Function at 0x1400b8c00
Capabilities:
Create pipe
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
lea rbp, [rsp + 0x50]
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [rdx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400b8c30
lea rax, [rax*2 + 2]
movabs r13, 0xffffffffffffff0
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b8c59
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x3fffffff
mov qword [rbp + 0x38], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rbp], rbx
xor ebx, ebx
mov qword [rbp + 8], rbx
test rdi, rdi
je 0x1400b8ca8
cmp qword [rdi], rbx
jne 0x1400b8cac
lea rdi, [rbp]
movzx r15d, byte [rbp + 0x1d8]
mov rcx, qword [rdi]
test r15b, 0x10
je 0x1400b8d94
mov edx, 1
mov rax, rdi
test rcx, rcx
je 0x1400b8cf9
nop
cmp rax, rdi
lea r8, [rdx + 1]
cmove r8, rdx
add rax, 8
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], bl
jne 0x1400b8ce6
mov rcx, qword [rax]
add rdx, r8
test rcx, rcx
jne 0x1400b8cd0
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400b8d05
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.1400bd490
sub rsp, rax
mov r9, rdi
mov r8b, 0x20
lea rbx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400b8b50
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400b8d30
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b8d4f
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
lea rsi, [rsp + 0x50]
mov dword [rsp + 0x28], 0x3fffffff
mov qword [rbp + 0x1b0], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
jmp 0x1400b8e18
test rcx, rcx
jne 0x1400b8d9f
lea r9d, [rcx + 1]
jmp 0x1400b8ddf
mov r9, rbx
mov rdx, rdi
nop word [rax + rax]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], bl
lea rax, [rax + 1]
jne 0x1400b8dc0
mov rcx, qword [rdx + 8]
lea r9, [r9 + rax*2]
add rdx, 8
add r9, 3
test rcx, rcx
jne 0x1400b8db0
lea rax, [r9 + r9]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b8def
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
mov r8, rdi
mov rdx, r9
lea rax, [rsp + 0x50]
mov rcx, rax
mov qword [rbp + 0x1b0], rax
call fcn.1400b89f0
mov qword [rbp + 0x1a8], rbx
test r14, r14
je 0x1400b8eff
mov rax, qword [r14]
mov r8d, 1
mov rdx, r14
test rax, rax
je 0x1400b8e72
nop dword [rax]
mov r9, rdx
mov rcx, 0xffffffffffffffff
add rdx, 8
nop
cmp byte [rax + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400b8e50
cmp r9, r14
lea rax, [r8 + 1]
cmove rax, r8
lea r8, [rax + rcx]
mov rax, qword [rdx]
test rax, rax
jne 0x1400b8e40
lea edi, [r8 + 1]
movsxd rcx, edi
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400b8e85
mov rax, r13
and rax, 0xfffffffffffffff0
call fcn.1400bd490
sub rsp, rax
lea rax, [rcx + rcx]
lea rcx, [rax + 0xf]
lea rsi, [rsp + 0x50]
cmp rcx, rax
ja 0x1400b8ea6
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
movsxd rbx, r8d
mov r9, r14
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
lea r15, [rsp + 0x50]
mov qword [rbp + 0x1a8], r15
call fcn.1400b8b50
mov r9d, edi
mov dword [rsp + 0x28], edi
mov r8, rsi
mov byte [rbx + rsi], 0
xor edx, edx
mov qword [rsp + 0x20], r15
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx r15d, byte [rbp + 0x1d8]
xor ebx, ebx
lea rcx, [rbp + 0x18]
call fcn.1400b8690
lea rcx, [rbp + 0x10]
call fcn.1400b8690
lea rcx, [rbp + 0x1b8]
call fcn.1400b8690
mov r12, qword [rbp + 0x1c0]
mov r14, qword [rbp + 0x1d0]
mov rsi, qword [rbp + 0x1c8]
test r12, r12
jne 0x1400b8f41
test rsi, rsi
jne 0x1400b8f41
test r14, r14
je 0x1400b8f46
mov ebx, 1
mov r8, qword [rbp + 0x1e0]
mov dword [rbp + 0x1d0], ebx
test r8, r8
je 0x1400b8fb6
mov rax, 0xffffffffffffffff
nop
cmp byte [r8 + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400b8f60
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400b8f80
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400bd490
sub rsp, rcx
xor edx, edx
mov ecx, 0xfde9
lea r13, [rsp + 0x50]
mov dword [rsp + 0x28], 0x3fffffff
lea r9d, [rdx - 1]
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
jmp 0x1400b8fbb
xor edi, edi
mov r13d, edi
xorps xmm0, xmm0
mov dword [rbp + 0x50], 0x68
xor eax, eax
mov dword [rbp + 0xb4], eax
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
test ebx, ebx
je 0x1400b91ad
mov dword [rbp + 0x8c], 0x100
test r12, r12
je 0x1400b907a
xor r9d, r9d
lea rdx, [rbp + 8]
xor r8d, r8d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400b92a0
mov rcx, qword [rbp]
movzx ebx, r15b
mov rax, qword [rbp + 8]
mov qword [rbp + 0x18], rcx
mov qword [r12], rax
and bl, 8
je 0x1400b9066
xor r9d, r9d
mov dword [rbp + 0x1c8], 1
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1400b92a0
mov rcx, qword [rbp]
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp]
jmp 0x1400b908c
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ebx, r15b
and bl, 8
mov qword [rbp + 0xa0], rax
test rsi, rsi
je 0x1400b9107
xor r9d, r9d
lea rdx, [rbp + 8]
xor r8d, r8d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400b92a0
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov qword [rsi], rax
mov qword [rbp + 0x10], rcx
test bl, bl
je 0x1400b90f3
xor r9d, r9d
mov dword [rbp + 0x1c8], 1
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1400b92a0
mov rcx, qword [rbp + 8]
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp + 8]
jmp 0x1400b9112
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0xa8], rax
test r14, r14
je 0x1400b9195
cmp r14, rsi
je 0x1400b91a0
xor r9d, r9d
lea rdx, [rbp + 8]
xor r8d, r8d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x1400b92a0
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
mov qword [r14], rax
mov qword [rbp + 0x1b8], rcx
test bl, bl
je 0x1400b9181
xor r9d, r9d
mov dword [rbp + 0x1c8], 1
xor r8d, r8d
lea rdx, [rbp + 0x1c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x1400b92a0
mov rcx, qword [rbp + 8]
mov edx, 1
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov rax, qword [rbp + 8]
jmp 0x1400b91a0
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [rbp + 0x1d0]
mov qword [rbp + 0xb0], rax
movzx ecx, byte [rbp + 0x1d8]
test cl, 1
je 0x1400b91c7
or dword [rbp + 0x8c], 1
mov word [rbp + 0x90], di
movzx r15d, cl
mov eax, 0x1000404
and r15b, 2
mov edx, 0x400
cmove eax, edx
mov rdx, qword [rbp + 0x1b0]
mov edi, eax
and cl, 4
or edi, 8
mov byte [rbp + 0x1d8], cl
test cl, cl
mov rcx, qword [rbp + 0x38]
cmove edi, eax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400b92ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 5
jne 0x1400b93a7
bt edi, 0x18
jae 0x1400b93a7
mov rdx, qword [rbp + 0x1b0]
lea rax, [rbp + 0x20]
mov rcx, qword [rbp + 0x38]
btr edi, 0x18
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x1d0]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400b92ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400b93a7
test r15b, r15b
je 0x1400b93ee
mov rcx, qword [0x1401d3218]
test rcx, rcx
jne 0x1400b934c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov qword [0x1401d3218], rax
test rax, rax
je 0x1400b9462
xorps xmm0, xmm0
lea r8, [rbp + 0xc0]
movups xmmword [rbp + 0xd0], xmm0
mov r9d, 0x90
mov dword [rbp + 0xd0], 0x2800
mov edx, 9
mov rcx, rax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov rcx, qword [0x1401d3218]
mov rdx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
je 0x1400b936d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400b93ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
mov edx, 0xff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x20]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1b8]
call fcn.1400b86a0
lea rcx, [rbp + 0x10]
call fcn.1400b86a0
lea rcx, [rbp + 0x18]
call fcn.1400b86a0
test r12, r12
je 0x1400b93d2
mov rcx, r12
call fcn.1400b86a0
test rsi, rsi
je 0x1400b93df
mov rcx, rsi
call fcn.1400b86a0
test r14, r14
je 0x1400b944c
mov rcx, r14
call fcn.1400b86a0
jmp 0x1400b944c
cmp byte [rbp + 0x1d8], 0
mov rcx, qword [rbp + 0x20]
je 0x1400b940d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400b9428
mov rbx, qword [rbp + 0x1a0]
mov rax, qword [rbp + 0x28]
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbx], eax
mov ebx, dword [0x1400ed134]
lea rcx, [rbp + 0x1b8]
call fcn.1400b86a0
lea rcx, [rbp + 0x10]
call fcn.1400b86a0
lea rcx, [rbp + 0x18]
call fcn.1400b86a0
mov eax, ebx
lea rsp, [rbp + 0x158]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
mov byte [rbp + 0x1d8], 0
lea rdx, [0x1400de310]
lea rcx, [rbp + 0x38]
call fcn.1400b8940
lea rdx, [rbp]
lea rcx, [rbp + 0x1d8]
movups xmm0, xmmword [rax]
movaps xmmword [rbp], xmm0
call fcn.1400b8950
test al, al
je 0x1400b9498
int3
call fcn.1400ba710
int3