Function at 0x1401cb840
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference cloudflare dns server
Set http header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
movzx ebx, r8w
mov qword [rbp - 0x10], rdi
mov r15, rdx
mov rsi, rcx
call fcn.1401cb580
test al, al
jne 0x1401cb876
xor eax, eax
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword ss:[rsp + 0xa0], r12
mov r12d, 1
mov qword [rsp + 0xa8], r13
mov qword [rsp + 0xb0], r14
lock xadd word [0x1402cb2b8], r12w
mov rcx, qword [0x1402caaf0]
mov r13d, 4
mov edx, r13d
mov dword [rbp + 0x48], 0x1000
mov r8d, 0x1000
inc r12w
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x28], 1
lea rdx, [rbp + 0x48]
mov r14, rax
mov word [rsp + 0x20], r12w
mov rcx, rax
movzx r9d, bx
mov rax, qword [0x1402cebd8]
mov r8, r15
call qword [case.0x14013d84a.0]
test eax, eax
setne cl
test eax, eax
jne 0x1401cb957
mov rcx, qword [0x1402caaf0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword ds:[rbp + 0x48]
mov edx, r13d
mov rcx, qword [0x1402caaf0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [rsp + 0x28], 1
lea rdx, [rbp + 0x48]
mov r14, rax
mov word [rsp + 0x20], r12w
mov rcx, rax
movzx r9d, bx
mov rax, qword [0x1402cebd8]
mov r8, r15
call qword [case.0x14013d84a.0]
test eax, eax
setne cl
test cl, cl
je 0x1401cbc9d
test byte [0x1402c6f30], 1
lea rbx, str.1.1.1.1
mov r15d, dword [rbp + 0x48]
jne 0x1401cbae5
lock bts qword [0x1402c6f30], 0x1f
setb al
test al, al
je 0x1401cb9aa
test byte [0x1402c6f30], 1
jne 0x1401cbae5
xor edx, edx
lea rcx, [0x1402c6f30]
call sym.SystemInformer.exe_PhfWaitForEvent
jmp 0x1401cbae5
cmp dword [0x1402bff40], 0x3f
mov edx, edi
mov dword [rsp + 0x20], edi
cmovae edx, r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x1402cebf0], rax
test rax, rax
je 0x1401cbad6
cmp dword [0x1402bff40], 0x3f
mov r9d, r13d
mov edx, 0x54
mov rcx, rax
jae 0x1401cb9fd
mov dword [rbp - 0x30], 0xa00
lea r8, [rbp - 0x30]
jmp 0x1401cba7f
lea r8, [rbp - 0x2c]
mov dword [rbp - 0x2c], 0x2800
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x1402cebf0]
lea r8, [rbp - 0x28]
mov r9d, r13d
mov dword [rbp - 0x28], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
cmp eax, 0x64
jb 0x1401cba5f
mov rcx, qword [0x1402cebf0]
lea r8, [rbp - 0x20]
mov r9d, r13d
mov dword [rbp - 0x20], 1
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [0x1402bff40]
nop
cmp eax, 0x72
jb 0x1401cba86
mov rcx, qword [0x1402cebf0]
lea r8, [rbp - 0x18]
mov dword [rbp - 0x18], 1
mov r9d, r13d
mov edx, 0xc3
nop
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x1402cebf0]
lea r8, [rbp - 0x14]
mov r9d, r13d
mov dword [rbp - 0x14], 1
mov edx, 0x49
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x1402bff40], 0x64
jb 0x1401cbad6
mov rcx, qword [0x1402cebf0]
test rsi, rsi
mov rdx, rbx
mov r8d, 0x1bb
cmovne rdx, rsi
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x1402cebf8], rax
lea rcx, [0x1402c6f30]
nop dword [rax]
call sym.SystemInformer.exe_PhfSetEvent
cmp dword [0x1402bff40], 0x64
jae 0x1401cbb17
mov rcx, qword [0x1402cebf0]
test rsi, rsi
mov r8d, 0x1bb
cmovne rbx, rsi
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x1402cebf8], rax
jmp 0x1401cbb1e
mov rax, qword [0x1402cebf8]
nop
test rax, rax
je 0x1401cbc9d
lea rcx, str.application_dns_message
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rcx
lea r8, str._dns_query
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea rdx, str.POST
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1401cbc9d
mov r9d, 0xa0000000
lea rdx, str.Content_Type:_application_dns_message
mov r8d, 0xffffffff
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [0x1402bff40], 0x3e
ja 0x1401cbbab
mov r9d, r13d
mov dword [rbp - 0x14], 0x1000
lea r8, [rbp - 0x14]
mov edx, 0x1f
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov qword [rsp + 0x30], rdi
mov r9, r14
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1401cbc73
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop
test eax, eax
je 0x1401cbc73
lea r8, [rbp - 0x18]
mov rcx, rsi
lea rdx, [rbp - 0x10]
call sym.SystemInformer.exe_PhHttpSocketReadDataToBuffer
test al, al
je 0x1401cbc73
mov edx, dword [rbp - 0x18]
mov qword [rbp - 0x20], rdi
cmp edx, 0xffff
ja 0x1401cbc73
mov rbx, qword [rbp - 0x10]
movzx eax, word [rbx + 4]
movzx ecx, word [rbx]
ror ax, 8
mov word [rbx + 4], ax
movzx eax, word [rbx + 6]
ror ax, 8
mov word [rbx + 6], ax
movzx eax, word [rbx + 8]
ror ax, 8
mov word [rbx + 8], ax
movzx eax, word [rbx + 0xa]
ror ax, 8
ror cx, 8
mov word [rbx], cx
mov word [rbx + 0xa], ax
cmp cx, r12w
jne 0x1401cbc77
mov rax, qword [0x1402cebe0]
lea r8, ds:[rbp - 0x20]
mov rcx, rbx
call qword [case.0x14013d84a.0]
mov rax, qword [rbp - 0x20]
test rax, rax
cmovne rdi, rax
jmp 0x1401cbc77
mov rbx, qword [rbp - 0x10]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rbx, rbx
je 0x1401cbc9d
mov rcx, qword [0x1402caaf0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
test r14, r14
je 0x1401cbcb7
mov rcx, qword [0x1402caaf0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r14, qword [rsp + 0xb0]
mov rax, rdi
mov r13, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret