Function at 0x14016d880
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference cloudflare dns server
Set http header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
movzx edi, r8w
mov qword [rbp - 0x20], rbx
mov r12, rdx
mov rsi, rcx
mov r15d, 1
lock xadd word [0x140245778], r15w
inc r15w
call fcn.140122880
nop
test rax, rax
je 0x14016dd01
mov rcx, qword [0x140241998]
mov r8d, 0x1000
mov qword [rsp + 0xb0], r13
mov r13d, 4
mov edx, r13d
mov qword [rsp + 0xb8], r14
mov dword [rbp + 0x48], 0x1000
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
call fcn.140122880
movzx r9d, di
mov dword [rsp + 0x28], 1
mov r8, r12
mov word [rsp + 0x20], r15w
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [case.0x1400f654f.0]
test eax, eax
setne cl
test eax, eax
jne 0x14016d98c
mov rcx, qword [0x140241998]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x48]
mov edx, r13d
mov rcx, qword [0x140241998]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r14, rax
call fcn.140122880
movzx r9d, di
mov dword [rsp + 0x28], 1
mov r8, r12
mov word [rsp + 0x20], r15w
lea rdx, [rbp + 0x48]
mov rcx, r14
call qword [case.0x1400f654f.0]
test eax, eax
setne cl
test cl, cl
je 0x14016dcbd
test byte [0x14023f350], 1
lea rdi, str.1.1.1.1
mov r12d, dword [rbp + 0x48]
jne 0x14016dae5
lock bts qword [0x14023f350], 0x1f
jae 0x14016d9d9
test byte [0x14023f350], 1
nop
jne 0x14016dae5
xor edx, edx
lea rcx, [0x14023f350]
call sym.ProcessHacker.exe_PhfWaitForEvent
jmp 0x14016dae5
cmp dword [0x140237d34], 0x3f
mov edx, ebx
mov dword [rsp + 0x20], ebx
cmovae edx, r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x140245780], rax
nop
test rax, rax
je 0x14016dad6
cmp dword [0x140237d34], 0x3f
mov r9d, r13d
mov edx, 0x54
mov rcx, rax
jae 0x14016da2a
mov dword [rbp - 0x40], 0xa00
lea r8, [rbp - 0x40]
jmp 0x14016da7e
lea r8, [rbp - 0x3c]
mov dword [rbp - 0x3c], 0x2a00
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x140245780]
lea r8, [rbp - 0x38]
mov r9d, r13d
mov dword [rbp - 0x38], 3
mov edx, 0x76
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x140237d34], 0x64
jb 0x14016da86
mov rcx, qword [0x140245780]
lea r8, [rbp - 0x34]
mov dword [rbp - 0x34], 1
mov r9d, r13d
mov edx, 0x85
nop
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [0x140245780]
lea r8, [rbp - 0x30]
mov r9d, r13d
mov dword [rbp - 0x30], 1
mov edx, 0x49
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp dword [0x140237d34], 0x64
jb 0x14016dad6
mov rcx, qword [0x140245780]
test rsi, rsi
mov rdx, rdi
mov r8d, 0x1bb
cmovne rdx, rsi
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x140245770], rax
lea rcx, [0x14023f350]
nop dword [rax]
call sym.ProcessHacker.exe_PhfSetEvent
cmp dword [0x140237d34], 0x64
jae 0x14016db17
mov rcx, qword [0x140245780]
test rsi, rsi
mov r8d, 0x1bb
cmovne rdi, rsi
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x140245770], rax
jmp 0x14016db1e
mov rax, qword [0x140245770]
nop
test rax, rax
je 0x14016dcbd
mov dword [rsp + 0x30], 0x800000
lea r8, str._dns_query
mov qword [rsp + 0x28], rbx
lea rdx, str.POST
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x14016dcbd
mov r9d, 0xa0000000
lea rdx, str.Content_Type:_application_dns_message
mov r8d, 0xffffffff
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [0x140237d34], 0x3e
ja 0x14016dbab
mov r9d, r13d
mov dword [rbp - 0x2c], 0x1000
lea r8, [rbp - 0x2c]
mov edx, 0x1f
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov qword [rsp + 0x30], rbx
mov r9, r14
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14016dc93
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop
test eax, eax
je 0x14016dc93
lea r8, [rbp - 0x28]
mov rcx, rsi
lea rdx, [rbp - 0x20]
call sym.ProcessHacker.exe_PhHttpSocketReadDataToBuffer
nop dword [rax + rax]
test al, al
je 0x14016dc93
mov qword [rbp - 0x18], rbx
call fcn.140122700
test rax, rax
je 0x14016dc93
mov r12d, dword ds:[rbp - 0x28]
cmp r12d, 0xffff
ja 0x14016dc93
mov rdi, qword [rbp - 0x20]
movzx eax, word [rdi + 4]
movzx ecx, word [rdi]
ror ax, 8
mov word [rdi + 4], ax
movzx eax, word [rdi + 6]
ror ax, 8
mov word [rdi + 6], ax
movzx eax, word [rdi + 8]
ror ax, 8
mov word [rdi + 8], ax
movzx eax, word [rdi + 0xa]
ror ax, 8
ror cx, 8
mov word [rdi], cx
mov word [rdi + 0xa], ax
cmp cx, r15w
jne 0x14016dc97
call fcn.140122700
lea r8, ds:[rbp - 0x18]
movzx edx, r12w
mov rcx, rdi
call qword [case.0x1400f654f.0]
mov rax, qword [rbp - 0x18]
test rax, rax
cmovne rbx, rax
jmp 0x14016dc97
mov rdi, qword [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rdi, rdi
je 0x14016dcbd
mov rcx, qword [0x140241998]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax]
test r14, r14
je 0x14016dcd7
mov rcx, qword [0x140241998]
mov r8, r14
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r13, qword [rsp + 0xb0]
mov rax, rbx
mov r14, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, rbx
jmp 0x14016dcea