Function at 0x140016f9f
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, 0x28
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140016fbd
sub rsp, 0x28
call fcn.1400f9dd0
mov rcx, qword [rsp + 0x1b0]
call fcn.14009ebc0
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400f9ea0
add rsp, 0x10
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400f9ea0
add rsp, 0x10
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x38]
sub rsp, 0x10
call fcn.1400f9ea0
add rsp, 0x10
mov rdx, qword [rsp + 0x1a8]
lea rcx, [rsp + 0x40]
sub rsp, 0x10
call fcn.1400f9ea0
add rsp, 0x10
movabs rdx, 0x14022e1a0
lea rcx, [rsp + 0x148]
call fcn.1400f9bb0
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400f99b0
add rsp, 0x20
pop rcx
push rax
movabs rax, str.tamfichero
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006665d
add rsp, 0x28
push rax
call fcn.1400f9a30
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400f6780
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14009ebc0
add rsp, 0x28
pop rax
mov qword [rsp + 0x120], rax
cmp qword [rsp + 0x120], 0
je 0x140017709
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
movabs rcx, str.xh.dat___download
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x120]
pop rdx
call fcn.1400f9ad0
lea rbp, [rsp + 0x60]
mov dword [rbp], DispGetIDsOfNames
mov qword [rbp + 8], 0
mov dword [rbp + 0x10], 1
push 0
lea rax, [rsp + 0x68]
mov rax, rax
push rax
lea rax, [rsp + 0x60]
mov rax, rax
push rax
lea rax, [rsp + 0x60]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_CreatePipe
and rax, rax
je 0x140017709
mov dword [rsp + 0x58], 0x420
lea rbp, [rsp + 0x78]
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 0x101
mov word [rbp + 0x40], 0
movsxd rax, dword [rsp + 0x50]
push rax
pop rax
mov qword [rbp + 0x58], rax
lea rax, [rsp + 0xe0]
mov rax, rax
push rax
lea rax, [rsp + 0x80]
mov rax, rax
push rax
push 0
push 0
movsxd rax, dword [rsp + 0x78]
mov rax, rax
push rax
push 1
lea rax, [rsp + 0x90]
mov rax, rax
push rax
lea rax, [rsp + 0x98]
mov rax, rax
push rax
mov rax, qword [rsp + 0x158]
mov rax, rax
push rax
push 0
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_CreateProcessW
add rsp, 0x50
and rax, rax
je 0x140017709
movsxd rax, dword [rsp + 0x50]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [rsp + 0xf8], 0x800
movsxd rax, dword [rsp + 0xf8]
mov rax, rax
push rax
pop rcx
call fcn.1400f8350
mov qword [rsp + 0x100], rax
push qword [rsp + 0x30]
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400def00
mov qword [rsp + 0x158], rax
push qword [rsp + 0x158]
pop rcx
call fcn.1400df260
and rax, rax
je 0x1400176cb
sub rsp, 8
push 0
lea rax, [rsp + 0x118]
mov rax, rax
push rax
movsxd rax, dword [rsp + 0x110]
mov rax, rax
push rax
push qword [rsp + 0x120]
movsxd rax, dword [rsp + 0x70]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadFile
add rsp, 0x30
and rax, rax
je 0x140017672
cmp dword [rsp + 0x108], 0
je 0x14001766b
movsxd r15, dword [rsp + 0x110]
movsxd rcx, dword [rsp + 0x108]
add r15, rcx
mov rax, r15
push rax
pop rax
mov dword [rsp + 0x110], eax
movsxd rax, dword [rsp + 0x108]
mov rax, rax
push rax
push qword [rsp + 0x108]
push qword [rsp + 0x168]
pop rcx
pop rdx
pop r8
call fcn.1400df410
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400f99b0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push 0x42
movsxd rax, dword [rsp + 0x138]
mov rax, rax
push rax
push qword [rsp + 0x138]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400f8200
add rsp, 0x20
push rax
call fcn.1400f9a30
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f5cf0
add rsp, 0x28
lea rcx, [rsp + 0x130]
pop rdx
call fcn.1400f9ad0
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400f99b0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0x138]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f6720
add rsp, 0x20
push rax
call fcn.1400f9a30
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f5cf0
add rsp, 0x28
lea rcx, [rsp + 0x130]
pop rdx
call fcn.1400f9ad0
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
fild dword [rsp + 0x130]
fmul qword [0x140249a68]
fild qword [rsp + 0x140]
fdivp st(1)
sub rsp, 8
fstp qword [rsp]
movsd xmm0, qword [rsp]
add rsp, 8
sub rsp, 0x20
call fcn.1400c5b20
add rsp, 0x28
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f6720
add rsp, 0x28
movabs rcx, 0x14022f396
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x140]
pop rdx
call fcn.1400f9ad0
push qword [rsp + 0x138]
mov rcx, qword [rsp + 0x148]
pop rdx
call fcn.1400f9d20
or rax, rax
jne 0x140017636
mov rcx, qword [rsp + 0x138]
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x138]
pop rdx
call fcn.1400f9ad0
mov rcx, qword [rsp + 0x38]
xor rdx, rdx
call fcn.1400f9d20
or rax, rax
jne 0x1400175a1
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
movabs rcx, 0x14022f04c
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
mov rcx, qword [rsp + 0x140]
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x138]
pop rdx
call fcn.1400f9ad0
mov rcx, qword [rsp + 0x40]
xor rdx, rdx
call fcn.1400f9d20
or rax, rax
jne 0x14001760f
mov rcx, qword [rsp + 0x130]
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
movabs rcx, 0x14022f04c
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x138]
pop rdx
call fcn.1400f9ad0
push qword [rsp + 0x198]
pop rcx
call fcn.1400cd04c
and rax, rax
je 0x140017636
push qword [rsp + 0x130]
push qword [rsp + 0x1a0]
pop rcx
pop rdx
call fcn.1400cd05c
mov rcx, qword [rsp + 0x138]
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
lea rcx, [rsp + 0x148]
pop rdx
call fcn.1400f9ad0
jmp 0x14001766d
jmp 0x140017672
jmp 0x140017291
push qword [rsp + 0x158]
pop rcx
call fcn.1400deb90
push qword [rsp + 0x138]
movabs rcx, str.100_
pop rdx
call fcn.1400f9d20
or rax, rax
je 0x1400176b4
movabs rdx, 0x140247f5c
lea rcx, [rsp + 0x148]
call fcn.1400f9bb0
jmp 0x1400176cb
movabs rdx, 0x14022e1a0
lea rcx, [rsp + 0x148]
call fcn.1400f9bb0
push qword [rsp + 0x100]
pop rcx
call fcn.1400f8550
lea rbp, [rsp + 0xe0]
push qword [rbp + 8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
lea rbp, [rsp + 0xe0]
push qword [rbp]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsxd rax, dword [rsp + 0x48]
mov rax, rax
push rax
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsx r15, byte [rsp + 0x190]
cmp r15, 1
jne 0x14001773d
push qword [rsp + 0x148]
movabs rcx, 0x140247f5c
pop rdx
call fcn.1400f9d20
or rax, rax
je 0x14001773d
mov rax, 1
jmp 0x140017740
xor rax, rax
and rax, rax
je 0x1400177f7
movabs rdx, 0x14022e1a0
lea rcx, [rsp + 0x148]
call fcn.1400f9bb0
push qword [rsp + 0x30]
push 0xffffffffffffffff
pop rcx
pop rdx
call fcn.1400df150
mov qword [rsp + 0x158], rax
push qword [rsp + 0x158]
pop rcx
call fcn.1400df260
and rax, rax
je 0x1400177f7
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push 0x10000
push 2
push qword [rsp + 0x180]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400df4c0
add rsp, 0x28
lea rcx, [rsp + 0x150]
pop rdx
call fcn.1400f9ad0
push qword [rsp + 0x158]
pop rcx
call fcn.1400deb90
push qword [rsp + 0x30]
pop rcx
call fcn.1400ddd94
mov rcx, qword [rsp + 0x148]
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400f9a60
add rsp, 0x28
pop rax
push rax
call fcn.1400f9a00
pop rdx
add rax, rdx
jmp 0x140017833
push rax
mov rcx, qword [rsp + 0x130]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x140]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x120]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x148]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x138]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x150]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
pop rax
add rsp, 0x168
pop r15
pop rbp
ret