Function at 0x140016a10
Capabilities:
Contain obfuscated stackstrings
Create tcp socket
Create udp socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
mov eax, 0x1360
call fcn.1401d5c30
sub rsp, rax
mov qword [rsp + 0x1340], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0x1358], rax
mov rcx, qword [rsp + 0x1378]
call fcn.140001960
mov rcx, qword [rsp + 0x1380]
call fcn.140001960
mov eax, dword [rsp + 0x1370]
and eax, 0xff000000
cmp eax, 0xff000000
jne 0x140016aa0
mov dword [rsp + 0x1320], 0
mov rcx, qword [rsp + 0x1390]
call fcn.140001470
mov eax, dword [rsp + 0x1320]
jmp 0x140017044
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x288], rax
mov dword [rsp + 0x12c0], 0
mov eax, 2
mov word [rsp + 0x12b0], ax
mov cx, 0x89
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x12b2], ax
mov eax, dword [rsp + 0x1370]
mov dword [rsp + 0x12b4], eax
mov byte [rsp + 0x12c8], 0
mov byte [rsp + 0x12c9], 0
mov byte [rsp + 0x12ca], 0
mov byte [rsp + 0x12cb], 0
mov byte [rsp + 0x12cc], 0
mov byte [rsp + 0x12cd], 1
mov byte [rsp + 0x12ce], 0
mov byte [rsp + 0x12cf], 0
mov byte [rsp + 0x12d0], 0
mov byte [rsp + 0x12d1], 0
mov byte [rsp + 0x12d2], 0
mov byte [rsp + 0x12d3], 0
mov byte [rsp + 0x12d4], 0x20
mov byte [rsp + 0x12d5], 0x43
mov byte [rsp + 0x12d6], 0x4b
mov byte [rsp + 0x12d7], 0x41
mov byte [rsp + 0x12d8], 0x41
mov byte [rsp + 0x12d9], 0x41
mov byte [rsp + 0x12da], 0x41
mov byte [rsp + 0x12db], 0x41
mov byte [rsp + 0x12dc], 0x41
mov byte [rsp + 0x12dd], 0x41
mov byte [rsp + 0x12de], 0x41
mov byte [rsp + 0x12df], 0x41
mov byte [rsp + 0x12e0], 0x41
mov byte [rsp + 0x12e1], 0x41
mov byte [rsp + 0x12e2], 0x41
mov byte [rsp + 0x12e3], 0x41
mov byte [rsp + 0x12e4], 0x41
mov byte [rsp + 0x12e5], 0x41
mov byte [rsp + 0x12e6], 0x41
mov byte [rsp + 0x12e7], 0x41
mov byte [rsp + 0x12e8], 0x41
mov byte [rsp + 0x12e9], 0x41
mov byte [rsp + 0x12ea], 0x41
mov byte [rsp + 0x12eb], 0x41
mov byte [rsp + 0x12ec], 0x41
mov byte [rsp + 0x12ed], 0x41
mov byte [rsp + 0x12ee], 0x41
mov byte [rsp + 0x12ef], 0x41
mov byte [rsp + 0x12f0], 0x41
mov byte [rsp + 0x12f1], 0x41
mov byte [rsp + 0x12f2], 0x41
mov byte [rsp + 0x12f3], 0x41
mov byte [rsp + 0x12f4], 0x41
mov byte [rsp + 0x12f5], 0
mov byte [rsp + 0x12f6], 0
mov byte [rsp + 0x12f7], 0x21
mov byte [rsp + 0x12f8], 0
mov byte [rsp + 0x12f9], 1
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rsp + 0x12b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, gethostbyname
lea rdx, [rsp + 0x12c8]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_sendto]
mov dword [rsp + 0x12c0], eax
movzx eax, byte [0x140250ae6]
mov byte [rsp + 0x2a0], al
lea rdi, [rsp + 0x2a1]
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov dword [rsp + 0x290], 1
mov dword [rsp + 0x294], 0
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x1300], 0
jmp 0x140016d19
mov eax, dword [rsp + 0x1300]
add eax, 1
mov dword [rsp + 0x1300], eax
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x1300], eax
jae 0x140016d40
mov ecx, dword [rsp + 0x1300]
mov rax, qword [rsp + 0x288]
cmp qword [rsp + rcx*8 + 0x78], rax
jne 0x140016d3e
jmp 0x140016d40
jmp 0x140016d08
mov eax, dword [rsp + 0x70]
cmp dword [rsp + 0x1300], eax
jne 0x140016d73
cmp dword [rsp + 0x70], 0x40
jae 0x140016d73
mov ecx, dword [rsp + 0x1300]
mov rax, qword [rsp + 0x288]
mov qword [rsp + rcx*8 + 0x78], rax
mov eax, dword [rsp + 0x70]
add eax, 1
mov dword [rsp + 0x70], eax
xor eax, eax
test eax, eax
jne 0x140016cfb
lea rax, [rsp + 0x290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov ecx, 0x40
call qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x280], eax
cmp dword [rsp + 0x280], 0
jg 0x140016ddf
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x1324], 0
mov rcx, qword [rsp + 0x1390]
call fcn.140001470
mov eax, dword [rsp + 0x1324]
jmp 0x140017044
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x288]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140017017
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rsp + 0x2a0]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x1304], eax
cmp dword [rsp + 0x1304], 0
jg 0x140016e5b
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x1328], 0
mov rcx, qword [rsp + 0x1390]
call fcn.140001470
mov eax, dword [rsp + 0x1328]
jmp 0x140017044
movsx eax, byte [rsp + 0x2d8]
imul eax, eax, 0x12
cdqe
lea rax, [rsp + rax + 0x2d9]
mov qword [rsp + 0x1308], rax
mov rax, qword [rsp + 0x1308]
movzx r10d, byte [rax + 5]
mov rax, qword [rsp + 0x1308]
movzx r9d, byte [rax + 4]
mov rax, qword [rsp + 0x1308]
movzx edi, byte [rax + 3]
mov rax, qword [rsp + 0x1308]
movzx edx, byte [rax + 2]
mov rax, qword [rsp + 0x1308]
movzx ecx, byte [rax + 1]
mov rax, qword [rsp + 0x1308]
movzx r8d, byte [rax]
mov dword [rsp + 0x60], r10d
mov rax, qword [rsp + 0x1390]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], r9d
mov rax, qword [rsp + 0x1390]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x1390]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edx
mov rax, qword [rsp + 0x1390]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rsp + 0x1390]
mov r9, qword [r9]
lea rdx, str._02x_s_02x_s_02x_s_02x_s_02x_s_02x
mov rcx, qword [rsp + 0x1378]
call fcn.140002be0
movsx eax, byte [rsp + 0x2d8]
test eax, eax
jle 0x140016fe8
mov byte [rsp + 0x1310], 0
lea rdi, [rsp + 0x1311]
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
rep stosb byte [rdi], al
lea rdx, [rsp + 0x2d9]
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rcx, [rsp + 0x1310]
call fcn.1400ac960
mov byte [rsp + 0x131f], 0
lea rdx, [rsp + 0x1310]
lea rcx, [rsp + 0x1330]
call fcn.140010e20
mov qword [rsp + 0x1348], rax
mov rax, qword [rsp + 0x1348]
mov qword [rsp + 0x1350], rax
mov rcx, qword [rsp + 0x1350]
call fcn.140010eb0
mov rdx, rax
mov rcx, qword [rsp + 0x1380]
call fcn.140002060
nop
lea rcx, [rsp + 0x1330]
call fcn.140002e10
mov rcx, qword [rsp + 0x1380]
call fcn.140012fc0
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x1338], 1
mov rcx, qword [rsp + 0x1390]
call fcn.140001470
mov eax, dword [rsp + 0x1338]
jmp 0x140017044
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rsp + 0x133c], 0
mov rcx, qword [rsp + 0x1390]
call fcn.140001470
mov eax, dword [rsp + 0x133c]
mov rcx, qword [rsp + 0x1358]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0x1360
pop rdi
ret