Function at 0x14000c770
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov qword [rsp + 0x230], rcx
mov qword [rsp + 0x238], rdx
mov esi, r8d
mov qword [rsp + 0x248], r9
movsxd rcx, dword [rsp + 0x258]
call fcn.14004f8e0
call fcn.14004f2c0
mov rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x230]
call fcn.14004f6b0
lea rcx, [rsp + 0x238]
mov rdx, qword [rsp + 0x238]
call fcn.14004f6b0
lea rcx, [rsp + 0x248]
mov rdx, qword [rsp + 0x248]
call fcn.14004f6b0
lea rcx, [rsp + 0x250]
mov rdx, qword [rsp + 0x250]
call fcn.14004f6b0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x88], 0
lea rbx, [rsp + 0x160]
mov ecx, reloc.WS2_32.dll_listen
xor eax, eax
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
lea rdi, [rsp + 0xa0]
lea rdx, [0x14017ac30]
mov rcx, rdi
call fcn.14004f780
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov rdx, qword [rsp + 0x230]
mov qword [rsp + 0xc0], rdx
lea rdx, str.tamfichero
mov qword [rsp + 0x110], rdx
movsxd rcx, eax
call fcn.14004f8e0
call fcn.14004f2c0
lea rcx, [rsp + 0xc0]
mov rdx, qword [rsp + 0xc0]
call fcn.14004f6b0
lea rcx, [rsp + 0x110]
mov rdx, qword [rsp + 0x110]
call fcn.14004f6b0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
lea rbp, [rsp + 0xf0]
lea rdx, [0x14017ac30]
mov rcx, rbp
call fcn.14004f780
mov qword [rsp + 0xe0], 0
mov ecx, 0x1000
call fcn.14004ecb0
mov qword [rsp + 0x100], rax
call fcn.14004f330
lea rcx, str.___headers
call fcn.14004f870
mov rcx, qword [rsp + 0xc0]
call fcn.14004f870
call fcn.14004f390
lea rcx, [rsp + 0xe8]
mov edx, eax
call fcn.14004f5a0
mov qword [rsp + 0x108], 0
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov ecx, eax
call fcn.14001eb3c
call fcn.14004f4e0
mov r12, rax
call fcn.14004f390
mov edx, eax
mov rcx, r12
call fcn.140031fc4
lea rcx, str.XH.dat
call fcn.14004f870
call fcn.14004f4e0
mov r9d, 0x2e
lea r8, [0x14017ac30]
mov rdx, qword [rsp + 0xe8]
mov rcx, rax
call fcn.14001ec68
mov r12, rax
call fcn.14004f400
mov qword [rsp + 0xf8], r12
mov rax, qword [rsp + 0xf8]
test rax, rax
jne 0x14000cc50
call fcn.14004f330
mov rcx, qword [rsp + 0xf0]
call fcn.14004f870
call fcn.14004f4e0
mov rcx, qword [rsp + 0xd0]
call fcn.14004f680
xor ecx, ecx
call fcn.14004f680
mov rcx, qword [rsp + 0xe8]
call fcn.14004f680
mov rcx, qword [rsp + 0xc0]
call fcn.14004f680
xor ecx, ecx
call fcn.14004f680
xor ecx, ecx
call fcn.14004f680
mov rcx, qword [rsp + 0x110]
call fcn.14004f680
mov rcx, qword [rsp + 0xf0]
call fcn.14004f680
call fcn.14004f4e0
mov rcx, rax
call fcn.14004cc40
mov rbp, rax
call fcn.14004f400
mov qword [rsp + 0x80], rbp
mov rax, qword [rsp + 0x80]
test rax, rax
jne 0x14000cf64
cmp sil, 1
je 0x14000d401
call fcn.14004f330
mov rcx, qword [rsp + 0xa0]
call fcn.14004f870
call fcn.14004f4e0
mov rbx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14004f680
mov rcx, qword [rsp + 0x78]
call fcn.14004f680
mov rcx, qword [rsp + 0x230]
call fcn.14004f680
mov rcx, qword [rsp + 0x88]
call fcn.14004f680
mov rcx, qword [rsp + 0x90]
call fcn.14004f680
mov rcx, qword [rsp + 0x238]
call fcn.14004f680
mov rcx, qword [rsp + 0x98]
call fcn.14004f680
mov rcx, qword [rsp + 0x248]
call fcn.14004f680
mov rcx, qword [rsp + 0x250]
call fcn.14004f680
mov rcx, qword [rsp + 0xa0]
call fcn.14004f680
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xf8]
call fcn.14001f1d8
test rax, rax
je 0x14000caf6
lea r12, [rsp + 0xd0]
lea r13, [0x14017ac30]
lea r14, [rsp + 0x118]
jmp 0x14000ccb8
call fcn.14004f330
mov rcx, qword [rsp + 0xd0]
call fcn.14004f870
call fcn.14004f390
mov edx, eax
mov rcx, rbp
call fcn.14004f5a0
mov rcx, qword [rsp + 0x118]
call fcn.14004f680
call fcn.14004f2c0
call fcn.14000c440
mov rcx, qword [rsp + 0xf8]
call fcn.14001f228
test rax, rax
je 0x14000cf42
mov rdx, r13
mov rcx, r12
call fcn.14004f780
mov rcx, qword [rsp + 0xf8]
call fcn.14001f290
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14000ccae
mov rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xf8]
call fcn.14001f2c8
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x14000ccae
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
mov r15, qword [rsp + 0x100]
call fcn.14004f390
mov rdx, qword [rsp + 0xd8]
mov r9d, eax
mov r8d, 0x42
mov rcx, r15
call fcn.14004efa0
call fcn.14004f4e0
mov r15, rax
call fcn.14004f390
mov edx, eax
mov rcx, r15
call fcn.14004c4a0
call fcn.14004f390
mov edx, eax
mov rcx, r12
call fcn.14004f5a0
mov qword [rsp + 0x118], 0
mov rdx, qword [rsp + 0x110]
mov rcx, r14
call fcn.14004f6b0
lea rdx, str.tamfichero
mov rcx, qword [rsp + 0x118]
call fcn.14004f720
test eax, eax
je 0x14000cc80
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov edx, eax
mov rcx, qword [rsp + 0xd0]
call fcn.14004cbb0
call fcn.14004f4e0
mov r8d, 1
lea rdx, str.content_length:
mov rcx, rax
call fcn.14004cdb0
mov r15, rax
call fcn.14004f400
test r15, r15
je 0x14000cca1
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov edx, eax
mov rcx, qword [rsp + 0xd0]
call fcn.14004cbb0
call fcn.14004f4e0
mov r8d, 1
lea rdx, str.content_length:
mov rcx, rax
call fcn.14004cdb0
mov r15, rax
call fcn.14004f400
call fcn.14004f390
mov r8d, eax
mov rdx, r15
mov rcx, qword [rsp + 0xd0]
call fcn.14004c880
call fcn.14004f390
mov edx, eax
mov rcx, rbp
call fcn.14004f5a0
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov r9d, eax
lea r8, [0x14016d2c2]
mov edx, 2
mov rcx, qword [rsp + 0xf0]
call fcn.14004c980
call fcn.14004f4e0
mov r15, rax
call fcn.14004f390
mov edx, eax
mov rcx, r15
call fcn.14004c4a0
call fcn.14004f390
mov edx, eax
mov rcx, rbp
call fcn.14004f5a0
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
mov rcx, qword [rsp + 0xf0]
call fcn.14004cc40
mov r15, rax
call fcn.14004f390
mov edx, eax
mov rcx, r15
call fcn.14004c5c0
call fcn.14004f4e0
mov r15, rax
call fcn.14004f390
mov edx, eax
mov rcx, r15
call fcn.14004c4a0
call fcn.14004f390
mov edx, eax
mov rcx, rbp
call fcn.14004f5a0
jmp 0x14000cca1
mov rcx, qword [rsp + 0xf8]
call fcn.14001f348
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
jmp 0x14000caf6
call fcn.14004f330
lea rcx, str.xh.dat___download
call fcn.14004f870
mov rcx, qword [rsp + 0x230]
call fcn.14004f870
call fcn.14004f390
lea rcx, [rsp + 0x88]
mov edx, eax
call fcn.14004f5a0
mov dword [rsp + 0x120], 0x18
mov qword [rsp + 0x128], 0
mov dword [rsp + 0x130], 1
lea rbp, [rsp + 0x120]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x64]
xor r9d, r9d
mov r8, rbp
call sub.KERNEL32.dll_CreatePipe
test rax, rax
je 0x14000cb91
mov dword [rsp + 0x58], 0x420
mov dword [rsp + 0x160], WSAGetLastError
mov dword [rsp + 0x19c], 0x101
xor eax, eax
mov word [rsp + 0x1a0], ax
movsxd rax, dword [rsp + 0x68]
mov qword [rsp + 0x1b8], rax
movsxd rax, dword [rsp + 0x58]
lea rdx, [rsp + 0x140]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
mov r9, rbp
mov r8, rbp
mov rdx, qword [rsp + 0x88]
xor ecx, ecx
call sub.KERNEL32.dll_CreateProcessW
test rax, rax
je 0x14000cb91
movsxd rcx, dword [rsp + 0x68]
call sub.KERNEL32.dll_CloseHandle
mov dword [rsp + 0x5c], 0x800
movsxd rcx, dword [rsp + 0x5c]
call fcn.14004ecb0
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0x238]
mov rcx, 0xffffffffffffffff
call fcn.140032870
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.140032bc0
test rax, rax
je 0x14000d3b5
lea rbp, [rsp + 0x6c]
lea rbx, [rsp + 0x70]
movsd xmm6, qword [0x140122130]
lea r12, [rsp + 0x78]
jmp 0x14000d153
call fcn.14004f330
mov rcx, qword [rsp + 0x248]
call fcn.14004f870
lea rcx, [0x14016d6d4]
call fcn.14004f870
mov rcx, qword [rsp + 0x78]
call fcn.14004f870
call fcn.14004f390
mov edx, eax
mov rcx, r13
call fcn.14004f5a0
jmp 0x14000d313
xor ecx, ecx
call fcn.1400265e0
test rax, rax
jne 0x14000d370
call fcn.14004f330
mov rcx, qword [rsp + 0x78]
call fcn.14004f870
call fcn.14004f390
lea rcx, [rsp + 0x90]
mov edx, eax
call fcn.14004f5a0
mov rdx, qword [rsp + 0xb0]
movsxd r8, dword [rsp + 0x5c]
movsxd rcx, dword [rsp + 0x64]
mov qword [rsp + 0x20], 0
mov r9, rbp
call sub.KERNEL32.dll_ReadFile
test rax, rax
je 0x14000d384
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14000d384
mov eax, dword [rsp + 0x60]
mov edx, dword [rsp + 0x6c]
add eax, edx
mov dword [rsp + 0x60], eax
mov rdx, qword [rsp + 0xb0]
movsxd r8, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xa8]
call fcn.140032fc0
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
mov r13, qword [rsp + 0xb0]
call fcn.14004f390
movsxd rdx, dword [rsp + 0x6c]
mov r9d, eax
mov r8d, 0x42
mov rcx, r13
call fcn.14004efa0
call fcn.14004f4e0
mov r13, rax
call fcn.14004f390
mov edx, eax
mov rcx, r13
call fcn.14004c4a0
call fcn.14004f390
mov edx, eax
mov rcx, rbx
call fcn.14004f5a0
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
movsxd rcx, dword [rsp + 0x60]
mov edx, eax
call fcn.14004c5c0
call fcn.14004f4e0
mov r13, rax
call fcn.14004f390
mov edx, eax
mov rcx, r13
call fcn.14004c4a0
call fcn.14004f390
mov edx, eax
mov rcx, rbx
call fcn.14004f5a0
call fcn.14004f330
call fcn.14004f330
mov eax, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x80]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm0, xmm6
pxor xmm1, xmm1
cvtsi2sd xmm1, rdx
divsd xmm0, xmm1
call fcn.14004f230
mov r13, rax
call fcn.14004f390
mov edx, eax
mov rcx, r13
call fcn.14004c5c0
lea rcx, [0x14016d62a]
call fcn.14004f870
call fcn.14004f390
mov edx, eax
mov rcx, r12
call fcn.14004f5a0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call fcn.14004f720
test eax, eax
jne 0x14000d130
call fcn.14004f330
mov rcx, qword [rsp + 0x78]
call fcn.14004f870
call fcn.14004f390
lea r13, [rsp + 0x98]
mov edx, eax
mov rcx, r13
call fcn.14004f5a0
mov rax, qword [rsp + 0x248]
test rax, rax
je 0x14000d313
cmp word [rax], 0
jne 0x14000d0e0
mov rax, qword [rsp + 0x250]
test rax, rax
je 0x14000d120
cmp word [rax], 0
je 0x14000d120
call fcn.14004f330
mov rcx, qword [rsp + 0x98]
call fcn.14004f870
lea rcx, [0x14016d6d4]
call fcn.14004f870
mov rcx, qword [rsp + 0x250]
call fcn.14004f870
call fcn.14004f390
mov edx, eax
mov rcx, r13
call fcn.14004f5a0
jmp 0x14000d120
mov rdx, qword [rsp + 0x98]
xor ecx, ecx
call fcn.140024cd4
jmp 0x14000d130
mov rcx, qword [rsp + 0xa8]
call fcn.140032dd0
mov rdx, qword [rsp + 0x78]
lea rcx, str.100_
call fcn.14004f720
test eax, eax
jne 0x14000d3f0
lea rdx, [0x14017ac30]
mov rcx, rdi
call fcn.14004f780
mov rcx, qword [rsp + 0xb0]
call fcn.14004ec90
mov rcx, qword [rsp + 0x148]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x140]
call sub.KERNEL32.dll_CloseHandle
movsxd rcx, dword [rsp + 0x64]
call sub.KERNEL32.dll_CloseHandle
jmp 0x14000cb91
lea rdx, [0x140166e6a]
mov rcx, rdi
call fcn.14004f780
jmp 0x14000d3b5
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x140166e6a]
call fcn.14004f720
test eax, eax
je 0x14000cb9b
lea rdx, [0x14017ac30]
mov rcx, rdi
call fcn.14004f780
mov rdx, qword [rsp + 0x238]
mov rcx, 0xffffffffffffffff
call fcn.140032ab0
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.140032bc0
test rax, rax
je 0x14000cb9b
call fcn.14004f330
call fcn.14004f330
call fcn.14004f390
mov rcx, qword [rsp + 0xa8]
mov r9d, eax
mov r8d, 0x10000
mov edx, 2
call fcn.140032bf0
call fcn.14004f390
mov edx, eax
mov rcx, rdi
call fcn.14004f5a0
mov rcx, qword [rsp + 0xa8]
call fcn.140032dd0
mov rcx, qword [rsp + 0x238]
call fcn.1400323a4
jmp 0x14000cb9b