Function at 0x140001178
Capabilities:
Encode data using xor
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rcx
mov qword [rbp + 0xd0], rcx
xor r15d, r15d
mov dword [rbp - 0x58], 0xad4ead4d
mov dword [rbp - 0x54], 0xad5cad4f
mov dword [rbp - 0x50], 0xad02ad51
mov dword [rbp - 0x4c], 0xad5dad09
mov dword [rbp - 0x48], 0xad5aad4e
mov dword [rbp - 0x44], 0xad26ad5a
mov word [rbp - 0x40], r15w
mov byte [rbp - 0x3e], 1
mov ebx, 0xad36
mov ecx, ebx
lea rdx, [rbp - 0x58]
lea r8d, [r15 + 6]
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, 2
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001202
mov byte [rbp - 0x3e], r15b
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r14, rax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x38], 0xad46ad54
mov dword [rbp - 0x34], 0xad16ad5e
mov dword [rbp - 0x30], 0xad5fad4d
mov dword [rbp - 0x2c], 0xad59ad57
mov dword [rbp - 0x28], 0xad4cad5a
mov dword [rbp - 0x24], 0xad2dad5e
mov dword [rbp - 0x20], 0xad2dad6f
mov dword [rbp - 0x1c], 0xad23ad31
mov word [rbp - 0x18], r15w
mov byte [rbp - 0x16], 1
mov rcx, rbx
lea rdx, [rbp - 0x38]
mov r8d, 8
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, 2
lea rdx, [rdx + 4]
sub r8, 1
jne 0x1400012af
mov byte [rbp - 0x16], r15b
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
mov qword [rbp + 0x68], rax
test rax, rax
jne 0x140001328
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea r14d, [rdi + 0xf]
jmp 0x140001a01
movdqa xmm0, xmmword [0x1400052a0]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x140005290]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0x31656e1d
mov dword [rbp + 0x34], 0x6b191538
mov dword [rbp + 0x38], 0xf2d2a3c
mov r14d, 0xf
mov dword [rbp + 0x3c], 0x1005627
mov rcx, r15
lea eax, [rcx + 0x35]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 0x2e
jb 0x140001367
mov byte [rbp + 0x3f], r15b
mov dword [rsp + 0x40], 0xc010502
mov dword [rsp + 0x44], 0xe0a0b0b
mov edx, 0xa
mov dword [rsp + 0x48], 0x1000704
lea r13d, [rdx - 3]
mov rcx, r15
lea eax, [rcx + 0x35]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, rdx
jb 0x14000139f
mov byte [rsp + 0x4b], r15b
mov rcx, rsi
cmp qword [rsi + 0x18], r14
jbe 0x1400013bf
mov rcx, qword [rsi]
mov r9, qword [rsi + 0x10]
add r9, rcx
mov rdx, rsi
cmp qword [rsi + 0x18], r14
jbe 0x1400013d2
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
cmp rdx, r9
jne 0x140001407
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r13
mov word [rbp + 0xe0], r15w
jmp 0x140001417
sub r9, rdx
lea rcx, [rbp + 0xe0]
call fcn.14000399c
nop
mov dword [rbp - 0x70], 0xad42ad13
mov dword [rbp - 0x6c], 0xad40ad52
mov dword [rbp - 0x68], 0xad07ad4d
mov word [rbp - 0x64], r15w
mov byte [rbp - 0x62], 1
mov rcx, rbx
lea rdx, [rbp - 0x70]
mov r8d, 3
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, 2
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001442
mov byte [rbp - 0x62], r15b
lea rax, [rsp + 0x40]
or r12, 0xffffffffffffffff
mov r9, r12
inc r9
cmp byte [rax + r9], r15b
jne 0x140001492
lea rax, [rsp + 0x40]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rcx, [rsp + 0x40]
cmp rcx, rax
jne 0x1400014d0
movdqa xmm2, xmmword [0x140005240]
movdqu xmmword [rbp], xmm2
mov word [rbp - 0x10], r15w
jmp 0x1400014e6
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.14000399c
movdqa xmm2, xmmword [0x140005240]
mov dword [rsp + 0x60], 0xad45ad1a
mov dword [rsp + 0x64], 0xad56ad52
mov dword [rsp + 0x68], 0xad77ad5d
mov dword [rsp + 0x6c], 0xad4fad5e
mov dword [rsp + 0x70], 0xad5fad4e
mov dword [rsp + 0x74], 0xad25ad58
mov dword [rsp + 0x78], 0xad21ad7e
mov dword [rsp + 0x7c], 0xad25ad2b
mov dword [rbp - 0x80], 0xad19ad31
mov dword [rbp - 0x7c], 0xad2cad2e
mov dword [rbp - 0x78], 0xad74
mov byte [rbp - 0x74], 1
mov rcx, r15
mov edx, 0x52cb
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x60], ax
inc rcx
cmp rcx, 0x15
jb 0x140001547
mov byte [rbp - 0x74], r15b
lea rax, [rbp + 0x10]
mov r9, r12
inc r9
cmp byte [rax + r9], r15b
jne 0x140001566
lea rax, [rbp + 0x10]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rcx, [rbp + 0x10]
cmp rcx, rax
jne 0x1400015a0
movdqu xmmword [rbp + 0x80], xmm2
mov word [rbp + 0x70], r15w
jmp 0x1400015ae
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x70]
call fcn.14000399c
nop
mov dword [rsp + 0x50], 0xad54ad1a
mov dword [rsp + 0x54], 0xad4cad58
mov word [rsp + 0x58], r15w
mov byte [rsp + 0x5a], 1
lea rcx, [rsp + 0x50]
mov edx, 2
lea rax, [rbx - 1]
movq xmm0, rbx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rcx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx], xmm1
add rbx, 2
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1400015d3
mov byte [rsp + 0x5a], r15b
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb0]
call fcn.14000353c
nop
lea rcx, [rsp + 0x60]
mov r8, r12
inc r8
cmp word [rcx + r8*2], r15w
jne 0x140001636
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400033c8
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x60], xmm6
movups xmm2, xmmword [rax + 0x10]
movdqu xmmword [rsp + 0x70], xmm2
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r13
mov word [rax], r15w
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movq rbx, xmm2
mov r15, qword [rbp]
lea r13, [rbx + r15]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rsp + 0x50], rcx
mov rax, rcx
sub rax, rbx
mov r9, qword [rbp + 8]
cmp r15, rax
ja 0x14000170e
cmp r9, rcx
ja 0x14000170e
movups xmmword [rbp + 0x40], xmm6
movdqu xmmword [rbp + 0x50], xmm2
movdqa xmm0, xmmword [0x140005240]
movdqu xmmword [rsp + 0x70], xmm0
xor eax, eax
mov word [rsp + 0x60], ax
lea r8, [rbp + 0x40]
movq rcx, xmm6
psrldq xmm2, 8
movq rax, xmm2
cmp rax, 7
cmova r8, rcx
lea rdx, [rbp - 0x10]
cmp r9, 7
cmova rdx, qword [rbp - 0x10]
lea rcx, [r8 + rbx*2]
lea r8, [r15*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001816
sub r9, r15
cmp rbx, r9
ja 0x14000177d
movups xmm2, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x40], xmm2
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x140005240]
movdqu xmmword [rbp], xmm1
xor eax, eax
mov word [rbp - 0x10], ax
movq rdi, xmm2
add rbx, rbx
lea rcx, [rdi + rbx]
lea r8, [r15*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rsp + 0x60]
movq rax, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rax
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001812
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rbx
cmp rax, r15
jb 0x140001a7f
mov rax, r13
or rax, 7
cmp rax, rcx
ja 0x1400017b1
mov rcx, rax
mov edx, 0xa
cmp rax, rdx
cmovb rcx, rdx
mov qword [rbp + 0x60], rcx
lea rdx, [rbp + 0x60]
call fcn.140003a6c
mov rdi, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x58], rcx
lea rdx, [rsp + 0x60]
movq rcx, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rcx
add rbx, rbx
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbx + rdi]
lea r8, [r15*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0x68]
lea rax, [rbp - 0x70]
xor r15d, r15d
inc r12
cmp word [rax + r12*2], r15w
jne 0x14000181d
mov r8, r12
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x40]
call fcn.1400033c8
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.1400033c8
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp + 0x90]
call fcn.1400031e8
nop
lea rcx, [rbp + 0x40]
call fcn.1400031e8
nop
lea rcx, [rsp + 0x60]
call fcn.1400031e8
nop
lea rcx, [rbp + 0xb0]
call fcn.1400031e8
nop
lea rcx, [rbp + 0x70]
call fcn.1400031e8
nop
lea rcx, [rbp - 0x10]
call fcn.1400031e8
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r8, qword [rbp + 0x100]
mov dword [rbp + 0xd0], 0xad73ad72
mov dword [rbp + 0xd4], 0xad63
mov byte [rbp + 0xd8], 1
mov rcx, r15
mov edx, 0x52cb
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 + 0xd0], ax
inc rcx
cmp rcx, 3
jb 0x140001951
mov byte [rbp + 0xd8], r15b
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x1400019d4
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rcx, rbx
test eax, eax
je 0x1400019ce
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea rcx, [rbp + 0x100]
call fcn.1400031e8
nop
lea rcx, [rbp + 0xe0]
call fcn.1400031e8
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, r14
jbe 0x140001a36
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140001a31
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a78
mov rcx, r8
call fcn.140003da4
mov byte [rsi], r15b
mov qword [rsi + 0x18], r14
xor eax, eax
mov qword [rsi + 0x10], r15
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140003d40
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001164
nop
int3