Function at 0x140054520
Capabilities:
Encode data using xor
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x138]
sub rsp, 0x238
mov r15, r9
mov r13, r8
mov rsi, rdx
mov rbx, rcx
xor r8d, r8d
mov dword [rsp + 0x44], r8d
mov r12, r9
cmp qword [r9 + 0x18], 0x10
jb 0x140054570
mov r12, qword [r9]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140054580
lea rcx, [rbp + 0x98]
call fcn.140054090
nop
mov rdx, r13
lea rcx, [rbp + 0x78]
call fcn.140054090
nop
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor r8d, r8d
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r8b
mov r14d, 1
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x40], r8d
mov dword [rbp + 0x74], r8d
mov dword [rsp + 0x5c], 0xb2008d
mov dword [rsp + 0x60], 0x9500b2
mov dword [rsp + 0x64], 0x8b008a
mov dword [rsp + 0x68], 0xc100b0
mov dword [rsp + 0x6c], 0x9b00a7
mov dword [rsp + 0x70], 0x880085
mov dword [rsp + 0x74], 0x8b0096
mov dword [rsp + 0x78], 0xc6008d
mov dword [rsp + 0x7c], 0xc500db
mov dword [rbp - 0x80], 0xed00dc
mov eax, 0xee
xor ax, word [str.POST]
mov word [rbp - 0x7c], ax
mov eax, 0xef
xor ax, word [0x1400742ba]
mov word [rbp - 0x7a], ax
mov eax, 0xf0
xor ax, word [0x1400742bc]
mov word [rbp - 0x78], ax
mov eax, 0xf1
xor ax, word [0x1400742be]
mov word [rbp - 0x76], ax
mov eax, 0xf2
xor ax, word [0x1400742c0]
mov word [rbp - 0x74], ax
mov eax, 0xf3
xor ax, word [0x1400742c2]
mov word [rbp - 0x72], ax
mov eax, 0xf4
xor ax, word [0x1400742c4]
mov word [rbp - 0x70], ax
mov eax, 0xf5
xor ax, word [0x1400742c6]
mov word [rbp - 0x6e], ax
mov eax, 0xf6
xor ax, word [0x1400742c8]
mov word [rbp - 0x6c], ax
mov eax, 0xf7
xor ax, word [0x1400742ca]
mov word [rbp - 0x6a], ax
mov eax, 0xf8
xor ax, word [0x1400742cc]
mov word [rbp - 0x68], ax
mov eax, 0xf9
xor ax, word [0x1400742ce]
mov word [rbp - 0x66], ax
mov eax, 0xfa
xor ax, word [str.Content_Type:_application_x_www_form_urlencoded_r_n]
mov word [rbp - 0x64], ax
mov eax, 0xfb
xor ax, word [0x1400742d2]
mov word [rbp - 0x62], ax
mov eax, 0xfc
xor ax, word [0x1400742d4]
mov word [rbp - 0x60], ax
mov eax, 0xfd
xor ax, word [0x1400742d6]
mov word [rbp - 0x5e], ax
mov eax, 0xfe
xor ax, word [0x1400742d8]
mov word [rbp - 0x5c], ax
mov eax, 0xff
xor ax, word [0x1400742da]
mov word [rbp - 0x5a], ax
mov eax, 0x100
xor ax, word [0x1400742dc]
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov ecx, r8d
mov edx, r8d
mov r9d, 0xda
lea eax, [r9 + rcx]
xor word [rsp + rdx*2 + 0x5c], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0x27
jb 0x140054761
mov word [rbp - 0x56], r8w
mov dword [rsp + 0x20], r8d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5c]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x140054f07
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 8
cmovae rdx, qword [rbp + 0x98]
mov r8d, 0x1bb
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov r10, rax
mov qword [rbp + 0xb8], rax
test rax, rax
je 0x140054ef9
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], 8
cmovae r8, qword [rbp + 0x78]
mov dword [rsp + 0x48], 0x94008a
mov dword [rsp + 0x4c], 0x89008f
mov eax, 0xde
mov word [rsp + 0x50], ax
mov eax, 0xdf
xor ax, word [0x1400742c2]
mov word [rsp + 0x52], ax
mov eax, 0xe0
xor ax, word [0x1400742c4]
mov word [rsp + 0x54], ax
mov eax, 0xe1
xor ax, word [0x1400742c6]
mov word [rsp + 0x56], ax
mov eax, 0xe2
xor ax, word [0x1400742c8]
mov word [rsp + 0x58], ax
xor eax, eax
mov word [rsp + 0x5a], ax
xor r9d, r9d
mov ecx, r9d
mov edx, r9d
mov r11d, 0xda
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + rcx]
xor word [rsp + rdx*2 + 0x48], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 9
jb 0x140054870
mov word [rsp + 0x5a], r9w
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x48]
mov rcx, r10
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x140054ee5
mov dword [rbp - 0x54], 0xb40099
mov dword [rbp - 0x50], 0xa900b2
mov dword [rbp - 0x4c], 0xb100bb
mov dword [rbp - 0x48], 0xcc0094
mov dword [rbp - 0x44], 0x9a00b6
mov dword [rbp - 0x40], 0x800094
mov dword [rbp - 0x3c], 0xc700dc
mov dword [rbp - 0x38], 0x990089
mov dword [rbp - 0x34], 0x87009a
mov dword [rbp - 0x30], 0x8e0085
mov dword [rbp - 0x2c], 0x9b008f
mov dword [rbp - 0x28], 0x9e0099
mov dword [rbp - 0x24], 0xdc009c
mov dword [rbp - 0x20], 0xd8008c
mov dword [rbp - 0x1c], 0x800081
mov dword [rbp - 0x18], 0xd4008f
mov dword [rbp - 0x14], 0x94009c
mov dword [rbp - 0x10], 0x90008e
mov dword [rbp - 0xc], 0x8a00d3
mov dword [rbp - 8], 0x16d0172
mov dword [rbp - 4], 0x16d0167
mov dword [rbp], 0x16a0167
mov dword [rbp + 4], 0x1620162
mov dword [rbp + 8], 0x104016c
mov dword [rbp + 0xc], 0x10b0100
mov eax, 0x10c
xor ax, word [0x140074334]
mov word [rbp + 0x10], ax
mov eax, 0x10d
xor ax, word [0x140074336]
mov word [rbp + 0x12], ax
mov eax, 0x10e
xor ax, word [0x140074338]
mov word [rbp + 0x14], ax
mov eax, 0x10f
xor ax, word [0x14007433a]
mov word [rbp + 0x16], ax
mov eax, 0x110
xor ax, word [0x14007433c]
mov word [rbp + 0x18], ax
mov eax, 0x111
xor ax, word [0x14007433e]
mov word [rbp + 0x1a], ax
mov eax, 0x112
xor ax, word [0x140074340]
mov word [rbp + 0x1c], ax
mov eax, 0x113
xor ax, word [0x140074342]
mov word [rbp + 0x1e], ax
mov eax, 0x114
xor ax, word [0x140074344]
mov word [rbp + 0x20], ax
mov eax, 0x115
xor ax, word [0x140074346]
mov word [rbp + 0x22], ax
mov eax, 0x116
xor ax, word [0x140074348]
mov word [rbp + 0x24], ax
mov eax, 0x117
xor ax, word [0x14007434a]
mov word [rbp + 0x26], ax
mov eax, 0x118
xor ax, word [0x14007434c]
mov word [rbp + 0x28], ax
mov eax, 0x119
xor ax, word [0x14007434e]
mov word [rbp + 0x2a], ax
mov eax, 0x11a
xor ax, word [0x140074350]
mov word [rbp + 0x2c], ax
mov eax, 0x11b
xor ax, word [0x140074352]
mov word [rbp + 0x2e], ax
mov eax, 0x11c
xor ax, word [0x140074354]
mov word [rbp + 0x30], ax
mov eax, 0x11d
xor ax, word [0x140074356]
mov word [rbp + 0x32], ax
mov eax, 0x11e
xor ax, word [0x140074358]
mov word [rbp + 0x34], ax
mov eax, 0x11f
xor ax, word [0x14007435a]
mov word [rbp + 0x36], ax
mov eax, 0x120
xor ax, word [0x14007435c]
mov word [rbp + 0x38], ax
mov eax, 0x121
xor ax, word [0x14007435e]
mov word [rbp + 0x3a], ax
mov eax, 0x122
xor ax, word [0x140074360]
mov word [rbp + 0x3c], ax
mov eax, 0x123
xor ax, word [0x140074362]
mov word [rbp + 0x3e], ax
mov eax, 0x124
xor ax, word [0x140074364]
mov word [rbp + 0x40], ax
mov eax, 0x125
xor ax, word [0x140074366]
mov word [rbp + 0x42], ax
mov eax, 0x126
xor ax, word [0x140074368]
mov word [rbp + 0x44], ax
mov eax, 0x127
xor ax, word [0x14007436a]
mov word [rbp + 0x46], ax
mov eax, 0x128
xor ax, word [0x14007436c]
mov word [rbp + 0x48], ax
mov eax, 0x129
xor ax, word [0x14007436e]
mov word [rbp + 0x4a], ax
mov eax, 0x12a
xor ax, word [0x140074370]
mov word [rbp + 0x4c], ax
mov eax, 0x12b
xor ax, word [0x140074372]
mov word [rbp + 0x4e], ax
mov eax, 0x12c
xor ax, word [0x140074374]
mov word [rbp + 0x50], ax
mov eax, 0x12d
xor ax, word [0x140074376]
mov word [rbp + 0x52], ax
mov eax, 0x12e
xor ax, word [0x140074378]
mov word [rbp + 0x54], ax
mov eax, 0x12f
xor ax, word [0x14007437a]
mov word [rbp + 0x56], ax
mov eax, 0x130
xor ax, word [0x14007437c]
mov word [rbp + 0x58], ax
mov eax, 0x131
xor ax, word [0x14007437e]
mov word [rbp + 0x5a], ax
mov eax, 0x132
xor ax, word [0x140074380]
mov word [rbp + 0x5c], ax
mov eax, 0x133
xor ax, word [0x140074382]
mov word [rbp + 0x5e], ax
mov eax, 0x134
xor ax, word [0x140074384]
mov word [rbp + 0x60], ax
mov eax, 0x135
xor ax, word [0x140074386]
mov word [rbp + 0x62], ax
mov eax, 0x136
xor ax, word [0x140074388]
mov word [rbp + 0x64], ax
mov eax, 0x137
xor ax, word [0x14007438a]
mov word [rbp + 0x66], ax
mov eax, 0x138
xor ax, word [0x14007438c]
mov word [rbp + 0x68], ax
mov eax, 0x139
xor ax, word [0x14007438e]
mov word [rbp + 0x6a], ax
mov eax, 0x13a
xor ax, word [0x140074390]
mov word [rbp + 0x6c], ax
mov eax, 0x13b
xor ax, word [0x140074392]
mov word [rbp + 0x6e], ax
mov eax, 0x13c
xor ax, word [str.JFIF]
mov word [rbp + 0x70], ax
xor eax, eax
mov word [rbp + 0x72], ax
xor r8d, r8d
mov ecx, r8d
mov edx, r8d
mov r9d, 0xda
nop word [rax + rax]
lea eax, [r9 + rcx]
xor word [rbp + rdx*2 - 0x54], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0x63
jb 0x140054c90
mov word [rbp + 0x72], r8w
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9, r12
mov r8d, 0xffffffff
lea rdx, [rbp - 0x54]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x140054edc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x140054edc
xor r12d, r12d
nop word [rax + rax]
mov dword [rsp + 0x40], r12d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
mov ecx, dword [rsp + 0x40]
inc ecx
call fcn.140064038
mov rdi, rax
mov r8d, dword [rsp + 0x40]
inc r8d
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x74]
mov r8d, dword [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x140054ec9
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], r12
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x140054d60
mov rdx, rdi
lea rcx, [rbp + 0xc8]
call fcn.1400417c0
nop
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140054d87
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
lea rcx, [rbp + 0xc8]
call fcn.1400637a0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x118], xmm1
movups xmmword [rbp + 0xf8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r14d, 2
mov dword [rsp + 0x44], r14d
lea rax, [rbp + 0xe8]
cmp rbx, rax
je 0x140054e46
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140054e26
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140054e13
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140054f48
mov rcx, r8
call fcn.140063c10
movups xmm0, xmmword [rbp + 0x108]
movups xmm1, xmmword [rbp + 0x118]
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp + 0xe8], 0
jmp 0x140054e4d
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140054e88
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054f48
call fcn.140063c10
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x140054ec9
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054ec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054f4f
call fcn.140063c10
mov rcx, rdi
call fcn.140063c10
cmp dword [rsp + 0x40], 0
ja 0x140054cf0
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rbp + 0x188]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 8
jb 0x140054f5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054f56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054f56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140063c10
xor edi, edi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], di
mov rdx, qword [rbp + 0xb0]
cmp rdx, 8
jb 0x140054fbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054fb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb0], 7
mov word [rbp + 0x98], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14005500f
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14005500a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400550c3
mov rcx, r8
call fcn.140063c10
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140055055
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140055050
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400550ca
mov rcx, r8
call fcn.140063c10
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14005509c
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140055097
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400550d1
mov rcx, r8
call fcn.140063c10
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rax, rbx
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3