Function at 0x140001178
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rbp - 0x58], 0xb48bb48a
mov dword [rbp - 0x54], 0xb491b48c
mov dword [rbp - 0x50], 0xb4cfb49e
mov dword [rbp - 0x4c], 0xb498b4ca
mov dword [rbp - 0x48], 0xb49fb489
mov dword [rbp - 0x44], 0xb49bb499
mov word [rbp - 0x40], r12w
mov byte [rbp - 0x3e], 1
mov ebx, 0xb4f3
mov ecx, ebx
lea rdx, [rbp - 0x58]
lea r8d, [r12 + 6]
lea r13d, [r12 + 2]
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001208
mov byte [rbp - 0x3e], r12b
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r14, rax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x38], 0xb483b493
mov dword [rbp - 0x34], 0xb4dbb49d
mov dword [rbp - 0x30], 0xb492b482
mov dword [rbp - 0x2c], 0xb49cb494
mov dword [rbp - 0x28], 0xb489b49d
mov dword [rbp - 0x24], 0xb490b49d
mov dword [rbp - 0x20], 0xb490b4d0
mov dword [rbp - 0x1c], 0xb566b572
mov word [rbp - 0x18], r12w
mov byte [rbp - 0x16], 1
mov rcx, rbx
lea rdx, [rbp - 0x38]
mov r8d, 8
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x1400012b4
mov byte [rbp - 0x16], r12b
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
mov qword [rbp + 0x68], rax
test rax, rax
jne 0x14000132c
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea r14d, [rdi + 0xf]
jmp 0x140001a04
movdqa xmm0, xmmword [0x140005300]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400052f0]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0x7c262b5a
mov dword [rbp + 0x34], 0x2e5a5877
mov dword [rbp + 0x38], 0x726e6f7b
mov dword [rbp + 0x3c], 0x1002b58
mov rcx, r12
lea eax, [rcx - 0xe]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 0x2e
jb 0x140001365
mov byte [rbp + 0x3f], r12b
mov dword [rsp + 0x40], 0xc1c2c0c5
mov dword [rsp + 0x44], 0xcbc9c6c4
mov dword [rsp + 0x48], 0x100c2c3
mov rcx, r12
mov edx, 0xa
lea eax, [rcx - 0xe]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, rdx
jb 0x140001399
mov byte [rsp + 0x4b], r12b
mov rcx, rsi
mov r14d, 0xf
cmp qword [rsi + 0x18], r14
jbe 0x1400013bf
mov rcx, qword [rsi]
mov r9, qword [rsi + 0x10]
add r9, rcx
mov rdx, rsi
cmp qword [rsi + 0x18], r14
jbe 0x1400013d2
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
cmp rdx, r9
jne 0x14000140b
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r12w
jmp 0x14000141b
sub r9, rdx
lea rcx, [rbp + 0xe0]
call fcn.1400039bc
nop
mov dword [rbp - 0x70], 0xb487b4d4
mov dword [rbp - 0x6c], 0xb48db491
mov dword [rbp - 0x68], 0xb4cab482
mov word [rbp - 0x64], r12w
mov byte [rbp - 0x62], 1
mov rcx, rbx
lea rdx, [rbp - 0x70]
mov r8d, 3
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001446
mov byte [rbp - 0x62], r12b
lea rax, [rsp + 0x40]
or r15, 0xffffffffffffffff
mov r9, r15
inc r9
cmp byte [rax + r9], r12b
jne 0x140001495
lea rax, [rsp + 0x40]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rcx, [rsp + 0x40]
cmp rcx, rax
jne 0x1400014d3
movdqa xmm2, xmmword [0x140005240]
movdqu xmmword [rbp], xmm2
mov word [rbp - 0x10], r12w
jmp 0x1400014e9
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.1400039bc
movdqa xmm2, xmmword [0x140005240]
mov dword [rsp + 0x60], 0xb480b4dd
mov dword [rsp + 0x64], 0xb49bb491
mov dword [rsp + 0x68], 0xb4bab492
mov dword [rsp + 0x6c], 0xb48ab49d
mov dword [rsp + 0x70], 0xb49ab489
mov dword [rsp + 0x74], 0xb498b49b
mov dword [rsp + 0x78], 0xb49cb4c1
mov dword [rsp + 0x7c], 0xb560b568
mov dword [rbp - 0x80], 0xb55cb576
mov dword [rbp - 0x7c], 0xb561b56d
mov dword [rbp - 0x78], 0xb53b
mov byte [rbp - 0x74], 1
mov rcx, r12
mov edx, 0x4b0e
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x60], ax
inc rcx
cmp rcx, 0x15
jb 0x14000154a
mov byte [rbp - 0x74], r12b
lea rax, [rbp + 0x10]
mov r9, r15
inc r9
cmp byte [rax + r9], r12b
jne 0x140001569
lea rax, [rbp + 0x10]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rcx, [rbp + 0x10]
cmp rcx, rax
jne 0x1400015a3
movdqu xmmword [rbp + 0x80], xmm2
mov word [rbp + 0x70], r12w
jmp 0x1400015b1
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x70]
call fcn.1400039bc
nop
mov dword [rsp + 0x50], 0xb491b4dd
mov dword [rsp + 0x54], 0xb481b49b
mov word [rsp + 0x58], r12w
mov byte [rsp + 0x5a], 1
lea rcx, [rsp + 0x50]
mov rdx, r13
lea rax, [rbx - 1]
movq xmm0, rbx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rcx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx], xmm1
add rbx, r13
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1400015d4
mov byte [rsp + 0x5a], r12b
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb0]
call fcn.14000355c
nop
lea rcx, [rsp + 0x60]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r12w
jne 0x140001636
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400033e8
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x60], xmm6
movups xmm2, xmmword [rax + 0x10]
movdqu xmmword [rsp + 0x70], xmm2
mov qword [rax + 0x10], r12
mov r10d, 7
mov qword [rax + 0x18], r10
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movq rbx, xmm2
mov r12, qword [rbp]
lea r13, [rbx + r12]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rsp + 0x50], rcx
mov rax, rcx
sub rax, rbx
mov r9, qword [rbp + 8]
cmp r12, rax
ja 0x140001712
cmp r9, rcx
ja 0x140001712
movups xmmword [rbp + 0x40], xmm6
movdqu xmmword [rbp + 0x50], xmm2
movdqa xmm0, xmmword [0x140005240]
movdqu xmmword [rsp + 0x70], xmm0
xor eax, eax
mov word [rsp + 0x60], ax
lea r8, [rbp + 0x40]
movq rcx, xmm6
psrldq xmm2, 8
movq rax, xmm2
cmp rax, r10
cmova r8, rcx
lea rdx, [rbp - 0x10]
cmp r9, r10
cmova rdx, qword [rbp - 0x10]
lea rcx, [r8 + rbx*2]
lea r8, [r12*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001819
sub r9, r12
cmp rbx, r9
ja 0x140001781
movups xmm2, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x40], xmm2
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x140005240]
movdqu xmmword [rbp], xmm1
xor eax, eax
mov word [rbp - 0x10], ax
movq rdi, xmm2
add rbx, rbx
lea rcx, [rdi + rbx]
lea r8, [r12*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rsp + 0x60]
movq rax, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rax
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001815
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rbx
cmp rax, r12
jb 0x140001a82
mov rax, r13
or rax, r10
cmp rax, rcx
ja 0x1400017b4
mov rcx, rax
mov edx, 0xa
cmp rax, rdx
cmovb rcx, rdx
mov qword [rbp + 0x60], rcx
lea rdx, [rbp + 0x60]
call fcn.140003a8c
mov rdi, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x58], rcx
lea rdx, [rsp + 0x60]
movq rcx, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rcx
add rbx, rbx
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbx + rdi]
lea r8, [r12*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0x68]
lea rax, [rbp - 0x70]
xor r12d, r12d
inc r15
cmp word [rax + r15*2], r12w
jne 0x140001820
mov r8, r15
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x40]
call fcn.1400033e8
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.1400033e8
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rcx, [rbp + 0x90]
call fcn.140003208
nop
lea rcx, [rbp + 0x40]
call fcn.140003208
nop
lea rcx, [rsp + 0x60]
call fcn.140003208
nop
lea rcx, [rbp + 0xb0]
call fcn.140003208
nop
lea rcx, [rbp + 0x70]
call fcn.140003208
nop
lea rcx, [rbp - 0x10]
call fcn.140003208
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r8, qword [rbp + 0x100]
mov dword [rbp + 0xd0], 0xb4b6b4b5
mov dword [rbp + 0xd4], 0xb4a0
mov byte [rbp + 0xd8], 1
mov rcx, r12
mov edx, 0x4b0e
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 + 0xd0], ax
inc rcx
cmp rcx, 3
jb 0x140001954
mov byte [rbp + 0xd8], r12b
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x1400019d7
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rcx, rbx
test eax, eax
je 0x1400019d1
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea rcx, [rbp + 0x100]
call fcn.140003208
nop
lea rcx, [rbp + 0xe0]
call fcn.140003208
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, r14
jbe 0x140001a39
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140001a34
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a7b
mov rcx, r8
call fcn.140003dc4
mov byte [rsi], r12b
mov qword [rsi + 0x18], r14
xor eax, eax
mov qword [rsi + 0x10], r12
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140003d60
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001164
nop