Function at 0x401b09
Capabilities:
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0x40], eax
mov eax, 0
mov dword [rbp - 0x44], eax
movabs rax, 0
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
movabs rax, 0
mov qword [rbp - 0x18], rax
movabs rax, 0
mov qword [rbp - 0x20], rax
movabs rax, 0
mov qword [rbp - 0x28], rax
movabs rax, 0
mov qword [rbp - 0x30], rax
mov eax, 1
mov dword [rbp - 0x34], eax
mov eax, 0
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x44]
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
lea rax, [rbp - 0x3c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [rbp - 0x38]
cmp eax, 0
je 0x401bcd
jmp 0x40268c
movabs rax, 0
mov qword [rsp + 0x30], rax
mov eax, 0x100
mov qword [rsp + 0x28], rax
mov eax, 2
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp + 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileW
mov qword [rbp - 0x50], rax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
jne 0x401c69
call sub.kernel32.dll_GetLastError
mov ecx, 0x209
mov r8, rcx
mov r11, rax
lea rax, [0x0040411c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x40268f
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x401ca8
jmp 0x401cf1
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x20e
mov r8, rcx
mov r11, rax
lea rax, [0x0040412f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
lea rcx, str._isapi_isapiv5.dll_v5_DEAD_BEEF_242606162432432_001877001fff_000005_ndpx.bin
mov r9, rcx
lea rcx, [0x00404142]
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x200
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x401d7b
jmp 0x401dc4
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x213
mov r8, rcx
mov r11, rax
lea rax, [0x00404198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
mov ecx, dword [rbp - 0x44]
and ecx, 0xffff
mov qword [rsp + 0x30], rcx
mov ecx, dword [rbp - 0x40]
mov qword [rsp + 0x28], rcx
mov ecx, dword [rbp - 0x3c]
mov qword [rsp + 0x20], rcx
lea rcx, str.TrollAV_5.0
mov r9, rcx
lea rcx, str._hs_WindowsNT_i._i._i_
mov r8, rcx
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 4
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpen
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x401e85
jmp 0x401ece
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x224
mov r8, rcx
mov r11, rax
lea rax, [0x004041ec]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, 0
mov r9, rax
mov eax, 0
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpConnect
movsxd rax, eax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x401f11
jmp 0x401f5a
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x227
mov r8, rcx
mov r11, rax
lea rax, [0x004041ff]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
lea rax, [0x00404212]
mov qword [rbp - 0x60], rax
movabs rax, 0
mov qword [rbp - 0x58], rax
mov eax, 0
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov rax, qword [rbp + 0x18]
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpOpenRequest
movsxd rax, eax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x401fdc
jmp 0x402025
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x22c
mov r8, rcx
mov r11, rax
lea rax, [0x0040421a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, 0
mov qword [rsp + 0x30], rax
mov eax, 0
mov qword [rsp + 0x28], rax
mov eax, 0
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 0
mov r8, rax
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpSendRequest
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x40208b
jmp 0x4020d4
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x238
mov r8, rcx
mov r11, rax
lea rax, [0x0040422d]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
movabs rax, 0
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReceiveResponse
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402107
jmp 0x402150
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x23b
mov r8, rcx
mov r11, rax
lea rax, [0x00404240]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, 0
mov dword [rbp - 0x68], eax
mov eax, 4
mov dword [rbp - 0x6c], eax
movabs rax, 0
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x68]
mov r9, rax
movabs rax, 0
mov r8, rax
mov eax, 0x20000013
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryHeaders
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4021ba
jmp 0x402203
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x247
mov r8, rcx
mov r11, rax
lea rax, [0x00404253]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, dword [rbp - 0x68]
cmp eax, 0x1f4
jb 0x40225b
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x248
mov r8, rcx
mov r11, rax
lea rax, [0x00404266]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
lea rax, [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402288
jmp 0x4022d1
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x24c
mov r8, rcx
mov r11, rax
lea rax, [0x00404279]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, 0
mov ecx, dword [rbp - 0x70]
cmp eax, ecx
jne 0x40232a
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x24f
mov r8, rcx
mov r11, rax
lea rax, [0x0040428c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
mov eax, dword [rbp - 0x70]
cmp eax, 0
je 0x402566
call sub.kernel32.dll_GetProcessHeap
mov ecx, dword [rbp - 0x70]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x40236e
jmp 0x4023b7
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x254
mov r8, rcx
mov r11, rax
lea rax, [0x0040429f]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
lea rax, [rbp - 0x74]
mov r9, rax
mov eax, dword [rbp - 0x70]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpReadData
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x4023f1
jmp 0x40243a
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x258
mov r8, rcx
mov r11, rax
lea rax, [0x004042b2]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x78]
mov r9, rax
mov eax, dword [rbp - 0x74]
mov r8, rax
mov rax, qword [rbp - 0x30]
mov r11, rax
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402483
jmp 0x4024ad
call sub.kernel32.dll_GetLastError
mov ecx, 0x260
mov r8, rcx
mov r11, rax
lea rax, [0x004042c5]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x402566
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4024eb
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.winhttp.dll_WinHttpQueryDataAvailable
mov dword [rbp - 0x64], eax
mov eax, dword [rbp - 0x64]
cmp eax, 0
je 0x402518
jmp 0x402561
mov eax, dword [rbp - 0x34]
mov ecx, 0x3e8
imul eax, ecx
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 0x34]
shl eax, 1
mov dword [rbp - 0x34], eax
call sub.kernel32.dll_GetLastError
mov ecx, 0x26a
mov r8, rcx
mov r11, rax
lea rax, str.ERROR__lu_in__i_r_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
jmp 0x40256c
jmp 0x40232a
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x38], eax
movabs rax, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
cmp rax, rcx
je 0x402592
mov rax, qword [rbp - 0x50]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_CloseHandle
mov rax, qword [rbp - 0x30]
cmp rax, 0
je 0x4025d0
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x30]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
movabs rax, 0
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x28]
cmp rax, 0
je 0x4025ed
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x20]
cmp rax, 0
je 0x40260a
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x402627
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.winhttp.dll_WinHttpCloseHandle
mov rax, qword [rbp - 0x10]
cmp rax, 0
je 0x402657
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 0x10]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x402687
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapFree
jmp 0x401bbc
mov eax, dword [rbp - 0x38]
leave
ret