Function at 0x401e30
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Create thread
Encode data using xor
Execute shellcode via indirect call
Get file size
Inject thread
Read and send data from client to server
Read data from internet
Read file on windows
Receive data
Send data
Send http request
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405f16
mov eax, dword fs:[0]
push eax
mov eax, 0x1090
call fcn.00405da0
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 1
push str.WinINet_POST_Example
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
mov dword [ebp - 0x1080], edi
test edi, edi
jne 0x401ea7
mov edx, str.InternetOpen_failed
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004044e0
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 1
jmp 0x40279c
mov eax, dword [0x407650]
xor ecx, ecx
movq xmm0, qword [str.VZVAK_O]
mov esi, dword [0x40a604]
mov dword [ebp - 0x1094], eax
mov ax, word [0x407654]
mov word [ebp - 0x1090], ax
mov al, byte [0x407656]
movq qword [ebp - 0x109c], xmm0
mov byte [ebp - 0x108e], al
mov dword [ebp - 0x1078], ecx
cmp esi, 2
jl 0x401ff0
movaps xmm2, xmmword [0x4076c0]
mov ecx, 8
movaps xmm3, xmmword [0x407710]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
mov dword [ebp - 0x1078], ecx
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4076e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x4076d0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x4076f0]
movd xmm0, dword [str.VZVAK_O]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
xorps xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x109c], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4076e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x4076f0]
movd xmm0, dword [ebp - 0x1098]
packuswb xmm1, xmm1
paddb xmm1, xmmword [str.5555555555555555]
xorps xmm1, xmm0
movd dword [ebp - 0x1098], xmm1
nop
mov eax, 0x4d4873ed
imul ecx
mov al, 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub al, cl
mov ecx, dword [ebp - 0x1078]
movsx eax, al
imul eax, eax, 0x35
add al, cl
xor byte [ebp + ecx - 0x109c], al
inc ecx
mov dword [ebp - 0x1078], ecx
cmp ecx, 0xf
jl 0x401ff0
push 0
push 0
push 3
push 0
push 0
push 0x50
lea eax, [ebp - 0x109c]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
mov dword [ebp - 0x1088], edi
test edi, edi
jne 0x402056
mov edx, str.InternetConnect_failed
jmp 0x401e85
cmp byte [0x40763b], 0
mov edx, dword [0x407634]
mov eax, dword [str.IRK_]
mov dword [ebp - 0x107c], edx
mov dword [ebp - 0x1078], eax
je 0x4021b7
xor ecx, ecx
mov dword [ebp - 0x1084], ecx
cmp esi, 2
jl 0x402181
movaps xmm2, xmmword [0x4076c0]
movaps xmm4, xmmword [0x407710]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
mov eax, dword [str.5555555555555555]
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4076e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x4076d0]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x4076f0]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, edx
xorps xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x107c], xmm1
movaps xmm1, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movaps xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x4076e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
andps xmm1, xmmword [0x4076f0]
packuswb xmm1, xmm1
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [str.IRK_]
xorps xmm1, xmm0
movd dword [ebp - 0x1078], xmm1
jmp 0x4021b7
mov eax, 0x4d4873ed
imul ecx
mov al, 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub al, cl
mov ecx, dword [ebp - 0x1084]
movsx eax, al
imul eax, eax, 0x35
add al, cl
xor byte [ebp + ecx - 0x107c], al
inc ecx
mov dword [ebp - 0x1084], ecx
cmp ecx, 8
jl 0x402181
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x107c]
push eax
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
mov dword [ebp - 0x108c], esi
test esi, esi
jne 0x4021ea
mov edx, str.HttpOpenRequest_failed
jmp 0x401e85
xorps xmm0, xmm0
mov dword [ebp - 0x1034], 0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1030], 0xf
mov byte [ebp - 0x1044], 0
mov dword [ebp - 4], 0
mov edx, 0x4074ac
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.004044e0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea edx, [ebp - 0x1044]
call fcn.00404730
mov ecx, dword [ebp - 0x1034]
mov eax, 0x7fffffff
sub eax, ecx
cmp eax, 4
jb 0x4027b7
cmp dword [ebp - 0x1030], 0xf
lea eax, [ebp - 0x1044]
push ecx
cmova eax, dword [ebp - 0x1044]
push eax
push 4
push str.key
push ecx
push dword [ebp - 0x1080]
lea ecx, [ebp - 0x105c]
call fcn.00404ce0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x105c]
push dword [ebp - 0x104c]
cmp dword [ebp - 0x1048], 0xf
cmova eax, dword [ebp - 0x105c]
push eax
push 0xffffffffffffffff
push str.Content_Type:_application_x_www_form_urlencoded
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4022d4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.HttpSendRequest_failed
call fcn.004044e0
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, 1
jmp 0x40270d
xorps xmm0, xmm0
mov dword [ebp - 0x101c], 0
movups xmmword [ebp - 0x102c], xmm0
mov dword [ebp - 0x1018], 0xf
mov byte [ebp - 0x102c], 0
lea eax, [ebp - 0x1014]
mov byte [ebp - 4], 2
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4023bb
nop
mov edi, dword [ebp - 0x1014]
test edi, edi
je 0x4023b5
mov edx, dword [ebp - 0x1018]
mov eax, edx
mov ecx, dword [ebp - 0x101c]
sub eax, ecx
push edi
cmp edi, eax
ja 0x40237a
lea eax, [ecx + edi]
cmp edx, 0xf
mov dword [ebp - 0x101c], eax
lea esi, [ebp - 0x102c]
cmova esi, dword [ebp - 0x102c]
lea eax, [ebp - 0x1010]
add esi, ecx
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [edi + esi], 0
add esp, 0xc
mov esi, dword [ebp - 0x108c]
jmp 0x402393
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1080]
lea ecx, [ebp - 0x102c]
push edi
call fcn.00404b70
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x402320
mov edi, dword [ebp - 0x1088]
sub esp, 8
lea ecx, [ebp - 0x102c]
call fcn.00403c70
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp eax, 0xffffffff
je 0x40269f
mov edx, 0x407514
call fcn.004044e0
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push edi
call esi
push dword [ebp - 0x1080]
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x407524
call fcn.004044e0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
sub esp, 0x18
mov ecx, esp
push 0x407538
call fcn.00403d90
call fcn.00401240
add esp, 0x18
test eax, eax
jne 0x402441
push 0x64
call esi
jmp 0x402420
sub esp, 0x18
mov ecx, esp
push 0x407538
call fcn.00403d90
call fcn.00401240
add esp, 0x18
mov dword [ebp - 0x1080], eax
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push str.ExitLag.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
push 0x3000
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push esi
push eax
push edi
mov dword [ebp - 0x1088], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp - 0x1088]
push dword [ebp - 0x1080]
push 0
mov esi, dword [edi + 0x3c]
add esi, edi
push 0x1fffff
mov dword [ebp - 0x108c], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40
push 0x3000
push dword [esi + 0x50]
mov dword [ebp - 0x1078], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push dword [esi + 0x54]
mov dword [ebp - 0x1084], eax
push edi
push eax
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
xor edi, edi
cmp ax, word [esi + 6]
jae 0x40254c
add esi, 0x10c
nop
mov eax, dword [esi]
add eax, dword [ebp - 0x1088]
push 0
push dword [esi - 4]
push eax
mov eax, dword [esi - 8]
add eax, dword [ebp - 0x1084]
push eax
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x108c]
lea esi, [esi + 0x28]
inc edi
movzx eax, word [eax + 6]
cmp edi, eax
jl 0x402510
mov esi, dword [ebp - 0x108c]
push 0x40
push 0x3000
push 0x1000
push 0
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, dword [ebp - 0x1084]
mov edi, eax
mov eax, dword [ebp - 0x1088]
mov dword [ebp - 0x1074], edx
push 0
push 0x18
mov ecx, dword [eax + 0x3c]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add ecx, edx
mov dword [ebp - 0x1070], ecx
mov ecx, dword [esi + 0xa0]
add ecx, edx
mov dword [ebp - 0x106c], ecx
mov ecx, dword [esi + 0x80]
mov dword [ebp - 0x1064], eax
add ecx, edx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1060], eax
lea eax, [ebp - 0x1074]
push eax
push edi
push dword [ebp - 0x1078]
mov dword [ebp - 0x1068], ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov eax, fcn.00401550
lea esi, [edi + 0x18]
sub eax, 0x401440
push eax
push 0x401440
push esi
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push edi
push esi
push 0
push 0
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Address_of_Loader:
mov esi, eax
call fcn.004044e0
push 0x401220
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push edi
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Address_of_Image:
call fcn.004044e0
push 0x401220
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x1084]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const__]
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::basic_istream_char__struct_std::char_traits_char__::get_void_]
push 0x8000
push 0
push edi
push dword [ebp - 0x1078]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x4026b6
mov edx, 0x407578
call fcn.004044e0
push 0x404700
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x1018]
xor esi, esi
cmp ecx, 0xf
jbe 0x4026f2
mov edx, dword [ebp - 0x102c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4026e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40278a
push ecx
push edx
call fcn.00405099
add esp, 8
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1018], 0xf
mov byte [ebp - 0x102c], 0
mov ecx, dword [ebp - 0x1048]
cmp ecx, 0xf
jbe 0x402743
mov edx, dword [ebp - 0x105c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402739
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40278a
push ecx
push edx
call fcn.00405099
add esp, 8
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x104c], 0
mov dword [ebp - 0x1048], 0xf
mov byte [ebp - 0x105c], 0
cmp ecx, 0xf
jbe 0x40279a
mov edx, dword [ebp - 0x1044]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402790
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402790
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00405099
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405056
mov esp, ebp
pop ebp
ret
call fcn.00401170
int3