Function at 0x14014ed80
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference cloudflare dns server
Set http header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
movzx ebx, r8w
mov qword [rbp - 0x18], r12
mov r15, rdx
mov qword [rbp - 0x40], r12
mov rsi, rcx
mov edi, 1
lock xadd word [0x1402177fc], di
inc di
call fcn.140136d20
test rax, rax
je 0x14014f224
mov rcx, qword [0x140213cd0]
mov r8d, 0x1000
mov qword [rsp + 0xb0], r13
mov r13d, 4
mov edx, r13d
mov qword [rsp + 0xb8], r14
mov dword [rbp + 0x48], 0x1000
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
call fcn.140136d20
movzx r9d, bx
mov dword [rsp + 0x28], 1
mov r8, r15
mov word [rsp + 0x20], di
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [case.0x140101f48.0]
test eax, eax
setne cl
test eax, eax
jne 0x14014ee8c
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x48]
mov edx, r13d
mov rcx, qword [0x140213cd0]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
call fcn.140136d20
movzx r9d, bx
mov dword [rsp + 0x28], 1
mov r8, r15
mov word [rsp + 0x20], di
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [case.0x140101f48.0]
test eax, eax
setne cl
test cl, cl
je 0x14014f207
test byte [0x1402115b8], 1
lea rbx, str.1.1.1.1
mov eax, dword [rbp + 0x48]
mov dword [rbp - 0x20], eax
jne 0x14014efe5
lock bts qword [0x1402115b8], 0x1f
jae 0x14014eeda
test byte [0x1402115b8], 1
jne 0x14014efe5
xor edx, edx
lea rcx, [0x1402115b8]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x14014efe5
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
mov edx, r12d
mov dword [rsp + 0x20], r12d
cmovae edx, r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x140217818], rax
test rax, rax
je 0x14014efd6
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
mov r9d, r13d
mov edx, 0x54
mov rcx, rax
jae 0x14014ef2c
mov dword [rbp - 0x38], 0xa00
lea r8, [rbp - 0x38]
jmp 0x14014ef80
lea r8, [rbp - 0x34]
mov dword [rbp - 0x34], 0x2a00
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x140217818]
lea r8, [rbp - 0x30]
mov r9d, r13d
mov dword [rbp - 0x30], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x14014ef86
mov rcx, qword [0x140217818]
lea r8, [rbp - 0x2c]
mov dword [rbp - 0x2c], 1
mov r9d, r13d
mov edx, 0x85
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x140217818]
lea r8, [rbp - 0x28]
mov r9d, r13d
mov dword [rbp - 0x28], 1
mov edx, 0x49
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jb 0x14014efd6
mov rcx, qword [0x140217818]
test rsi, rsi
mov rdx, rbx
mov r8d, 0x1bb
cmovne rdx, rsi
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x140217810], rax
lea rcx, [0x1402115b8]
nop dword [rax]
call sym.ProcessHacker.exe_PhfSetEvent
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jae 0x14014f017
mov rcx, qword [0x140217818]
test rsi, rsi
mov r8d, 0x1bb
cmovne rbx, rsi
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x140217810], rax
jmp 0x14014f01e
mov rax, qword [0x140217810]
nop
test rax, rax
je 0x14014f1c2
mov dword [rsp + 0x30], 0x800000
lea r8, str._dns_query
mov qword [rsp + 0x28], r12
lea rdx, str.POST
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x14014f1c2
mov r9d, 0xa0000000
lea rdx, str.Content_Type:_application_dns_message
mov r8d, 0xffffffff
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
ja 0x14014f0ab
mov r9d, r13d
mov dword [rbp - 0x24], 0x1000
lea r8, [rbp - 0x24]
mov edx, 0x1f
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [rbp - 0x20]
mov r9, r14
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14014f197
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop
test eax, eax
je 0x14014f197
lea r8, [rbp - 0x1c]
mov rcx, rsi
lea rdx, [rbp - 0x18]
call sym.ProcessHacker.exe_PhHttpSocketReadDataToBuffer
nop dword [rax + rax]
test al, al
je 0x14014f197
mov qword [rbp - 0x10], r12
call fcn.140136bf0
test rax, rax
je 0x14014f197
mov r15d, dword ds:[rbp - 0x1c]
cmp r15d, 0xffff
ja 0x14014f197
mov rbx, qword [rbp - 0x18]
movzx eax, word [rbx + 4]
movzx ecx, word [rbx]
ror ax, 8
mov word [rbx + 4], ax
movzx eax, word [rbx + 6]
ror ax, 8
mov word [rbx + 6], ax
movzx eax, word [rbx + 8]
ror ax, 8
mov word [rbx + 8], ax
movzx eax, word [rbx + 0xa]
ror ax, 8
ror cx, 8
mov word [rbx], cx
mov word [rbx + 0xa], ax
cmp cx, di
jne 0x14014f19b
call fcn.140136bf0
lea r8, ds:[rbp - 0x10]
movzx edx, r15w
mov rcx, rbx
call qword [case.0x140101f48.0]
mov rax, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x40]
test rax, rax
cmovne rdi, rax
jmp 0x14014f19f
mov rbx, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rbx, rbx
je 0x14014f1c6
mov rcx, qword [0x140213cd0]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x14014f1c6
mov rdi, qword [rbp - 0x40]
test r14, r14
je 0x14014f1dd
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, rdi
mov r13, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14, r14
je 0x14014f21e
mov rcx, qword [0x140213cd0]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [rbp - 0x40]
jmp 0x14014f1e0
mov rax, qword [rbp - 0x40]
jmp 0x14014f1f0