Function at 0x140010db0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f8]
sub rsp, 0x5d0
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r13
lea r15d, [r13 + 0xf]
mov qword [rcx + 0x18], r15
mov byte [rcx], r13b
mov dword [rsp + 0x50], 1
xor eax, eax
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
mov word [rbp + 0xb8], ax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r15
mov byte [rbp + 0x40], r13b
test edx, edx
je 0x140010eae
sub edx, 1
je 0x140010ea5
cmp edx, 1
jne 0x140010f0a
lea r8, str.wmic_cpu_get_processorid
lea edx, [rax + 0x32]
lea rcx, [rbp + 0x88]
call fcn.1400a6c48
lea edx, [r13 + 0xb]
cmp qword [rbp + 0x58], rdx
jb 0x140010e9c
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova rbx, qword [rbp + 0x40]
mov qword [rbp + 0x50], rdx
mov r8d, edx
lea rdx, str.ProcessorId
mov rcx, rbx
call fcn.1400ce3e0
mov byte [rbx + 0xb], r13b
jmp 0x140010f0a
lea r9, str.ProcessorId
jmp 0x140010f01
lea r8, str.wmic_bios_get_serialnumber
jmp 0x140010eb5
lea r8, str.wmic_BaseBoard_get_SerialNumber
mov edx, 0x32
lea rcx, [rbp + 0x88]
call fcn.1400a6c48
mov edx, 0xc
cmp qword [rbp + 0x58], rdx
jb 0x140010efa
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
mov qword [rbp + 0x50], rdx
mov r8d, edx
cmova rbx, qword [rbp + 0x40]
lea rdx, str.SerialNumber
mov rcx, rbx
call fcn.1400ce3e0
mov byte [rbx + 0xc], r13b
jmp 0x140010f0a
lea r9, str.SerialNumber
lea rcx, [rbp + 0x40]
call fcn.14001b8bc
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x70], r13
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400ceb20
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov dword [rbp + 0x80], r13d
mov ecx, ebx
call fcn.1400a91bc
mov r14, rax
mov qword [rsp + 0x58], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400ceb20
mov qword [rbp - 0x38], r13
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x2c]
call fcn.1400ceb20
mov qword [rbp - 0x60], 0x18
mov qword [rbp - 0x50], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x30], 0x68
mov qword [rbp - 0x58], r13
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14001129a
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x28], rax
mov word [rbp + 0x10], r13w
mov dword [rbp + 0xc], 0x101
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14001129a
lea edx, [rbx - 0x15]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x80]
lea r8d, [rbx - 1]
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001129a
lea rax, [rbp + 0xc0]
or rdi, 0xffffffffffffffff
mov r14, rdi
inc r14
cmp byte [rax + r14], r13b
jne 0x14001105d
cmp r14, qword [rbp + 0x78]
ja 0x140011095
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova rbx, qword [rbp + 0x60]
mov qword [rbp + 0x70], r14
mov r8, r14
lea rdx, [rbp + 0xc0]
mov rcx, rbx
call fcn.1400ce3e0
mov byte [rbx + r14], r13b
jmp 0x1400110a8
lea r9, [rbp + 0xc0]
mov rdx, r14
lea rcx, [rbp + 0x60]
call fcn.14001b8bc
lea r13, [rbp + 0x40]
cmp qword [rbp + 0x58], r15
cmova r13, qword [rbp + 0x40]
lea r14, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r14, qword [rbp + 0x60]
mov r15, qword [rbp + 0x50]
mov r12, qword [rbp + 0x70]
cmp r15, r12
ja 0x14001112e
mov rax, r12
sub rax, r15
test r15, r15
jne 0x1400110e2
xor r13d, r13d
mov ebx, r13d
jmp 0x140011134
inc rax
add rax, r14
mov qword [rsp + 0x60], rax
mov r8, rax
sub r8, r14
mov rcx, r14
jmp 0x14001111c
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1400ceec0
test eax, eax
je 0x140011284
inc rbx
mov r8, qword [rsp + 0x60]
sub r8, rbx
mov rcx, rbx
movsx edx, byte [r13]
call fcn.1400cea60
test rax, rax
mov rbx, rax
jne 0x1400110f8
mov rbx, rdi
xor r13d, r13d
lea rcx, [r15 + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
cmp r12, rcx
jb 0x140011380
sub r12, rcx
mov r8, rdi
cmp r12, rdi
cmovb r8, r12
lea rdx, [rbp + 0x60]
mov r15d, 0xf
cmp qword [rbp + 0x78], r15
cmova rdx, qword [rbp + 0x60]
add rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140002d1c
mov dword [rsp + 0x50], 3
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x60]
call fcn.1400197ec
mov rdx, qword [rbp - 0x80]
cmp rdx, r15
jbe 0x1400111d0
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400111cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011386
call fcn.14009e230
mov ebx, 0x3fd
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xc0]
call fcn.1400ceb20
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], r15
cmova r8, qword [rbp + 0x60]
mov edx, ebx
lea rcx, [rbp + 0xc0]
call fcn.1400a6c48
lea rax, [rbp + 0xc0]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], r13b
jne 0x14001120b
mov rdx, r13
mov r14, qword [rsp + 0x58]
test rcx, rcx
je 0x140011251
mov r9, r14
movsx r8, byte [rbp + rdx + 0xc0]
cmp r8b, 0x20
ja 0x140011243
movabs r10, 0x100002400
bt r10, r8
jb 0x140011249
mov byte [r9], r8b
inc r9
inc rdx
cmp rdx, rcx
jb 0x140011224
inc rdi
cmp byte [r14 + rdi], r13b
jne 0x140011251
cmp rdi, qword [rsi + 0x18]
ja 0x14001128c
mov rbx, rsi
cmp qword [rsi + 0x18], r15
jbe 0x14001126c
mov rbx, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400ce3e0
mov byte [rbx + rdi], r13b
jmp 0x14001129a
sub rbx, r14
jmp 0x140011131
mov r9, r14
mov rdx, rdi
mov rcx, rsi
call fcn.14001b8bc
mov rcx, r14
call fcn.1400a88b4
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, r15
jbe 0x140011305
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011300
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001138c
call fcn.14009e230
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], r13b
mov rdx, qword [rbp + 0x58]
cmp rdx, r15
jbe 0x140011347
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001137a
call fcn.14009e230
mov rax, rsi
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14009e210
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400a9144
nop
call fcn.14001a4fc
int3
call fcn.1400a9144
nop
call fcn.1400a9144
int3