Function at 0x14000f4a0
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5e0]
sub rsp, 0x6e0
movaps xmmword [rsp + 0x6d0], xmm6
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x20], r8
xor r12d, r12d
mov rcx, qword [r8 + 0x10]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x140010139
mov rax, r8
cmp qword [r8 + 0x18], 7
jbe 0x14000f51b
mov rax, qword [r8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x140092e98]
lea rcx, [rbp + 0x78]
call fcn.140027860
nop
lea rdx, [rbp + 0x78]
mov rcx, rsi
call fcn.140024350
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000f58f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f58a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010175
call fcn.140054120
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x14000f5a6
mov rcx, qword [rsi]
mov rdx, rcx
lea r8, [rcx + rax*2]
jmp 0x14000f5ad
mov rdx, rsi
lea r8, [rsi + rax*2]
lea rcx, [rbp + 0x38]
call fcn.1400255c0
nop
lea rdi, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rdi, qword [rbp + 0x38]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.http_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r13, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14000f726
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000f630
mov rcx, qword [rbp + 0x38]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f62b
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010175
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000f681
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000f67c
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001017b
mov rcx, r8
call fcn.140054120
mov word [rsi], r12w
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r12
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000f6d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14000f6cb
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001012d
mov rcx, r8
call fcn.140054120
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000f71f
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x14000f71a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010133
mov rcx, r8
call fcn.140054120
xor eax, eax
jmp 0x1400100eb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
mov dword [rbp - 0x68], 0x68
mov dword [rbp - 0x58], 0xffffffff
mov dword [rbp - 0x48], 0xffffffff
mov dword [rbp - 0x18], 0xffffffff
mov dword [rbp - 8], 0xffffffff
lea r9, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
lea rdx, [rbp - 0x68]
test eax, eax
cmove rdx, qword [rbp + 0x20]
movups xmm0, xmmword [rdx]
movaps xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rdx + 0x20]
movaps xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [rdx + 0x30]
movaps xmmword [rbp + 0x170], xmm1
movups xmm6, xmmword [rdx + 0x40]
movups xmm0, xmmword [rdx + 0x50]
movaps xmmword [rbp + 0x190], xmm0
movsd xmm1, qword [rdx + 0x60]
movsd qword [rbp + 0x1a0], xmm1
mov rcx, rdi
call fcn.140004840
lea rdx, [0x1400a6110]
mov rax, qword [0x1400a6120]
cmp qword [0x1400a6128], 7
jbe 0x14000f7f5
mov rdx, qword [0x1400a6110]
lea r8, [rdx + rax*2]
lea rcx, [rbp + 0x58]
call fcn.1400255c0
nop
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova rdx, qword [rbp + 0x58]
mov r8d, 0x1bb
xor r9d, r9d
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x14000f884
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14000f86d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000f868
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001016f
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r12w
jmp 0x14000f5f0
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
psrldq xmm6, 8
movq r8, xmm6
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov r13, rax
test rax, rax
je 0x14000f82d
mov dword [rsp + 0x44], 0x3300
mov r9d, 4
lea r8, [rsp + 0x44]
lea edx, [r9 + 0x1b]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rax, qword [r15 + 0x10]
sub rbx, rax
cmp rbx, 1
jb 0x14001013f
mov r9, r15
cmp qword [r15 + 0x18], 7
jbe 0x14000f8fd
mov r9, qword [r15]
mov qword [rsp + 0x30], 1
lea rcx, [0x140092c50]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x78]
call fcn.140027860
nop
mov rdx, r14
lea rcx, [rbp + 0x78]
call fcn.140024350
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000f9aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010145
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0x88], xmm0
mov word [rbp + 0x78], r12w
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova rcx, qword [rbp + 0x98]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000fd52
xor edx, edx
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000fd52
mov dword [rsp + 0x40], r12d
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rbp + 0x1c0]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000fd4f
xor edi, edi
nop dword [rax]
cmp dword [rsp + 0x40], 0
jbe 0x14000fd4f
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8d, 0x400
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
add r12d, 1
lea r9, [rbp + 0xcd]
jns 0x14000fae2
mov ecx, r12d
neg ecx
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov ecx, edx
test edx, edx
jne 0x14000fab0
dec r9
mov byte [r9], reloc.Cabinet.dll_CloseDecompressor
jmp 0x14000fb1a
mov r8d, r12d
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14000faf0
lea r8, [rbp + 0xcd]
mov rdx, r9
lea rcx, [rbp + 0x118]
call fcn.140027f90
nop
mov r9d, recv
lea r8, str.RBNUPSTATE_
lea rcx, [rbp + 0x118]
call fcn.140027c80
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rdi
mov qword [rbp + 0x110], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x108], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x14000fbc7
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fbc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010151
call fcn.140054120
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x130], recv
mov byte [rbp + 0x118], 0
mov rax, qword [0x1400a6130]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x10]
lea rax, [rbp]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0xf8]
lea rcx, [rbp]
call fcn.140003a00
mov rbx, rax
lea rcx, [rbp + 0x140]
call fcn.140021a50
nop
lea r8, [0x1400a60b0]
cmp qword [0x1400a60c8], 7
cmova r8, qword [0x1400a60b0]
mov rax, qword [0x1400a60c0]
lea r9, [r8 + rax*2]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x140]
call fcn.140023880
nop
lea rcx, [rbp + 0x140]
call fcn.140021960
nop
mov r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0xb8]
call fcn.140004040
nop
mov rdx, rax
mov rcx, qword [0x1400a6130]
call rdi
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x14000fcbb
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010157
call fcn.140054120
xor edi, edi
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd0], recv
mov byte [rbp + 0xb8], dil
mov rcx, qword [0x1400a6130]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0xf
jbe 0x14000fd27
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fd22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001015d
call fcn.140054120
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rbp + 0x1c0]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rbx, qword [rsp + 0x48]
test eax, eax
jne 0x14000fa70
xor r12d, r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
mov ecx, CloseCompressor
call fcn.140054128
mov rdx, rax
mov qword [rbp + 0xd8], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_socket]
movdqu xmmword [rbp + 0xe8], xmm0
movups xmm1, xmmword [str.RBNUPLOADDOWNCOMPLETE_]
movups xmmword [rax], xmm1
mov ecx, dword [0x140093308]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14009330c]
mov word [rax + 0x14], cx
movzx eax, byte [0x14009330e]
mov byte [rdx + 0x16], al
mov byte [rdx + 0x17], 0
mov rax, qword [0x1400a6130]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x10]
lea rax, [rbp]
mov qword [rsp + 0x70], rax
lea rdx, [rbp + 0xd8]
lea rcx, [rbp]
call fcn.140003a00
mov rbx, rax
lea rcx, [rbp + 0x140]
call fcn.140021a50
nop
cmp qword [0x1400a60c8], 7
lea rcx, [0x1400a60b0]
cmova rcx, qword [0x1400a60b0]
mov rax, qword [0x1400a60c0]
lea r9, [rcx + rax*2]
mov r8, rcx
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x140]
call fcn.140023880
nop
lea rcx, [rbp + 0x140]
call fcn.140021960
nop
mov r8, rbx
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x78]
call fcn.140004040
nop
mov rdx, rax
mov rcx, qword [0x1400a6130]
call rdi
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x14000feb8
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000feb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001014b
call fcn.140054120
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x14000fef9
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fef4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010163
call fcn.140054120
movdqa xmm0, xmmword [0x140094730]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14000ff56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010169
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0xa8], xmm0
mov word [rbp + 0x98], r12w
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14000ffae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001016f
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0x68], xmm0
mov word [rbp + 0x58], r12w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140010000
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fffb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010175
call fcn.140054120
movdqa xmm0, xmmword [0x140094720]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x140010051
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001004c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001017b
mov rcx, r8
call fcn.140054120
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x1400100a0
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001009b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001012d
mov rcx, r8
call fcn.140054120
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 7
mov word [r15], r12w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x1400100eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1400100e6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010133
mov rcx, r8
call fcn.140054120
mov word [r14], r12w
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], r12
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.140054100
mov rbx, qword [rsp + 0x738]
movaps xmm6, xmmword [rsp + 0x6d0]
add rsp, 0x6e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
int3
call fcn.14006a6c0
nop
call fcn.14006a6c0
int3
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
int3