d7f
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
cmp r15, 0x10
jb 0x140037db2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140037daa
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037de5
mov rcx, r14
call fcn.14003dd70
mov rax, rsi
mov rcx, qword [rbp + 0x1140]
xor rcx, rsp
call fcn.14003dd50
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400447b4
int3
call fcn.1400447b4
nop
call fcn.140004270
nop
call fcn.1400041d0
int3
call fcn.1400447b4
nop
call fcn.140004270
int3
call fcn.14003e208
int3
call fcn.1400041d0
int3
call fcn.1400447b4
nop
call fcn.1400447b4
nop
call fcn.1400447b4
int3