Function at 0x14000e800
Capabilities:
Check if file exists
Connect to http server
Create http request
Get disk information
Read data from internet
Receive data
Resolve dns
Send data
Send http request
Send http request with host header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xe60
mov qword [rsp + 0xd70], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0xe58], rax
mov rdx, qword [rsp + 0xe78]
mov rcx, qword [rsp + 0xe70]
call fcn.14000f3a0
test eax, eax
je 0x14000f37b
mov r8d, 0x400
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dx, 0x2e
lea rcx, [rsp + 0x60]
call fcn.140001460
mov rdx, rax
xor eax, eax
mov word [rdx], ax
mov dx, VarDateFromDisp
lea rcx, [rsp + 0x60]
call fcn.140001460
mov rdx, rax
add rdx, 2
lea rcx, [rsp + 0x898]
call fcn.140002100
nop
lea rcx, [rsp + 0x898]
call fcn.140006970
lea rcx, [rsp + 0x878]
call fcn.140002de0
nop
mov r8, qword [rsp + 0x898]
lea rdx, str.reg._s.com
lea rcx, [rsp + 0x878]
call fcn.140002c70
lea rax, [rsp + 0xcb8]
mov qword [rsp + 0xcc0], rax
lea rax, [rsp + 0xcc8]
mov qword [rsp + 0xcd0], rax
lea rdx, str.8.8.8.8_8.8.4.4
mov rcx, qword [rsp + 0xcc0]
call fcn.140002100
mov qword [rsp + 0xd78], rax
mov rax, qword [rsp + 0xd78]
mov qword [rsp + 0xd80], rax
lea rdx, [rsp + 0x878]
mov rcx, qword [rsp + 0xcd0]
call fcn.140001430
mov qword [rsp + 0xd88], rax
mov rdx, qword [rsp + 0xd80]
mov rcx, qword [rsp + 0xd88]
call fcn.1400dc310
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x868], eax
cmp dword [rsp + 0x40], 0
jne 0x14000ea53
lea rcx, [rsp + 0x878]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xcd8]
call fcn.140002e10
mov qword [rsp + 0xd90], rax
mov rax, qword [rsp + 0xd90]
mov qword [rsp + 0xd98], rax
mov rcx, qword [rsp + 0xd98]
call fcn.140002ec0
mov rcx, rax
call qword [sym.imp.WSOCK32.dll_gethostbyname]
mov qword [rsp + 0xca0], rax
lea rcx, [rsp + 0xcd8]
call fcn.140002ea0
cmp qword [rsp + 0xca0], 0
jne 0x14000ea3b
mov rcx, qword [rsp + 0xe70]
add rcx, 0x2f8
lea rdx, str.123202
call fcn.1400020d0
lea rdx, str.License_verify_problem:_resolve_hostname_false
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0xce0], 0
lea rcx, [rsp + 0x878]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
mov eax, dword [rsp + 0xce0]
jmp 0x14000f380
mov rax, qword [rsp + 0xca0]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rsp + 0x868], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsp + 0x890], rax
mov ecx, dword [rsp + 0x868]
call qword [sym.imp.WSOCK32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0xce8]
call fcn.14000e700
mov qword [rsp + 0xda0], rax
mov rcx, qword [rsp + 0xda0]
call fcn.1400118c0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x50
mov rdx, rax
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rsp + 0x860], rax
lea rcx, [rsp + 0xce8]
call fcn.140002ea0
lea rcx, [rsp + 0x888]
call fcn.140002de0
nop
lea rcx, [rsp + 0x48]
call fcn.140002de0
nop
mov edx, 3
lea rcx, [rsp + 0xcf0]
call fcn.1400dde90
mov qword [rsp + 0xda8], rax
mov rax, qword [rsp + 0xda8]
mov qword [rsp + 0xdb0], rax
mov rdx, qword [rsp + 0xdb0]
lea rcx, [rsp + 0x48]
call fcn.140002db0
nop
lea rcx, [rsp + 0xcf0]
call fcn.140001490
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x44], eax
mov byte [rsp + 0xca8], 0x43
jmp 0x14000eb80
movzx eax, byte [rsp + 0xca8]
add al, 1
mov byte [rsp + 0xca8], al
movsx eax, byte [rsp + 0xca8]
cmp eax, 0x5a
jg 0x14000ecba
movsx ecx, byte [rsp + 0xca8]
sub ecx, 0x41
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, dword [rsp + 0x44]
and eax, ecx
test eax, eax
jne 0x14000ebb1
jmp 0x14000eb6f
lea rcx, [rsp + 0xcb0]
call fcn.140002de0
nop
movsx r8d, byte [rsp + 0xca8]
lea rdx, [0x140256e30]
lea rcx, [rsp + 0xcb0]
call fcn.140002c70
lea rcx, [rsp + 0xcb0]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x14000eca8
lea r8, str.ccboot.cer
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0xd00]
call fcn.1400010b0
mov qword [rsp + 0xdb8], rax
mov rcx, qword [rsp + 0xdb8]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0xcf8], eax
lea rcx, [rsp + 0xd00]
call fcn.140001490
cmp dword [rsp + 0xcf8], 0
je 0x14000eca8
lea rcx, [rsp + 0xd08]
call fcn.1401c2ec0
mov qword [rsp + 0xdc0], rax
mov rax, qword [rsp + 0xdc0]
mov qword [rsp + 0xdc8], rax
mov rdx, qword [rsp + 0xdc8]
lea rcx, [rsp + 0x48]
call fcn.140002db0
nop
lea rcx, [rsp + 0xd08]
call fcn.140001490
nop
lea rcx, [rsp + 0xcb0]
call fcn.140001490
jmp 0x14000ecba
lea rcx, [rsp + 0xcb0]
call fcn.140001490
jmp 0x14000eb6f
mov rdx, qword [rsp + 0xe80]
lea rcx, [rsp + 0xd10]
call fcn.1400d9ff0
mov qword [rsp + 0xdd0], rax
mov rax, qword [rsp + 0xdd0]
mov qword [rsp + 0xdd8], rax
lea rcx, [rsp + 0x48]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xd18]
call fcn.1400d9ff0
mov qword [rsp + 0xde0], rax
mov rax, qword [rsp + 0xde0]
mov qword [rsp + 0xde8], rax
lea rcx, [rsp + 0xd20]
call fcn.140005140
mov qword [rsp + 0xdf0], rax
mov rax, qword [rsp + 0xdf0]
mov qword [rsp + 0xdf8], rax
mov rcx, qword [rsp + 0xdf8]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xd28]
call fcn.1400d9ff0
mov qword [rsp + 0xe00], rax
mov rax, qword [rsp + 0xe00]
mov qword [rsp + 0xe08], rax
lea rcx, [rsp + 0x898]
call fcn.14000f8f0
mov rdx, rax
lea rcx, [rsp + 0xd30]
call fcn.1400d9ff0
mov qword [rsp + 0xe10], rax
mov rax, qword [rsp + 0xe10]
mov qword [rsp + 0xe18], rax
mov rdx, qword [rsp + 0xe78]
lea rcx, [rsp + 0xd38]
call fcn.1400d9ff0
mov qword [rsp + 0xe20], rax
mov rax, qword [rsp + 0xe20]
mov qword [rsp + 0xe28], rax
mov rax, qword [rsp + 0xdd8]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xde8]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xe08]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xe18]
mov r9, qword [r9]
mov r8, qword [rsp + 0xe28]
mov r8, qword [r8]
lea rdx, str._reg_index.php_id_sproduct_sdate_smid_soem_s
lea rcx, [rsp + 0x888]
call fcn.140002c70
nop
lea rcx, [rsp + 0xd38]
call fcn.140001490
nop
lea rcx, [rsp + 0xd30]
call fcn.140001490
nop
lea rcx, [rsp + 0xd28]
call fcn.140001490
nop
lea rcx, [rsp + 0xd20]
call fcn.140001490
nop
lea rcx, [rsp + 0xd18]
call fcn.140001490
nop
lea rcx, [rsp + 0xd10]
call fcn.140001490
lea rcx, [rsp + 0x888]
call fcn.14000f8f0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x28f500
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, [0x140256ec0]
mov rcx, qword [rsp + 0x860]
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x870]
call fcn.140002de0
nop
mov r8, qword [rsp + 0x878]
lea rdx, str.Host:__s_r_n
lea rcx, [rsp + 0x870]
call fcn.140002c70
lea rcx, [rsp + 0x870]
call fcn.14000f8f0
mov r9d, 0xa0000000
mov r8d, 0xffffffff
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x14000eff3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x860]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0xe70]
add rcx, 0x2f8
lea rdx, str.123202
call fcn.1400020d0
lea rdx, str.License_verify_problem:_Internet_send_false
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0xd40], 0
lea rcx, [rsp + 0x870]
call fcn.140001490
nop
lea rcx, [rsp + 0x48]
call fcn.140001490
nop
lea rcx, [rsp + 0x888]
call fcn.140001490
nop
lea rcx, [rsp + 0x878]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
mov eax, dword [rsp + 0xd40]
jmp 0x14000f380
movzx eax, byte [0x140257000]
mov byte [rsp + 0x8a0], al
lea rdi, [rsp + 0x8a1]
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov dword [rsp + 0x880], 0
lea r9, [rsp + 0x880]
mov r8d, 0x3ff
lea rdx, [rsp + 0x8a0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14000f0f2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x860]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0xe70]
add rcx, 0x2f8
lea rdx, str.123202
call fcn.1400020d0
lea rdx, str.License_verify_problem:_Internet_read_false
mov ecx, 1
call fcn.1400dcf70
mov dword [rsp + 0xd44], 0
lea rcx, [rsp + 0x870]
call fcn.140001490
nop
lea rcx, [rsp + 0x48]
call fcn.140001490
nop
lea rcx, [rsp + 0x888]
call fcn.140001490
nop
lea rcx, [rsp + 0x878]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
mov eax, dword [rsp + 0xd44]
jmp 0x14000f380
mov eax, dword [rsp + 0x880]
mov byte [rsp + rax + 0x8a0], 0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x860]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x890]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r8d, 4
lea rdx, str._ERR
lea rcx, [rsp + 0x8a0]
call fcn.1400cd4f8
test eax, eax
jne 0x14000f261
lea rdx, [rsp + 0x8a4]
lea rcx, [rsp + 0xd48]
call fcn.1400dd9c0
mov qword [rsp + 0xe30], rax
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0xe38], rax
mov r8, qword [rsp + 0xe38]
mov r8, qword [r8]
lea rdx, str._ERROR__License_problem:__s
mov ecx, 1
call fcn.1400dcf70
nop
lea rcx, [rsp + 0xd48]
call fcn.140001490
cmp qword [rsp + 0xe88], 0
je 0x14000f208
cmp dword [rsp + 0xe90], 0
je 0x14000f208
lea rdx, [rsp + 0x8a4]
lea rcx, [rsp + 0xd50]
call fcn.1400dd9c0
mov qword [rsp + 0xe40], rax
movsxd rdi, dword [rsp + 0xe90]
mov rcx, qword [rsp + 0xe40]
call fcn.14000f8f0
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsp + 0xe88]
call fcn.1400a9968
lea rcx, [rsp + 0xd50]
call fcn.140001490
mov dword [rsp + 0xd58], 0xffffffff
lea rcx, [rsp + 0x870]
call fcn.140001490
nop
lea rcx, [rsp + 0x48]
call fcn.140001490
nop
lea rcx, [rsp + 0x888]
call fcn.140001490
nop
lea rcx, [rsp + 0x878]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
mov eax, dword [rsp + 0xd58]
jmp 0x14000f380
mov rcx, qword [rsp + 0xe70]
add rcx, 0x300
call fcn.14000e350
lea rcx, [rsp + 0x8a0]
call fcn.1400a98c0
cmp rax, 6
jne 0x14000f2e9
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0xd60]
call fcn.14000e700
mov qword [rsp + 0xe48], rax
mov rax, qword [rsp + 0xe48]
mov qword [rsp + 0xe50], rax
mov rcx, qword [rsp + 0xe50]
call fcn.1400118c0
mov rcx, qword [rsp + 0xe70]
add rcx, 0x2f8
mov rdx, rax
call fcn.1400020d0
nop
lea rcx, [rsp + 0xd60]
call fcn.140002ea0
jmp 0x14000f304
mov rcx, qword [rsp + 0xe70]
add rcx, 0x2f8
lea rdx, str.123202
call fcn.1400020d0
mov rcx, qword [rsp + 0xe70]
add rcx, 0x300
mov rax, qword [rsp + 0xe70]
mov rax, qword [rax + 0x300]
call qword [rax + 0x28]
mov dword [rsp + 0xd68], 1
lea rcx, [rsp + 0x870]
call fcn.140001490
nop
lea rcx, [rsp + 0x48]
call fcn.140001490
nop
lea rcx, [rsp + 0x888]
call fcn.140001490
nop
lea rcx, [rsp + 0x878]
call fcn.140001490
nop
lea rcx, [rsp + 0x898]
call fcn.140001490
mov eax, dword [rsp + 0xd68]
jmp 0x14000f380
mov eax, 1
mov rcx, qword [rsp + 0xe58]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0xe60
pop rdi
ret