Function at 0x1400057e8
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140036040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14d, r9d
mov dword [rsp + 0x68], r9d
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], r8
xor r15d, r15d
mov r13d, r15d
lea ebx, [r15 + 1]
cmp r9d, ebx
jne 0x140005948
lea rcx, str.SeRestorePrivilege
call fcn.140005108
lea rcx, str.SeCreateTokenPrivilege
call fcn.140005108
lea rcx, str.SeImpersonatePrivilege
call fcn.140005108
lea rcx, str.SeCreateTokenPrivilege
call fcn.140005108
mov qword [rsp + 0x70], r15
call fcn.1400051c4
test eax, eax
je 0x14000591b
mov r8d, eax
xor edx, edx
mov r13d, 0x2000000
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbx, rbx
je 0x140005912
lea r8, [rsp + 0x70]
mov edx, 0x201eb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005909
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea eax, [r15 + 1]
mov dword [rsp + 0x20], eax
mov r9d, eax
xor r8d, r8d
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x1400058fe
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rbp - 0x80]
test r13, r13
jne 0x140005943
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r15
mov r8d, 2
lea rdx, [0x1400311bc]
mov rcx, rsi
call fcn.140002b6c
jmp 0x140005f66
mov ebx, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
mov r8, rbx
lea rdx, [0x140030f98]
lea rcx, [rbp + 0xb0]
call fcn.140002b6c
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x50], 0x18
mov dword [rbp - 0x40], ebx
xor r9d, r9d
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov ebx, 0x68
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140025b00
mov dword [rbp - 0x30], ebx
mov dword [rbp + 0xc], 0x100
mov qword [rbp - 0x20], r15
mov qword [rbp + 0x20], r15
mov rax, qword [rbp - 0x78]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov word [rbp + 0x10], r15w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov ebx, r15d
or r15, 0xffffffffffffffff
xor r9d, r9d
cmp qword [r12 + 0x10], r9
jne 0x140005a6d
test r14d, r14d
jne 0x140005a14
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140005a0a
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
jmp 0x140005ac2
mov ecx, 1
cmp r14d, ecx
jne 0x140005b58
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140005a2f
mov rdx, qword [rdi]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], 0x8000020
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r9
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140005af4
mov r8d, 1
lea rdx, str._0__
mov rcx, rdi
call fcn.1400029ec
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x140005a91
mov rdx, qword [r12]
mov r8, r15
xor eax, eax
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005a96
mov rcx, rdi
call fcn.1400029ec
xor r9d, r9d
test r14d, r14d
jne 0x140005afb
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140005abd
mov rdx, qword [rdi]
xor r8d, r8d
xor ecx, ecx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
xor r9d, r9d
jmp 0x140005b58
mov ecx, 1
cmp r14d, ecx
jne 0x140005b58
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140005b12
mov r8, qword [rdi]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], 0x8000020
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r9
xor edx, edx
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov ebx, eax
xor r9d, r9d
test eax, eax
lea eax, [r9 + 1]
cmove ebx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r9
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r9b
mov r9d, 1
cmp ebx, r9d
je 0x140005b97
mov r8d, r9d
lea rdx, [0x1400311c4]
lea rcx, [rbp + 0xb0]
call fcn.1400028cc
xor ebx, ebx
jmp 0x140005e71
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x2710
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140005fa4
cmp dword [rsp + 0x60], ebx
je 0x140005fa4
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], bl
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
mov r8d, 0x100
lea rdx, [rbp + 0xd0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x64], eax
lea rax, [rbp + 0xd0]
mov rbx, r15
xor r15d, r15d
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140005c35
cmp rbx, 0xf
ja 0x140005c7c
mov qword [rbp + 0x80], rbx
mov r8, rbx
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.140025ec0
mov byte [rbp + rbx + 0x70], r15b
mov r14, qword [rbp + 0x88]
mov rbx, qword [rbp + 0x80]
mov r15, qword [rbp + 0x70]
xor eax, eax
jmp 0x140005d2a
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140005fc2
mov r14, rbx
or r14, 0xf
cmp r14, rax
jbe 0x140005cae
mov r14, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140005cd4
mov eax, 0x16
cmp r14, rax
cmovb r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140005cf3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005fce
mov rcx, rax
call fcn.14000d15c
test rax, rax
je 0x140005fd4
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140005d00
test rcx, rcx
je 0x140005d00
call fcn.14000d15c
mov r15, rax
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], r14
mov r8, rbx
lea rdx, [rbp + 0xd0]
mov rcx, r15
call fcn.140025ec0
xor eax, eax
mov byte [r15 + rbx], al
mov qword [rbp + 0x70], r15
mov r8d, dword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp + 0x70]
cmp r14, 0xf
cmova rdx, r15
lea rcx, [rbp + 0x90]
call fcn.14000ca24
nop
lea r9, [rbp + 0x90]
mov r14, qword [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova r9, r14
mov rcx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x68]
sub rax, rcx
mov r15, qword [rbp + 0xa0]
cmp r15, rax
ja 0x140005dc7
lea rax, [r15 + rcx]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rbx, qword [rbp + 0x50]
add rbx, rcx
mov r8, r15
mov rdx, r9
mov rcx, rbx
call fcn.140025ec0
xor eax, eax
mov byte [r15 + rbx], al
jmp 0x140005ddf
mov qword [rsp + 0x20], r15
mov rdx, r15
lea rcx, [rbp + 0x50]
call fcn.14000cc64
mov r14, qword [rbp + 0x90]
mov rax, qword [rbp + 0xa8]
cmp rax, 0xf
jbe 0x140005e1e
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140005e15
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005fd4
mov rcx, r14
call fcn.14000d128
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140005e5c
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005fda
call fcn.14000d128
xor ebx, ebx
or r15, 0xffffffffffffffff
cmp dword [rsp + 0x64], ebx
jne 0x140005be6
mov r14d, dword [rsp + 0x68]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140005eed
inc rcx
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.14000d3d8
mov rbx, rax
mov rcx, qword [rbp + 0x60]
xor eax, eax
mov word [rbx + rcx*2], ax
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r8, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x60]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
inc r15
cmp word [rbx + r15*2], ax
jne 0x140005ec7
mov r8, r15
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call fcn.1400028cc
mov rcx, rbx
call fcn.14000d128
xor ebx, ebx
test r13, r13
je 0x140005efb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
cmp r14d, eax
jne 0x140005f0b
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp + 0xc0]
movups xmmword [rsi + 0x10], xmm1
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140005f57
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005fc8
call fcn.14000d128
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], bl
mov rcx, rdi
call fcn.14000276c
nop
mov rcx, r12
call fcn.14000276c
mov rax, rsi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14000d100
mov rbx, qword [rsp + 0x338]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 1
lea rdx, [0x1400311c8]
lea rcx, [rbp + 0xb0]
call fcn.1400028cc
jmp 0x140005e71
call fcn.140001188
nop
call fcn.140013dec
nop
call fcn.1400010f0
int3
call fcn.140013dec
nop
call fcn.140013dec
int3