Function at 0x14000d020
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1238
call fcn.140110f10
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0x1220], rax
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x5d0], r8
mov qword [rsp + 0x48], rdx
mov r14, rcx
mov dword [rsp + 0x44], 0xffffffff
cmp dword [rcx + 0x568], 0
je 0x14000d083
or eax, 0xffffffff
jmp 0x14000d5f5
call fcn.14002e530
mov rcx, rax
or r8d, 0xffffffff
lea rdx, [rsp + 0x58]
call fcn.14002c200
test eax, eax
je 0x14000d5f1
mov edx, 1
lea rcx, [0x1401890b0]
call fcn.140008170
mov byte [rsp + 0x5e0], 0x31
mov byte [rsp + 0x5e1], 0x62
mov byte [rsp + 0x5e2], 0x33
mov byte [rsp + 0x5e3], 0x30
mov byte [rsp + 0x5e4], 0x34
mov byte [rsp + 0x5e5], 0x63
mov byte [rsp + 0x5e6], 0x37
mov byte [rsp + 0x5e7], 0x61
mov byte [rsp + 0x5e8], 0x32
mov byte [rsp + 0x5e9], 0x64
mov byte [rsp + 0x5ea], 0x30
mov byte [rsp + 0x5eb], 0x30
mov byte [rsp + 0x5ec], 0x34
mov byte [rsp + 0x5ed], 0x37
mov byte [rsp + 0x5ee], 0x31
mov byte [rsp + 0x5ef], 0x30
mov byte [rsp + 0x5f0], 0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, qword [r14 + 0x578]
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx + 0xf]
and edi, 0xfffffff0
lea rax, [0x140141ef8]
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x158], 0
mov dword [rsp + 0x20], SafeArrayGetUBound
mov r9d, SafeArrayGetUBound
lea r8, [0x140141ec8]
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x150]
call fcn.140021da0
movsxd rbp, edi
mov rdi, qword [r14 + 0x578]
xor ebx, ebx
mov rsi, rdi
movsxd rcx, dword [rsp + 0x520]
xor edx, edx
mov rax, rbp
div rcx
test eax, eax
jle 0x14000d1f0
nop
nop
nop
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x150]
call fcn.140022640
movsxd rcx, dword [rsp + 0x520]
add rdi, rcx
add rsi, rcx
add ebx, 1
xor edx, edx
mov rax, rbp
div rcx
cmp ebx, eax
jl 0x14000d1c0
lea rcx, str.wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r13, rax
test rax, rax
je 0x14000d5e3
lea rdx, str.InternetOpenA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea rdx, str.HttpOpenRequestA
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.InternetConnectA
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.HttpSendRequestA
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x68], rax
lea rdx, str.InternetCloseHandle
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.InternetReadFile
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
test rdi, rdi
je 0x14000d5da
test rsi, rsi
je 0x14000d5da
test r12, r12
je 0x14000d5da
test rbx, rbx
je 0x14000d5da
test r15, r15
je 0x14000d5da
test rax, rax
je 0x14000d5da
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140134728]
call rdi
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000d5d4
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 3
lea r9, str.toto
mov qword [rsp + 0x20], r9
mov r8w, 0x50
lea rdx, str.valid.canardpc.com
mov rcx, rax
call rbx
mov r15, rax
test rax, rax
je 0x14000d5c7
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x80000000
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.index.php
lea rdx, str.POST
mov rcx, r15
call r12
mov r12, rax
test rax, rax
je 0x14000d5ba
mov ecx, 0x1000
call fcn.1400d8d48
mov rbx, rax
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x100
lea rax, [rsp + 0x720]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x100
lea rax, [rsp + 0x620]
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, qword [rsp + 0x5d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rsp + 0x620]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x720]
lea r8, str.user_name_suser_email_sraw_cvf
mov edx, 0x1000
mov rcx, rbx
call fcn.1400f0e70
test rbp, rbp
jle 0x14000d453
nop
nop
nop
mov rax, qword [r14 + 0x578]
movzx r9d, byte [rax + rdi]
lea r8, str._02x
mov edx, 8
lea rcx, [rsp + 0x5d0]
call fcn.1400f0e70
lea r8, [rsp + 0x5d0]
mov edx, 0x1000
mov rcx, rbx
call fcn.1400f0ea0
add rdi, 1
cmp rdi, rbp
jl 0x14000d410
xor r9d, r9d
cmp dword [rsp + 0x40], 1
sete r9b
lea r8, str.publish_dsendok
mov edx, 0x40
lea rcx, [rsp + 0x5e0]
call fcn.1400f0e70
lea r8, [rsp + 0x5e0]
mov edx, 0x1000
mov rcx, rbx
call fcn.1400f0ea0
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov dword [rsp + 0x20], ecx
mov r9, rbx
or r8d, 0xffffffff
lea rdx, str.Content_Type:_application_x_www_form_urlencoded__charsetutf_8
mov rcx, r12
call qword [rsp + 0x68]
test eax, eax
je 0x14000d5a0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0xa20]
call fcn.1400f1600
mov dword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
mov r8d, 0x800
lea rdx, [rsp + 0xa20]
mov rcx, r12
call qword [rsp + 0x60]
test eax, eax
je 0x14000d5a6
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000d5a6
mov byte [rsp + rax + 0xa20], 0
mov dword [rsp + 0x44], 0x63
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x44]
lea rdx, str._d__d
lea rcx, [rsp + 0xa20]
call fcn.1400f0800
test eax, eax
je 0x14000d5a6
cmp dword [rsp + 0x44], 0
jne 0x14000d5a6
mov r9d, dword [rsp + 0x48]
mov dword [0x14018961c], r9d
lea r8, str.http:__valid.canardpc.com_show_oc.php_id_d
mov edx, 0x100
lea rcx, [rsp + 0x820]
call fcn.14002c2d0
lea rcx, [rsp + 0x80]
call fcn.1400143e0
mov r8d, 5
lea rdx, [rsp + 0x820]
lea rcx, [rsp + 0x80]
call fcn.140014960
lea rcx, [rsp + 0x80]
call fcn.140014600
jmp 0x14000d5a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.1400d8d50
mov rcx, r12
call rsi
mov rdi, qword [rsp + 0x50]
jmp 0x14000d5c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
call rsi
jmp 0x14000d5cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call rsi
jmp 0x14000d5da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.14002e530
mov rcx, rax
call fcn.14002baf0
nop
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x1220]
xor rcx, rsp
call fcn.1400efff0
add rsp, 0x1238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret