Function at 0x1401cd240
Capabilities:
Prepare http request
Receive http response
Set http header

Disassembly:
mov qword ss:[rsp + 0x18], rbx
push rsi
push rdi
push r15
sub rsp, 0x60
xor edi, edi
movzx esi, r8w
mov qword [rsp + 0x48], rdi
mov r15, rdx
mov rbx, rcx
call fcn.1401cd0c0
test al, al
jne 0x1401cd27c
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop rdi
pop rsi
ret
mov qword ss:[rsp + 0x80], rbp
mov qword [rsp + 0x88], r14
mov r14d, 1
lock xadd word [0x1402c64f4], r14w
mov rcx, qword [0x1402c6140]
mov edx, 4
mov r8d, 0x1000
mov dword [rsp + 0x98], 0x1000
inc r14w
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x28], 1
lea rdx, [rsp + 0x98]
mov rbp, rax
mov word [rsp + 0x20], r14w
mov rcx, rax
movzx r9d, si
mov rax, qword [0x1402ca340]
mov r8, r15
call qword [case.0x14013f76a.0]
test eax, eax
setne cl
test eax, eax
jne 0x1401cd360
mov rcx, qword [0x1402c6140]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rsp + 0x98]
mov edx, 4
mov rcx, qword [0x1402c6140]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x28], 1
lea rdx, [rsp + 0x98]
mov rbp, rax
mov word [rsp + 0x20], r14w
mov rcx, rax
movzx r9d, si
mov rax, qword [0x1402ca340]
mov r8, r15
call qword [case.0x14013f76a.0]
test eax, eax
setne cl
test cl, cl
je 0x1401cd4fd
mov rcx, rbx
call fcn.1401ccea0
test rax, rax
je 0x1401cd4fd
lea rcx, str.application_dns_message
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rcx
lea r8, str._dns_query
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.POST
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1401cd4fd
mov r9d, 0xa0000000
lea rdx, str.Content_Type:_application_dns_message
mov r8d, 0xffffffff
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [0x1402bbf68], 0x3e
ja 0x1401cd3fe
mov r9d, 4
mov dword [rsp + 0x40], 0x1000
lea r8, [rsp + 0x40]
mov edx, 0x1f
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword ds:[rsp + 0x98]
mov r9, rbp
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1401cd4d7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop dword [rax]
test eax, eax
je 0x1401cd4d7
lea r8, [rsp + 0x44]
mov rcx, rsi
lea rdx, [rsp + 0x48]
call sym.SystemInformer.exe_Ordinal_2025
test al, al
je 0x1401cd4d7
mov edx, dword [rsp + 0x44]
mov qword [rsp + 0x50], rdi
cmp edx, 0xffff
ja 0x1401cd4d7
mov rbx, qword [rsp + 0x48]
movzx eax, word [rbx + 4]
movzx ecx, word [rbx]
ror ax, 8
mov word [rbx + 4], ax
movzx eax, word [rbx + 6]
ror ax, 8
mov word [rbx + 6], ax
movzx eax, word [rbx + 8]
ror ax, 8
mov word [rbx + 8], ax
movzx eax, word [rbx + 0xa]
ror ax, 8
ror cx, 8
mov word [rbx], cx
mov word [rbx + 0xa], ax
cmp cx, r14w
jne 0x1401cd4dc
mov rax, qword [0x1402ca348]
lea r8, [rsp + 0x50]
mov rcx, rbx
call qword [case.0x14013f76a.0]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rdi, rax
jmp 0x1401cd4dc
mov rbx, qword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rbx, rbx
je 0x1401cd4fd
mov rcx, qword [0x1402c6140]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
test rbp, rbp
je 0x1401cd517
mov rcx, qword [0x1402c6140]
mov r8, rbp
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, qword [rsp + 0x88]
mov rax, rdi
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop rdi
pop rsi
ret