Function at 0x180008650
Capabilities:
Check http status code
Prepare http request
Read and send data from client to server
Read file on windows
Read http header
Receive http response
Resolve function by parsing pe exports
Send data
Send http request
Set http header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1140
call fcn.180024010
sub rsp, rax
movaps xmmword [rsp + 0x1130], xmm6
movaps xmmword [rsp + 0x1120], xmm7
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1110], rax
mov r12, rcx
xor r15d, r15d
mov dword [rsp + 0xdc], r15d
mov dword [rsp + 0xec], 4
mov dword [rsp + 0xd8], r15d
mov dword [rsp + 0x9c], r15d
mov dword [rsp + 0xe4], r15d
mov dword [rsp + 0xe8], r15d
mov dword [rsp + 0xe0], r15d
mov qword [rsp + 0xc0], 0xffffffffffffffff
mov esi, r15d
mov qword [rsp + 0x70], r15
mov r13d, r15d
mov qword [rsp + 0x50], r15
mov ebx, r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0xc8], r15
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], r15
mov eax, r15d
mov edx, dword [rcx]
lea r8, [0x180033a00]
mov rcx, r8
cmp dword [rcx], edx
je 0x18000874a
inc eax
add rcx, 0x28
cmp eax, 3
jb 0x180008736
mov r14, r15
jmp 0x180008752
lea rcx, [rax + rax*4]
lea r14, [r8 + rcx*8]
mov rdx, qword [r12 + 0x48]
mov dword [rsp + 0x30], 0x60
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 0x120089
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ProcessHacker.exe_PhCreateFileWin32]
mov edi, eax
mov dword [rsp + 0x64], eax
test eax, eax
jns 0x1800087b3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov r8d, eax
lea rdx, str.Unable_to_open_the_file
mov rcx, r12
call fcn.180008150
jmp 0x180008f4f
xor r9d, r9d
movzx r8d, word [r14 + 0x10]
mov rdx, qword [r14 + 8]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rcx, rax
test rax, rax
jne 0x1800087ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Unable_to_connect_to_the_service
mov rcx, r12
call fcn.180008150
jmp 0x180008f4f
mov eax, dword [r14 + 0x14]
bts eax, 8
mov r8, qword [r12 + 0x60]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, qword [r8 + 8]
lea rdx, str.POST
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov r13, rax
test rax, rax
jne 0x180008838
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_create_the_request
jmp 0x180008f3f
cmp dword [r12], 0x66
jne 0x180008871
lea rcx, str.X_Requested_With:_XMLHttpRequest
call qword [sym.imp.ProcessHacker.exe_PhCreateString]
mov rbx, rax
mov r8d, dword [rax]
shr r8d, 1
mov r9d, 0x20000000
mov rdx, qword [rax + 8]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov edx, 0x104
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ProcessHacker.exe_PhInitializeStringBuilder]
mov edx, 0x104
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhInitializeStringBuilder]
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ProcessHacker.exe_PhInitializeStringBuilder]
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov ebx, eax
shl rbx, 0x1f
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_RtlRandomEx]
mov edx, eax
or rdx, rbx
lea rcx, str._________________________I64u
call qword [sym.imp.ProcessHacker.exe_PhFormatString]
mov rsi, rax
mov qword [rsp + 0x70], rax
mov r8, qword [rax + 8]
lea rdx, str.Content_Type:_multipart_form_data__boundary_s_r_n
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0xa0]
cmp dword [r12], 0x66
jne 0x18000898d
lea rdx, str._r_n___s_r_n
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
lea rdx, str.Content_Disposition:_form_data__name_MAX_FILE_SIZE__r_n_r_n268435456_r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
mov r8, qword [rsi + 8]
lea rdx, str.___s_r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
mov r9, qword [r12 + 0x50]
mov r9, qword [r9 + 8]
mov r8, qword [r14 + 0x20]
lea rdx, str.Content_Disposition:_form_data__name__s___filename__s__r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
lea rdx, str.Content_Type:_application_x_msdownload_r_n_r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
lea rdx, str._r_n___s___r_n
jmp 0x1800089d8
lea rdx, str.___s_r_n
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
mov r9, qword [r12 + 0x50]
mov r9, qword [r9 + 8]
mov r8, qword [r14 + 0x20]
lea rdx, str.Content_Disposition:_form_data__name__s___filename__s__r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
lea rdx, str.Content_Type:_application_octet_stream_r_n_r_n
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
lea rdx, str._r_n___s___r_n_r_n
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ProcessHacker.exe_PhAppendFormatStringBuilder]
mov r9d, 0xa0000000
or r8d, 0xffffffff
mov rdx, qword [rsp + 0xd0]
mov rdx, qword [rdx + 8]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x180008a2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Unable_to_add_request_headers
mov rcx, r12
call fcn.180008150
mov rbx, qword [rsp + 0x58]
jmp 0x180008f4a
mov rax, qword [rsp + 0xb8]
mov edx, dword [rax]
shr edx, 1
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rax]
shr ecx, 1
add edx, ecx
add edx, dword [r12 + 0x3c]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x180008a93
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Unable_to_send_the_request
mov rcx, r12
call fcn.180008150
mov rbx, qword [rsp + 0x58]
jmp 0x180008f4a
mov rax, qword [rsp + 0xa8]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhCountStringZ]
lea rdx, [rax + rax]
mov r8b, 0x2d
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhConvertUtf16ToAsciiEx]
mov r14, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rcx + 8]
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhCountStringZ]
lea rdx, [rax + rax]
mov r8b, 0x2d
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhConvertUtf16ToAsciiEx]
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ProcessHacker.exe_PhQuerySystemTime]
lea r9, [rsp + 0xe4]
mov r8d, dword [r14]
mov rdx, qword [r14 + 8]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
jne 0x180008b29
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_write_the_post_header
jmp 0x180008f3f
movss xmm7, dword [0x18002f930]
movabs r14, 0xd6bf94d5e57a42bd
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x1000
lea rax, [rsp + 0x110]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntdll.dll_NtReadFile]
mov edi, eax
mov dword [rsp + 0x64], eax
mov rcx, r13
test eax, eax
jns 0x180008f0c
lea r9, [rsp + 0xe8]
mov r8d, dword [rbx]
mov rdx, qword [rbx + 8]
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
jne 0x180008bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_write_the_post_footer
jmp 0x180008f3f
xor edx, edx
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x180008bda
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_receive_the_response
jmp 0x180008f3f
mov qword [rsp + 0x28], r15
lea rax, [rsp + 0xec]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xdc]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov eax, dword [rsp + 0xdc]
cmp eax, 0xc8
je 0x180008c2f
add eax, 0xfffffed2
cmp eax, 1
jbe 0x180008c2f
mov r8d, 0x80210001
lea rdx, str.Unable_to_complete_the_request
jmp 0x180008f42
mov ecx, dword [r12]
sub ecx, 0x65
je 0x180008e56
sub ecx, 1
je 0x180008ce6
cmp ecx, 1
jne 0x180008eca
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x80], r15d
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x90]
mov rcx, r13
call fcn.180008030
test eax, eax
jne 0x180008c8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_complete_the_CIMA_request
jmp 0x180008f3f
lea rdx, str.url
mov rcx, qword [rsp + 0x90]
call fcn.18000af5c
mov rbx, rax
test rax, rax
je 0x180008ec5
add rbx, 4
mov edx, 0x22
mov rcx, rbx
call fcn.18000aed0
test rax, rax
je 0x180008ec5
sub rax, rbx
mov r8, rbx
mov rdx, rax
lea rcx, str.http:__camas.comodo.com_.S
call qword [sym.imp.ProcessHacker.exe_PhFormatString]
mov qword [r12 + 0x68], rax
jmp 0x180008ec5
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x84], r15d
lea r8, [rsp + 0x84]
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.180008030
test eax, eax
jne 0x180008d1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_complete_the_request
jmp 0x180008f3f
mov rcx, qword [rsp + 0x78]
call fcn.180002510
mov rbx, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x180008ec5
mov rdi, r15
mov qword [rsp + 0x68], r15
cmp dword [rax], 4
je 0x180008d53
mov qword [rsp + 0x68], r15
mov eax, r15d
jmp 0x180008e12
mov rsi, qword [rax + 0x28]
lea rcx, str.redirecturl
call qword [rsi + 0x48]
mov ecx, dword [rsi]
xor edx, edx
div ecx
mov ebx, edx
mov dword [rsp + 0x60], edx
mov r14d, r15d
mov dword [rsp + 0x88], r15d
inc dword [rsi + 0x10]
nop dword [rax + rax]
cmp r14d, ecx
jge 0x180008df3
mov r13d, ebx
shl r13, 5
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax + r13]
cmp rcx, 0xffffffffffffffff
je 0x180008df3
cmp rcx, 0xfffffffffffffffe
je 0x180008dd4
lea rdx, str.redirecturl
call qword [rsi + 0x50]
test eax, eax
je 0x180008dd4
mov rax, qword [rsi + 0x38]
add rax, r13
je 0x180008df3
lea rcx, [rsp + 0x68]
test rcx, rcx
je 0x180008dcd
mov rax, qword [rax + 8]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x68]
mov eax, 1
jmp 0x180008e08
inc ebx
mov dword [rsp + 0x60], ebx
mov ecx, dword [rsi]
cmp ebx, ecx
cmove ebx, r15d
mov dword [rsp + 0x60], ebx
inc r14d
mov dword [rsp + 0x88], r14d
jmp 0x180008d80
lea rax, [rsp + 0x68]
test rax, rax
je 0x180008e05
mov qword [rax], r15
mov rdi, qword [rsp + 0x68]
mov eax, r15d
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
test eax, eax
je 0x180008e30
test rdi, rdi
je 0x180008e30
cmp dword [rdi], 6
je 0x180008e2a
mov rcx, rdi
call fcn.180001770
jmp 0x180008e33
mov rax, qword [rdi + 0x28]
jmp 0x180008e33
mov rax, r15
mov rdx, rax
lea rcx, str.http:__virusscan.jotti.org_hs
call qword [sym.imp.ProcessHacker.exe_PhFormatString]
mov qword [r12 + 0x68], rax
mov rcx, rbx
call fcn.1800015c0
mov edi, dword [rsp + 0x64]
jmp 0x180008ec5
mov dword [rsp + 0x9c], r15d
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea edx, [r8 + 0x22]
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
test eax, eax
jne 0x180008eca
mov edx, dword [rsp + 0x9c]
xor ecx, ecx
call qword [sym.imp.ProcessHacker.exe_PhCreateStringEx]
mov rbx, rax
lea r9, [rsp + 0x9c]
mov r8, qword [rax + 8]
mov edx, 0x22
mov rcx, r13
call qword [sym.imp.WINHTTP.dll_WinHttpQueryOption]
test eax, eax
je 0x180008ebc
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ProcessHacker.exe_PhCreateStringEx]
mov qword [r12 + 0x68], rax
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov rbx, qword [rsp + 0x58]
mov rax, qword [r12 + 0x68]
test rax, rax
je 0x180008eda
cmp qword [rax], 0
jne 0x180008ee0
mov r15d, 1
test r15b, r15b
jne 0x180008efd
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
mov rcx, qword [r12 + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x180008f4a
mov r8d, 0xd
lea rdx, str.Unable_to_complete_the_Launch_request__please_try_again_after_a_few_minutes_
jmp 0x180008f42
lea r9, [rsp + 0xe0]
mov r8d, dword [rsp + 0x108]
lea rdx, [rsp + 0x110]
call qword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
jne 0x180008fdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_upload_the_file_data
mov r8d, eax
mov rcx, r12
call fcn.180008150
mov r13, qword [rsp + 0x50]
test rsi, rsi
je 0x180008f5d
mov rcx, rsi
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
test rbx, rbx
je 0x180008f6b
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
test r13, r13
je 0x180008f79
mov rcx, r13
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
cmp qword [rsp + 0xb8], 0
je 0x180008f92
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ProcessHacker.exe_PhDeleteStringBuilder]
cmp qword [rsp + 0xa8], 0
je 0x180008fab
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ProcessHacker.exe_PhDeleteStringBuilder]
cmp qword [rsp + 0xd0], 0
je 0x180008fc4
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ProcessHacker.exe_PhDeleteStringBuilder]
mov rcx, qword [rsp + 0xc0]
cmp rcx, 0xffffffffffffffff
je 0x180008fd8
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
jmp 0x180009106
mov esi, dword [rsp + 0x9c]
add esi, dword [rsp + 0xe0]
mov dword [rsp + 0x9c], esi
mov dword [rsp + 0x98], esi
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ProcessHacker.exe_PhQuerySystemTime]
mov rcx, qword [rsp + 0xf0]
sub rcx, qword [rsp + 0xf8]
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov ecx, 1
cmp rdx, rcx
cmova rcx, rdx
xor edx, edx
mov eax, esi
div rcx
mov rbx, rax
mov ecx, dword [r12 + 0x3c]
mov edx, esi
xorps xmm6, xmm6
cvtsi2ss xmm6, rdx
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
divss xmm6, xmm0
mulss xmm6, xmm7
or edx, 0xffffffff
call qword [sym.imp.ProcessHacker.exe_PhFormatSize]
mov r14, rax
or edx, 0xffffffff
mov ecx, esi
call qword [sym.imp.ProcessHacker.exe_PhFormatSize]
mov rsi, rax
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhFormatSize]
mov rdi, rax
mov r9, qword [rax + 8]
mov r8, qword [r14 + 8]
mov rdx, qword [rsi + 8]
lea rcx, str._s_of__s____s_s
call qword [sym.imp.ProcessHacker.exe_PhFormatString]
mov rbx, rax
mov rdx, qword [rax + 8]
mov rcx, qword [r12 + 0x18]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cvttss2si ecx, xmm6
movsxd r8, ecx
xor r9d, r9d
mov edx, 0x402
mov rcx, qword [r12 + 0x20]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rbx
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov rcx, rdi
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov rcx, r14
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov rcx, rsi
call qword [sym.imp.ProcessHacker.exe_PhDereferenceObject]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x70]
jmp 0x180008b31
mov rcx, qword [rsp + 0x1110]
xor rcx, rsp
call fcn.18000a000
lea r11, [rsp + 0x1140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret