Function at 0x140006ed0
Capabilities:
Create pipe
Create process on windows
Read file on windows
Read pipe

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x240], xmm6
mov qword [rbp + 0x238], 0xfffffffffffffffe
mov dword [rbp + 0x224], r9d
mov qword [rbp + 0x218], r8
mov qword [rbp + 0x230], rdx
mov qword [rbp + 0x228], rcx
cmp dword [rbp + 0x224], 1
jne 0x140006f70
call fcn.140006810
mov rcx, rax
mov qword [rbp + 0x208], rax
test rax, rax
jne 0x140006f79
xorps xmm0, xmm0
mov rax, qword [rbp + 0x228]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
nop
mov rax, qword [rbp + 0x228]
mov qword [rax + 0x10], 2
mov qword [rax + 0x18], 7
mov dword [rax], 0x340031
mov word [rax + 4], 0
jmp 0x14000794f
xor eax, eax
mov qword [rbp + 0x208], rax
xorps xmm0, xmm0
mov rax, qword [rbp + 0x228]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
nop
mov rax, qword [rbp + 0x228]
mov qword [rax + 0x10], 1
mov qword [rax + 0x18], 7
mov dword [rax], gethostbyname
xorps xmm6, xmm6
movaps xmmword [rbp + 0x150], xmm6
mov qword [rbp + 0x160], 0
mov dword [rbp + 0x150], 0x18
mov dword [rbp + 0x160], 1
lea rcx, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b8]
lea r8, [rbp + 0x150]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreatePipe]
nop
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0x110], xmm6
movaps xmmword [rbp + 0x120], xmm6
movaps xmmword [rbp + 0x100], xmm6
movaps xmmword [rbp + 0xf0], xmm6
mov dword [rbp + 0xe0], 0x68
mov dword [rbp + 0x11c], 0x100
mov qword [rbp + 0x130], 0
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], rax
movaps xmmword [rbp + 0x170], xmm6
mov qword [rbp + 0x180], 0
mov rax, qword [rbp + 0x218]
cmp qword [rax + 0x10], 0
je 0x1400070a0
nop
mov rcx, qword [rbp + 0x230]
mov rax, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
cmp r8, rax
jne 0x140007123
nop
mov qword [rsp + 0x20], 1
lea r9, [0x140071466]
mov edx, 1
call fcn.140005e10
jmp 0x14000714b
mov ecx, dword [rbp + 0x224]
test ecx, ecx
je 0x1400072a9
xor eax, eax
cmp ecx, 1
jne 0x140007300
nop
mov rdx, qword [rbp + 0x230]
cmp qword [rdx + 0x18], 8
jb 0x1400070d2
mov rax, qword [rbp + 0x230]
mov rdx, qword [rax]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], 0x8000020
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x208]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
jmp 0x140007300
lea rdx, [rax + 1]
mov qword [rcx + 0x10], rdx
mov rdx, rcx
cmp r8, 8
jb 0x14000713e
mov rcx, qword [rbp + 0x230]
mov rdx, qword [rcx]
mov word [rdx + rax*2], 0x20
mov word [rdx + rax*2 + 2], 0
nop
mov rsi, qword [rbp + 0x218]
cmp qword [rsi + 0x18], 8
jb 0x140007164
mov rax, qword [rbp + 0x218]
mov rsi, qword [rax]
mov rcx, rsi
call fcn.1400441fc
mov rbx, qword [rbp + 0x230]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x14000719c
nop
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rax
mov r9, rsi
call fcn.140005e10
jmp 0x1400071cc
lea rdi, [rcx + rax]
mov qword [rbx + 0x10], rdi
cmp rdx, 8
jb 0x1400071b4
mov rdx, qword [rbp + 0x230]
mov rbx, qword [rdx]
lea rcx, [rbx + rcx*2]
add rax, rax
mov rdx, rsi
mov r8, rax
call fcn.14006d670
mov word [rbx + rdi*2], 0
mov ecx, dword [rbp + 0x224]
test ecx, ecx
je 0x140007250
xor eax, eax
cmp ecx, 1
jne 0x140007300
nop
mov r8, qword [rbp + 0x230]
cmp qword [r8 + 0x18], 8
jb 0x1400071fa
mov rax, qword [rbp + 0x230]
mov r8, qword [rax]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], 0x8000020
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x208]
xor edx, edx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp eax, 1
adc eax, 0
jmp 0x140007300
nop
mov rdx, qword [rbp + 0x230]
cmp qword [rdx + 0x18], 8
jb 0x140007269
mov rax, qword [rbp + 0x230]
mov rdx, qword [rax]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140007300
nop
mov rcx, qword [rbp + 0x230]
cmp qword [rcx + 0x18], 8
jb 0x1400072c2
mov rax, qword [rbp + 0x230]
mov rcx, qword [rax]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], 0
nop
mov qword [rbp + 0x1f8], 0xf
cmp eax, 1
jne 0x14000774a
nop
mov rcx, qword [rbp + 0x1b8]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x170]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x1b0]
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x140007792
nop
cmp dword [rbp + 0x220], 0
je 0x1400077bf
jmp 0x1400073ad
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
cmp dword [rbp + 0x210], 0
je 0x14000777a
nop
movaps xmmword [rbp + 0x190], xmm6
mov qword [rbp + 0x1a0], 0
nop
mov qword [rbp + 0x1a8], 0xf
nop
mov rcx, qword [rbp + 0x1b0]
nop
mov qword [rsp + 0x20], 0
lea rdx, [rbp - 0x20]
mov r8d, 0x100
lea r9, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rbp + 0x210], eax
lea rcx, [rbp + 0x190]
lea rdx, [rbp - 0x20]
call fcn.14001ed80
nop
mov esi, dword [rbp + 0x220]
movaps xmmword [rbp + 0x1c0], xmm6
movaps xmmword [rbp + 0x1d0], xmm6
nop
mov rax, qword [rbp + 0x1a0]
cmp rax, rsi
cmovb rsi, rax
cmp qword [rbp + 0x1a8], 0x10
lea r14, [rbp + 0x190]
jb 0x140007447
mov r14, qword [rbp + 0x190]
cmp rsi, 0xf
ja 0x140007480
nop
mov qword [rbp + 0x1d0], rsi
mov qword [rbp + 0x1d8], 0xf
lea rcx, [rbp + 0x1c0]
mov rdx, r14
mov r8, rsi
call fcn.14006d670
lea rbx, [rsi + rbp]
add rbx, 0x1c0
jmp 0x1400074ef
nop
mov qword [rbp + 0x1d8], 0xf
mov rdi, rsi
or rdi, 0xf
cmp rdi, 0x17
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rdi, 0xfff
jb 0x1400074c0
call fcn.140005860
jmp 0x1400074c5
call fcn.14001ef3c
mov rbx, rax
nop
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1d0], rsi
mov qword [rbp + 0x1d8], rdi
mov rcx, rax
mov rdx, r14
mov r8, rsi
call fcn.14006d670
add rbx, rsi
nop
mov byte [rbx], 0
nop
cmp qword [rbp + 0x1d8], 0x10
lea r12, [rbp + 0x1c0]
jb 0x14000750c
mov r12, qword [rbp + 0x1c0]
mov r13, qword [rbp + 0x1d0]
mov r14, qword [rbp + 0x1f0]
mov r15, qword [rbp + 0x1f8]
mov rax, r15
sub rax, r14
cmp rax, r13
jae 0x140007630
mov rax, r14
movabs rbx, 0x7fffffffffffffff
xor rax, rbx
cmp rax, r13
jb 0x140007a49
mov rdi, r14
add rdi, r13
movabs rcx, 0x8000000000000000
js 0x1400075a0
mov rax, r15
shr rax, 1
mov rdx, rax
xor rdx, rbx
cmp rdx, r15
jb 0x1400075a0
mov rcx, rdi
or rcx, 0xf
add rax, r15
cmp rcx, rax
mov rbx, rax
cmova rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000772d
nop word cs:[rax + rax]
call fcn.140005860
mov rsi, rax
nop
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], rbx
cmp r15, 0x10
jb 0x140007670
nop
mov rbx, qword [rbp + 0x1e0]
mov rcx, rsi
mov rdx, rbx
mov r8, r14
call fcn.14006d670
add r14, rsi
mov rcx, r14
mov rdx, r12
mov r8, r13
call fcn.14006d670
mov byte [rsi + rdi], 0
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x140007619
nop
mov rax, qword [rbx - 8]
add rbx, 0xfffffffffffffff8
sub rbx, rax
cmp rbx, 0x20
jae 0x140007a58
add r15, 0x28
mov rdx, r15
mov rbx, rax
mov rcx, rbx
call fcn.14001ef80
jmp 0x140007697
lea rsi, [r14 + r13]
mov qword [rbp + 0x1f0], rsi
lea rdi, [rbp + 0x1e0]
cmp r15, 0x10
jb 0x14000764f
mov rdi, qword [rbp + 0x1e0]
add r14, rdi
mov rcx, r14
mov rdx, r12
mov r8, r13
call fcn.14006d670
mov byte [rdi + rsi], 0
jmp 0x14000769f
mov rcx, rsi
lea rdx, [rbp + 0x1e0]
mov r8, r14
call fcn.14006d670
add r14, rsi
mov rcx, r14
mov rdx, r12
mov r8, r13
call fcn.14006d670
mov byte [rsi + rdi], 0
nop
mov qword [rbp + 0x1e0], rsi
nop
mov rax, qword [rbp + 0x1d8]
cmp rax, 0x10
jb 0x1400076e7
nop
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400076e2
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007a4e
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0x1a8]
cmp rax, 0x10
jb 0x14000739f
nop
mov rcx, qword [rbp + 0x190]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000739a
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x140007390
jmp 0x140007a53
test rcx, rcx
je 0x14000773c
call fcn.14001ef3c
jmp 0x1400075a5
mov rbx, 0xffffffffffffffff
xor esi, esi
jmp 0x1400075a8
nop
mov rcx, qword [rbp + 0x228]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000777f
mov rdx, rcx
cmp rax, 8
jb 0x140007767
mov rdx, qword [rcx]
mov qword [rcx + 0x10], 1
mov dword [rdx], reloc.WS2_32.dll_gethostname
jmp 0x140007810
jmp 0x140007810
lea r9, [0x14007146a]
mov edx, 1
call fcn.140005d00
jmp 0x140007810
nop
mov rcx, qword [rbp + 0x228]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400077ec
mov rdx, rcx
cmp rax, 8
jb 0x1400077af
mov rdx, qword [rcx]
mov qword [rcx + 0x10], 1
mov dword [rdx], gethostname
jmp 0x140007810
nop
mov rcx, qword [rbp + 0x228]
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x1400077ff
mov rdx, rcx
cmp rax, 8
jb 0x1400077dc
mov rdx, qword [rcx]
mov qword [rcx + 0x10], 1
mov dword [rdx], gethostname
jmp 0x140007810
lea r9, [0x14007146e]
mov edx, 1
call fcn.140005d00
jmp 0x140007810
lea r9, [0x14007146e]
mov edx, 1
call fcn.140005d00
nop
mov rsi, qword [rbp + 0x1f0]
test rsi, rsi
je 0x1400078e1
mov rax, rsi
inc rax
lea rax, [rsi + rsi + 2]
mov rcx, 0xffffffffffffffff
cmovns rcx, rax
call fcn.14001efc0
mov qword [rbp + 0x210], rax
nop
mov rbx, qword [rbp + 0x210]
mov word [rbx + rsi*2], 0
cmp qword [rbp + 0x1f8], 0x10
jb 0x140007864
mov r8, qword [rbp + 0x1e0]
jmp 0x14000786b
lea r8, [rbp + 0x1e0]
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
xor ecx, ecx
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call fcn.1400441fc
mov rsi, rax
mov rcx, qword [rbp + 0x228]
mov rax, qword [rcx + 0x18]
cmp rax, rsi
jae 0x1400078ad
mov rdx, rsi
mov r9, rbx
call fcn.140005d00
jmp 0x1400078d4
mov rdi, rcx
cmp rax, 8
jb 0x1400078b9
mov rdi, qword [rcx]
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rcx, rdi
mov rdx, rbx
call fcn.14006d670
mov word [rdi + rsi*2], 0
nop
mov rcx, qword [rbp + 0x210]
call fcn.14001efd0
cmp qword [rbp + 0x208], 0
je 0x1400078f9
nop
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x224], 1
jne 0x140007907
call fcn.140006920
nop
mov rax, qword [rbp + 0x1f8]
cmp rax, 0x10
jb 0x14000794f
nop
mov rcx, qword [rbp + 0x1e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000794a
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007a67
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rcx, qword [rbp + 0x230]
mov rax, qword [rcx + 0x18]
cmp rax, 8
jb 0x1400079a6
nop
mov rcx, qword [rcx]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140007999
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007a5d
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rcx, qword [rbp + 0x230]
nop
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
nop
mov rcx, qword [rbp + 0x218]
mov rax, qword [rcx + 0x18]
cmp rax, 8
jb 0x140007a0f
nop
mov rcx, qword [rcx]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140007a02
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140007a62
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rcx, qword [rbp + 0x218]
nop
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 7
mov word [rcx], 0
nop
mov rax, qword [rbp + 0x228]
nop
movaps xmm6, xmmword [rbp + 0x240]
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
int3