Function at 0x140001178
Capabilities:
Encode data using xor
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rsi, rcx
mov qword [rbp + 0xd0], rcx
xor r12d, r12d
mov dword [rbp - 0x58], 0xb861b860
mov dword [rbp - 0x54], 0xb87fb862
mov dword [rbp - 0x50], 0xb825b874
mov dword [rbp - 0x4c], 0xb87eb82c
mov dword [rbp - 0x48], 0xb845b853
mov dword [rbp - 0x44], 0xb845b847
mov word [rbp - 0x40], r12w
mov byte [rbp - 0x3e], 1
mov ebx, 0xb819
mov ecx, ebx
lea rdx, [rbp - 0x58]
lea r8d, [r12 + 6]
lea r13d, [r12 + 2]
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001208
mov byte [rbp - 0x3e], r12b
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
lea rcx, [rbp - 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r14, rax
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x38], 0xb869b879
mov dword [rbp - 0x34], 0xb835b873
mov dword [rbp - 0x30], 0xb878b868
mov dword [rbp - 0x2c], 0xb87ab872
mov dword [rbp - 0x28], 0xb853b847
mov dword [rbp - 0x24], 0xb84eb843
mov dword [rbp - 0x20], 0xb84ab80a
mov dword [rbp - 0x1c], 0xb840b854
mov word [rbp - 0x18], r12w
mov byte [rbp - 0x16], 1
mov rcx, rbx
lea rdx, [rbp - 0x38]
mov r8d, 8
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x1400012b4
mov byte [rbp - 0x16], r12b
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, [rbp - 0x38]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
mov qword [rbp + 0x68], rax
test rax, rax
jne 0x14000132c
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea r14d, [rdi + 0xf]
jmp 0x140001a04
movdqa xmm0, xmmword [0x1400052d0]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400052e0]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0x52080170
mov dword [rbp + 0x34], 0x87c725d
mov dword [rbp + 0x38], 0x2c303521
mov dword [rbp + 0x3c], 0x1007102
mov rcx, r12
lea eax, [rcx + 0x18]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 0x2e
jb 0x140001365
mov byte [rbp + 0x3f], r12b
mov dword [rsp + 0x40], 0x2f2c2a2f
mov dword [rsp + 0x44], 0x2d2f2c2e
mov dword [rsp + 0x48], 0x1001819
mov rcx, r12
mov edx, 0xa
lea eax, [rcx + 0x18]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, rdx
jb 0x140001399
mov byte [rsp + 0x4b], r12b
mov rcx, rsi
mov r14d, 0xf
cmp qword [rsi + 0x18], r14
jbe 0x1400013bf
mov rcx, qword [rsi]
mov r9, qword [rsi + 0x10]
add r9, rcx
mov rdx, rsi
cmp qword [rsi + 0x18], r14
jbe 0x1400013d2
mov rdx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
cmp rdx, r9
jne 0x14000140b
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r12w
jmp 0x14000141b
sub r9, rdx
lea rcx, [rbp + 0xe0]
call fcn.140003a90
nop
mov dword [rbp - 0x70], 0xb86db83e
mov dword [rbp - 0x6c], 0xb863b87f
mov dword [rbp - 0x68], 0xb820b868
mov word [rbp - 0x64], r12w
mov byte [rbp - 0x62], 1
mov rcx, rbx
lea rdx, [rbp - 0x70]
mov r8d, 3
lea rax, [rcx - 1]
movq xmm0, rcx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rdx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx], xmm1
add rcx, r13
lea rdx, [rdx + 4]
sub r8, 1
jne 0x140001446
mov byte [rbp - 0x62], r12b
lea rax, [rsp + 0x40]
or r15, 0xffffffffffffffff
mov r9, r15
inc r9
cmp byte [rax + r9], r12b
jne 0x140001495
lea rax, [rsp + 0x40]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rcx, [rsp + 0x40]
cmp rcx, rax
jne 0x1400014d3
movdqa xmm2, xmmword [0x140005240]
movdqu xmmword [rbp], xmm2
mov word [rbp - 0x10], r12w
jmp 0x1400014e9
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140003a90
movdqa xmm2, xmmword [0x140005240]
mov dword [rsp + 0x60], 0xb86ab837
mov dword [rsp + 0x64], 0xb875b87f
mov dword [rsp + 0x68], 0xb850b878
mov dword [rsp + 0x6c], 0xb86cb87b
mov dword [rsp + 0x70], 0xb840b853
mov dword [rsp + 0x74], 0xb846b845
mov dword [rsp + 0x78], 0xb846b81b
mov dword [rsp + 0x7c], 0xb846b84e
mov dword [rbp - 0x80], 0xb876b85c
mov dword [rbp - 0x7c], 0xb84fb843
mov dword [rbp - 0x78], 0xb811
mov byte [rbp - 0x74], 1
mov rcx, r12
mov edx, 0x47e8
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x60], ax
inc rcx
cmp rcx, 0x15
jb 0x14000154a
mov byte [rbp - 0x74], r12b
lea rax, [rbp + 0x10]
mov r9, r15
inc r9
cmp byte [rax + r9], r12b
jne 0x140001569
lea rax, [rbp + 0x10]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
lea rcx, [rbp + 0x10]
cmp rcx, rax
jne 0x1400015a3
movdqu xmmword [rbp + 0x80], xmm2
mov word [rbp + 0x70], r12w
jmp 0x1400015b1
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x70]
call fcn.140003a90
nop
mov dword [rsp + 0x50], 0xb87bb837
mov dword [rsp + 0x54], 0xb86fb875
mov word [rsp + 0x58], r12w
mov byte [rsp + 0x5a], 1
lea rcx, [rsp + 0x50]
mov rdx, r13
lea rax, [rbx - 1]
movq xmm0, rbx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rcx]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx], xmm1
add rbx, r13
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1400015d4
mov byte [rsp + 0x5a], r12b
lea r8, [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb0]
call fcn.140003630
nop
lea rcx, [rsp + 0x60]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r12w
jne 0x140001636
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400034bc
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x60], xmm6
movups xmm2, xmmword [rax + 0x10]
movdqu xmmword [rsp + 0x70], xmm2
mov qword [rax + 0x10], r12
mov r10d, 7
mov qword [rax + 0x18], r10
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
movq rbx, xmm2
mov r12, qword [rbp]
lea r13, [rbx + r12]
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rsp + 0x50], rcx
mov rax, rcx
sub rax, rbx
mov r9, qword [rbp + 8]
cmp r12, rax
ja 0x140001712
cmp r9, rcx
ja 0x140001712
movups xmmword [rbp + 0x40], xmm6
movdqu xmmword [rbp + 0x50], xmm2
movdqa xmm0, xmmword [0x140005240]
movdqu xmmword [rsp + 0x70], xmm0
xor eax, eax
mov word [rsp + 0x60], ax
lea r8, [rbp + 0x40]
movq rcx, xmm6
psrldq xmm2, 8
movq rax, xmm2
cmp rax, r10
cmova r8, rcx
lea rdx, [rbp - 0x10]
cmp r9, r10
cmova rdx, qword [rbp - 0x10]
lea rcx, [r8 + rbx*2]
lea r8, [r12*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001819
sub r9, r12
cmp rbx, r9
ja 0x140001781
movups xmm2, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x40], xmm2
movups xmm0, xmmword [rbp]
movups xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [0x140005240]
movdqu xmmword [rbp], xmm1
xor eax, eax
mov word [rbp - 0x10], ax
movq rdi, xmm2
add rbx, rbx
lea rcx, [rdi + rbx]
lea r8, [r12*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rsp + 0x60]
movq rax, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rax
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], r13
jmp 0x140001815
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rbx
cmp rax, r12
jb 0x140001a82
mov rax, r13
or rax, r10
cmp rax, rcx
ja 0x1400017b4
mov rcx, rax
mov edx, 0xa
cmp rax, rdx
cmovb rcx, rdx
mov qword [rbp + 0x60], rcx
lea rdx, [rbp + 0x60]
call fcn.140003b60
mov rdi, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], r13
mov rcx, qword [rbp + 0x60]
mov qword [rbp + 0x58], rcx
lea rdx, [rsp + 0x60]
movq rcx, xmm6
cmp qword [rsp + 0x50], 7
cmova rdx, rcx
add rbx, rbx
mov r8, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbx + rdi]
lea r8, [r12*2 + 2]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0x68]
lea rax, [rbp - 0x70]
xor r12d, r12d
inc r15
cmp word [rax + r15*2], r12w
jne 0x140001820
mov r8, r15
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x40]
call fcn.1400034bc
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.1400034bc
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rcx, [rbp + 0x90]
call fcn.1400032dc
nop
lea rcx, [rbp + 0x40]
call fcn.1400032dc
nop
lea rcx, [rsp + 0x60]
call fcn.1400032dc
nop
lea rcx, [rbp + 0xb0]
call fcn.1400032dc
nop
lea rcx, [rbp + 0x70]
call fcn.1400032dc
nop
lea rcx, [rbp - 0x10]
call fcn.1400032dc
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r8, qword [rbp + 0x100]
mov dword [rbp + 0xd0], 0xb85cb85f
mov dword [rbp + 0xd4], 0xb84e
mov byte [rbp + 0xd8], 1
mov rcx, r12
mov edx, 0x47e8
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 + 0xd0], ax
inc rcx
cmp rcx, 3
jb 0x140001954
mov byte [rbp + 0xd8], r12b
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
je 0x1400019d7
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov rcx, rbx
test eax, eax
je 0x1400019d1
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea rcx, [rbp + 0x100]
call fcn.1400032dc
nop
lea rcx, [rbp + 0xe0]
call fcn.1400032dc
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, r14
jbe 0x140001a39
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140001a34
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a7b
mov rcx, r8
call fcn.140003e94
mov byte [rsi], r12b
mov qword [rsi + 0x18], r14
xor eax, eax
mov qword [rsi + 0x10], r12
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140003e30
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001164
nop