Function at 0x140005960
Capabilities:
Send data
Send http request

Disassembly:
push rdi
sub rsp, 0x4a0
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rax, qword [rdx + 0x20]
mov rdi, rdx
cmp qword [rax], 0
jne 0x14000598f
xor eax, eax
jmp 0x140005c64
mov qword [rsp + 0x4c0], rbx
xor r9d, r9d
mov qword [rsp + 0x498], rbp
xor r8d, r8d
mov qword [rsp + 0x490], rsi
xor edx, edx
mov qword [rsp + 0x488], r12
mov qword [rsp + 0x480], r13
xor r13d, r13d
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0x84cc3300
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x478], r14
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x470], r15
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rsp + 0x50], rax
mov r12, rax
test rax, rax
je 0x140005c27
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], 4
lea r8, [rsp + 0x40]
mov rcx, rax
lea edx, [r13 + 0x1f]
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
test eax, eax
je 0x140005a41
or dword [rsp + 0x40], 0x3380
lea r9d, [r13 + 4]
lea r8, [rsp + 0x40]
mov rcx, r12
lea edx, [r13 + 0x1f]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov edx, 1
lea ecx, [rdx + 0x23]
call fcn.140009b88
mov r15, rax
test rax, rax
je 0x140005c9d
mov esi, r13d
lea r12, str.486f73743a206c6f63616c686f73740d0a
mov r14, rax
nop word [rax + rax]
lea edx, [rsi + rsi]
movsx r8d, byte [rdx + r12]
lea ecx, [rdx + 1]
movzx ebp, byte [rcx + r12]
mov ecx, r8d
call fcn.140009fb0
lea ebx, [rax - 0x30]
cmp bl, 9
jle 0x140005a93
lea ebx, [rax - 0x37]
movsx ecx, bpl
call fcn.140009fb0
lea ecx, [rax - 0x30]
cmp cl, 9
jle 0x140005aa7
lea ecx, [rax - 0x37]
shl bl, 4
inc esi
add bl, cl
mov byte [r14], bl
inc r14
cmp esi, 0x11
jb 0x140005a70
mov r12, qword [rsp + 0x50]
mov r9d, 0xa0000000
mov rcx, r12
mov r8d, 0xffffffff
mov rdx, r15
call qword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov rcx, r15
call fcn.14000a0b4
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rcx, r12
test eax, eax
je 0x140005c97
lea r9, [rsp + 0x44]
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x48]
mov dword [rsp + 0x44], 8
mov edx, 0x69
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
test eax, eax
je 0x140005c1e
mov r13, qword [rsp + 0x48]
xor r15d, r15d
cmp dword [r13 + 0xc], r15d
jle 0x140005c15
xor r12d, r12d
nop
mov rax, qword [r13 + 0x10]
xor esi, esi
mov r14, qword [r12 + rax]
cmp dword [r14 + 0xc], esi
jle 0x140005bfa
xor ebp, ebp
nop word [rax + rax]
mov rax, qword [r14 + 0x10]
xor edx, edx
mov r8d, 0x400
mov rcx, qword [rax + rbp]
mov rbx, qword [rcx + 8]
lea rcx, [rsp + 0x60]
call fcn.140008f40
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x400
lea r8, [rsp + 0x60]
mov edx, 3
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertGetCertificateContextProperty]
test eax, eax
je 0x140005bea
mov rax, qword [rdi + 0x20]
xor ebx, ebx
cmp qword [rax], rbx
je 0x140005bea
xor ecx, ecx
nop
mov rcx, qword [rcx + rax]
call fcn.140001bb0
mov r8d, 0x28
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140019520
test eax, eax
je 0x140005c7d
mov rax, qword [rdi + 0x20]
inc rbx
lea rcx, [rbx*8]
cmp qword [rcx + rax], 0
jne 0x140005bb0
inc esi
add rbp, 8
cmp esi, dword [r14 + 0xc]
jl 0x140005b60
inc r15d
add r12, 8
cmp r15d, dword [r13 + 0xc]
jl 0x140005b40
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rcx, r13
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 2
mov r14, qword [rsp + 0x478]
mov r13, qword [rsp + 0x480]
mov r12, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x498]
mov rbx, qword [rsp + 0x4c0]
mov r15, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140007e30
add rsp, 0x4a0
pop rdi
ret
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateChain]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
jmp 0x140005c2c
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x140005c2c