Windows Socket Creation from Stomped Module

api where process.Ext.api.name == "VirtualProtect" and
 process.Ext.api.metadata.target_address_name == "mswsock.dll" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "c:\\windows\\sys?????\\ws2_32.dll!WSASocket*") and
 (
  (process.thread.Ext.call_stack_summary regex """ntdll.dll\
| apphelp.dll\
| ntdll.dll\
| kernelbase.dll\
| ws2_32.dll\
| [a-z]+\.dll""" and
   _arraysearch(process.thread.Ext.call_stack, $entry,
                stringcontains~($entry.symbol_info, substring(process.thread.Ext.call_stack_summary, 58, length(process.thread.Ext.call_stack_summary))) and $entry.callsite_trailing_bytes : "?*")) or

  (process.thread.Ext.call_stack_summary regex """ntdll.dll\
| wow64.dll\
| wow64cpu.dll\
| wow64.dll\
| ntdll.dll\
| apphelp.dll\
| ntdll.dll\
| kernelbase.dll\
| ws2_32.dll\
| [a-z]+\.dll""" and
   _arraysearch(process.thread.Ext.call_stack, $entry,
                stringcontains~($entry.symbol_info, substring(process.thread.Ext.call_stack_summary, 101, length(process.thread.Ext.call_stack_summary))) and $entry.callsite_trailing_bytes : "?*"))
  ) and 
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\syswow64\\rapi.dll*" and $entry.callsite_trailing_bytes like "8b450c8b0850ff5108eb1066837f50027509ff77548b0656ff500cb9a0725e67e8b23a0000eb0e8b0656*")