Function at 0x140078240
Capabilities:
Encode data using xor
Initialize winhttp library
Reference http user-agent string

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x140136210]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0xd8], rcx
mov qword [r11 - 0xe0], rdx
xor ebx, ebx
mov qword [r11 - 0x78], rbx
lea rax, [0x14011ba60]
mov qword [r11 - 0x88], rax
lea r15, str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__Trident_5.0_
mov qword [r11 - 0x80], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
movdqa xmm1, xmmword [0x14011da60]
movdqu xmmword [rsp + 0x108], xmm1
mov byte [rsp + 0xf8], bl
lea rcx, [rsp + 0x68]
call fcn.1400725f0
mov r14, rax
lea r12, [0x14018c9d0]
cmp r12, rax
je 0x14007835c
mov rdx, qword [0x14018c9e8]
cmp rdx, 0x10
jb 0x14007831c
mov rcx, qword [0x14018c9d0]
inc rdx
cmp rdx, 0x1000
jb 0x140078317
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f07
mov rcx, r8
call fcn.1400a7470
mov qword [0x14018c9e0], rbx
mov qword [0x14018c9e8], 0xf
mov byte [0x14018c9d0], 0
movups xmm0, xmmword [r14]
movaps xmmword [0x14018c9d0], xmm0
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [0x14018c9e0], xmm1
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14007839c
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078397
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f07
call fcn.1400a7470
cmp qword [0x14018c9e0], 1
jae 0x14007858f
mov eax, dword [0x14011d7bc]
mov dword [rsp + 0x40], eax
movzx ecx, word [0x14011d7c0]
mov word [rsp + 0x44], cx
movzx eax, byte [0x14011d7c2]
mov byte [rsp + 0x40], 0x42
xor byte [rsp + 0x41], 0x3a
xor byte [rsp + 0x42], 0x3b
xor byte [rsp + 0x43], 0x3c
xor cl, 0x3d
mov byte [rsp + 0x44], cl
xor byte [rsp + 0x45], 0x3e
xor al, 0x3f
mov byte [rsp + 0x46], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov r8d, 3
lea rdx, [0x14011c274]
lea rcx, [rsp + 0x138]
call fcn.14000efc0
nop
lea rdx, [rsp + 0x138]
lea rcx, [0x14018c928]
call fcn.140068520
lea rcx, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x140078440
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14000c750
nop
mov rdx, qword [rsp + 0x150]
cmp rdx, 0x10
jb 0x14007849c
inc rdx
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078496
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f0d
call fcn.1400a7470
nop
mov rdx, qword [rsp + 0x110]
cmp rdx, 0x10
jb 0x1400784df
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400784da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f4f
call fcn.1400a7470
movdqa xmm0, xmmword [0x14011da60]
movdqu xmmword [rsp + 0x108], xmm0
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140078532
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14007852d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f19
mov rcx, r8
call fcn.1400a7470
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14007857b
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140078576
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f1f
mov rcx, r8
call fcn.1400a7470
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x140078ed9
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x138], rax
test rax, rax
jne 0x1400786a8
mov rdx, qword [rsp + 0x110]
cmp rdx, 0x10
jb 0x1400785f8
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400785f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f4f
call fcn.1400a7470
movdqa xmm0, xmmword [0x14011da60]
movdqu xmmword [rsp + 0x108], xmm0
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14007864b
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140078646
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f19
mov rcx, r8
call fcn.1400a7470
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140078694
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14007868f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f1f
mov rcx, r8
call fcn.1400a7470
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x140078ed9
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.140009f60
mov r14, rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x88], rax
lea rdx, [0x14018c9f0]
lea rcx, [rsp + 0x118]
call fcn.140009f60
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov r8d, 9
lea rdx, str.resethwid
lea rcx, [rsp + 0x48]
call fcn.14000efc0
nop
mov r9, r14
mov r8, r15
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.1400067a0
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x14007873b
mov r9, qword [rax]
mov dword [rsp + 0x40], 0x100c493
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140078750
mov byte [rsp + 0x43], 0
lea r8, [rsp + 0x40]
lea rdx, str.command
lea rcx, [rsp + 0xf8]
call fcn.14005a2d0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1400787bf
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400787ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f13
call fcn.1400a7470
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.140009f60
mov r15, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x88], rax
lea rdx, [0x14018c9f0]
lea rcx, [rsp + 0x48]
call fcn.140009f60
mov r14, rax
mov rdx, rsi
lea rcx, [rsp + 0x118]
call fcn.140009f60
nop
mov r9, r15
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400067a0
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x140078834
mov r9, qword [rax]
mov dword [rsp + 0x40], 0x100c493
mov rcx, rbx
nop
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140078840
mov byte [rsp + 0x43], 0
lea r8, [rsp + 0x40]
lea rdx, str.username
lea rcx, [rsp + 0xf8]
call fcn.14005a2d0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1400788af
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400788aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f25
call fcn.1400a7470
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.140009f60
mov r15, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x88], rax
lea rdx, [0x14018c9f0]
lea rcx, [rsp + 0x48]
call fcn.140009f60
mov r14, rax
mov rdx, rdi
lea rcx, [rsp + 0x118]
call fcn.140009f60
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.140006250
nop
mov r9, r15
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400067a0
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x140078934
mov r9, qword [rax]
mov dword [rsp + 0x40], 0x100c493
mov rcx, rbx
nop
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140078940
mov byte [rsp + 0x43], 0
lea r8, [rsp + 0x40]
lea rdx, str.password
lea rcx, [rsp + 0xf8]
call fcn.14005a2d0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x1400789af
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400789aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f2b
call fcn.1400a7470
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x90], rax
mov rdx, r12
lea rcx, [rsp + 0xc8]
call fcn.140009f60
mov r15, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x88], rax
lea rdx, [0x14018c9f0]
lea rcx, [rsp + 0xa0]
call fcn.140009f60
mov r14, rax
lea rdx, [0x14018ca10]
lea rcx, [rsp + 0x48]
call fcn.140009f60
nop
mov r9, r15
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400067a0
mov r9, rax
cmp qword [rax + 0x18], 0x10
jb 0x140078a2b
mov r9, qword [rax]
mov dword [rsp + 0x40], 0x100c493
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140078a40
mov byte [rsp + 0x43], 0
lea r8, [rsp + 0x40]
lea rdx, str.token
lea rcx, [rsp + 0xf8]
call fcn.14005a2d0
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x140078aaf
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078aaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f31
call fcn.1400a7470
cmp qword [0x14018c9e8], 0x10
cmovae r12, qword [0x14018c9d0]
mov dword [rsp + 0x40], 0x100c493
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x4a]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 2
jb 0x140078ad0
mov byte [rsp + 0x43], 0
mov r9, r12
lea r8, [rsp + 0x40]
lea rdx, [0x14011c56c]
lea rcx, [rsp + 0xf8]
call fcn.14005a2d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x158], xmm0
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], 0xf
mov byte [rsp + 0x158], 0
xor eax, eax
movups xmmword [rsp + 0x178], xmm0
mov qword [rsp + 0x188], rax
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea r8d, [rax + 0x1b]
lea rdx, str.Authorization:_PUBLIC_TOKEN
lea rcx, [rsp + 0x68]
call fcn.14005b450
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x178]
call fcn.14007d320
nop
lea r9, [fcn.14005a130]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x68]
call fcn.1400a74f8
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
mov r8d, 0x22
lea rdx, str.http:__us_nyc03.pylex.me:8448_post
lea rcx, [rsp + 0x48]
call fcn.14005b450
lea rax, [rsp + 0x48]
mov qword [rsp + 0x90], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x118], xmm1
mov qword [rsp + 0x128], rbx
mov r14d, dword [rsp + 0x108]
dec r14d
lea r15, [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae r15, qword [rsp + 0xf8]
inc r15
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xc8]
call fcn.14005a1a0
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
lea r9, str.POST
lea r8, [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.14005a930
mov qword [rsp + 0x168], rbx
mov byte [rsp + 0x158], 0
mov r8, qword [rsp + 0x120]
mov r14, qword [rsp + 0x118]
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.14005b310
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.140009d80
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140078ce9
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078ce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f37
call fcn.1400a7470
nop
test r14, r14
je 0x140078d27
mov rdx, qword [rsp + 0x128]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x140078d1e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f3d
mov rcx, r14
call fcn.1400a7470
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140078d69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078d64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f43
call fcn.1400a7470
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0xc8]
call fcn.140009f60
lea rdx, [0x14018c928]
mov rcx, rax
call fcn.140072920
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x140078da1
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rsp + 0x178]
call fcn.14007d850
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x140078df3
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078ded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f49
call fcn.1400a7470
nop
mov rdx, qword [rsp + 0x110]
cmp rdx, 0x10
jb 0x140078e37
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078e31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f4f
call fcn.1400a7470
nop
jmp 0x140078e4b
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140078e85
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140078e80
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f55
mov rcx, r8
call fcn.1400a7470
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140078eca
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140078ec5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140078f01
mov rcx, r8
call fcn.1400a7470
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400a70e0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
int3
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
int3
call fcn.1400bc558
int3
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
nop
call fcn.1400bc558
int3