Function at 0x180018628
Capabilities:
Contain obfuscated stackstrings
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov r14, r8
mov rax, rdx
mov r15, rcx
mov rdi, qword [rbp + 0x580]
xor r13d, r13d
mov r12b, r13b
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
lea ebx, [r13 + 0xf]
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x70], r13b
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x70], r13b
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x70]
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180018c58
test al, al
je 0x180018aae
lea esi, [rbx - 0xe]
mov ebx, esi
mov ecx, dword [rsp + 0x40]
call fcn.180017c94
test al, al
je 0x1800186dc
mov rcx, r15
call fcn.18001763c
neg al
sbb ecx, ecx
and ebx, ecx
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.18000198c
mov r9d, ebx
mov r8d, dword [rsp + 0x44]
mov rdx, rax
mov rcx, r15
call fcn.180018d60
cmp byte [r15 + 0x28], r13b
je 0x180018aa1
mov ebx, r13d
mov eax, 0x803000
cmp dword [rsp + 0x40], esi
cmove ebx, eax
or ebx, 0x4480000
mov edx, esi
lea rcx, [rbp - 0x50]
call fcn.180018b88
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r8, qword [rsp + 0x70]
cmp qword [rax + 0x18], 0x10
jb 0x180018740
mov rax, qword [rax]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [0x180027140]
mov rdx, rax
mov rcx, qword [r15 + 0x458]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rsi, rax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1800187a8
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800187a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018b61
call fcn.180001fe4
mov qword [rbp - 0x40], r13
mov ecx, 0xf
mov qword [rbp - 0x38], rcx
mov byte [rbp - 0x50], r13b
test rsi, rsi
je 0x180018a98
mov word [rbp - 0x2a], 0x2d74
mov dword [rbp - 0x18], 0x736a2f6e
mov dword [rbp - 0x20], 0x63696c70
mov word [rbp - 0x27], 0x7079
mov dword [rbp - 0x24], 0x7061203a
mov dword [rbp - 0xe], 0x65737261
mov dword [rbp - 9], 0x6674753d
mov word [rbp - 0x11], 0x6320
mov word [rbp - 0x14], 0x6e6f
mov byte [rbp - 0xa], 0x74
mov word [rbp - 5], 0x382d
mov dword [rbp - 0x1c], 0x6f697461
mov dword [rbp - 0x2e], 0x6e65746e
mov word [rbp - 0x30], 0x6f43
mov byte [rbp - 0x12], 0x3b
mov byte [rbp - 0xf], 0x68
mov byte [rbp - 3], r13b
mov byte [rbp - 0x28], 0x54
mov byte [rbp - 0x25], 0x65
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rcx
lea rax, [rbp - 0x30]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r13b
jne 0x180018846
cmp rbx, rcx
lea rcx, [rsp + 0x50]
ja 0x180018871
mov qword [rsp + 0x60], rbx
mov r8, rbx
lea rdx, [rbp - 0x30]
call fcn.1800039d0
mov byte [rsp + rbx + 0x50], r13b
jmp 0x18001887d
lea r9, [rbp - 0x30]
mov rdx, rbx
call fcn.1800013f4
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18001888a
mov r9, qword [rdi]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov ebx, eax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800188ef
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800188ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018b67
call fcn.180001fe4
test ebx, ebx
je 0x180018a98
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x44]
lea r8, [rbp]
mov edx, 0x13
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x18001892b
lea rcx, [rbp]
call fcn.1800090a0
mov r12b, 1
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r13b
mov dword [rsp + 0x40], r13d
jmp 0x1800189e1
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x180018a04
cmp rax, 0x401
jae 0x180018b6d
mov byte [rbp + rax + 0x100], r13b
lea rax, [rbp + 0x100]
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], r13b
jne 0x180018978
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
sub rax, rcx
cmp rdi, rax
ja 0x1800189c8
lea rax, [rcx + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0x100]
mov rcx, rbx
call fcn.1800039d0
mov byte [rbx + rdi], r13b
jmp 0x1800189e1
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x100]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.18000165c
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rbp + 0x100]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18001894d
lea rax, [rsp + 0x50]
cmp r14, rax
je 0x180018a5b
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
cmp rbx, qword [r14 + 0x18]
ja 0x180018a4f
mov rdi, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180018a37
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.1800039d0
mov byte [rdi + rbx], r13b
jmp 0x180018a5b
mov rdx, rbx
mov rcx, r14
call fcn.1800013f4
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180018a98
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018a93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018b73
call fcn.180001fe4
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call fcn.180018d24
mov ebx, 0xf
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180018aea
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018b79
call fcn.180001fe4
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x70], r13b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x180018b2e
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018b5b
call fcn.180001fe4
mov al, r12b
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.180001f90
mov rbx, qword [rsp + 0x678]
add rsp, 0x620
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180008a6c
nop
call fcn.180008a6c
nop
call fcn.180008a6c
nop
call fcn.1800020f4
nop
call fcn.180008a6c
nop
call fcn.180008a6c
int3