Function at 0x18003ad90
Capabilities:
Check http status code
Create http request
Log keystrokes via polling
Read data from internet
Receive data

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
mov eax, 0x1090
call fcn.18006c190
sub rsp, rax
mov rax, qword [0x18009c600]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov r14, qword [rsp + 0x10e0]
mov rsi, qword [rsp + 0x10f0]
mov r15, r9
mov r12, rcx
test r9, r9
je 0x18003b0ea
test r14, r14
je 0x18003b0ea
mov qword [rsp + 0x10c8], rbp
mov qword [rsp + 0x1088], rdi
mov qword [rsp + 0x1080], r13
mov r13d, 1
mov edi, r13d
lea ecx, [r13 + 0x13]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
mov dx, ax
bt edx, 0xf
jae 0x18003ae3b
lea ecx, [rbx + 0x58]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
bt edx, 0xf
jae 0x18003ae3b
lea ecx, [rbx + 0x5a]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dx, ax
bt edx, 0xf
cmovb edi, ebx
mov rcx, qword [rsi]
cmp dword [rcx - 0x10], ebx
je 0x18003ae5a
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
jmp 0x18003ae76
lea rcx, str.CHM_MSDN
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbp, rax
test rbp, rbp
jne 0x18003ae8b
mov rdx, qword [rsi]
sub rdx, 0x18
or rbx, 0xffffffffffffffff
jmp 0x18003b0cf
mov r9d, 4
lea r8, [rsp + 0x38]
mov rcx, rbp
lea edx, [r9 + 0x3d]
mov dword [rsp + 0x38], r13d
call qword [sym.imp.WININET.dll_InternetSetOptionW]
xor eax, eax
or rbx, 0xffffffffffffffff
lea rdi, str.Accept_Encoding:_gzip_r_nConnection:_close
mov rcx, rbx
lea r8, str.Accept_Encoding:_gzip_r_nConnection:_close
repne scasw ax, word [rdi]
xor edi, edi
mov rdx, r12
not rcx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x84083180
lea r9d, [rcx - 1]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r12, rax
test rax, rax
je 0x18003b0bf
xor eax, eax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x40]
lea edx, [rbx + 0x14]
mov rcx, r12
mov word [rsp + 0x40], di
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x52], ax
mov dword [rsp + 0x34], reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x18003b0b6
lea rcx, [rsp + 0x40]
call fcn.180052f9c
cmp eax, 0xc8
je 0x18003af96
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call fcn.1800014ac
xor eax, eax
mov rdi, qword [rsp + 0x1088]
mov rbp, qword [rsp + 0x10c8]
mov r13, qword [rsp + 0x1080]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1800520e0
add rsp, 0x1090
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x61]
mov ebx, edi
xor edx, edx
mov r8d, 0x1000
mov dword [rsp + 0x30], edi
mov byte [rsp + 0x60], bl
call fcn.180054ba0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18003b081
cmp dword [rsp + 0x30], 0
jbe 0x18003b070
test rdi, rdi
jne 0x18003b002
mov ecx, 0x1001
call fcn.180052aa0
xor edx, edx
mov r8d, 0x1001
mov rcx, rax
mov rdi, rax
call fcn.180054ba0
jmp 0x18003b025
lea edx, [rbx + 0x1001]
mov rcx, rdi
call fcn.180053f44
mov ecx, ebx
xor edx, edx
add rcx, rax
mov r8d, 0x1001
mov rdi, rax
call fcn.180054ba0
mov r8d, dword [rsp + 0x30]
mov ecx, ebx
lea rdx, [rsp + 0x60]
add rcx, rdi
call fcn.18005a1e0
add ebx, dword [rsp + 0x30]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x1001
call fcn.180054ba0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18003afd3
test ebx, ebx
jne 0x18003b0ae
test rdi, rdi
je 0x18003b081
mov rcx, rdi
call fcn.1800529c4
xor ebx, ebx
mov qword [r15], rbx
mov dword [r14], ebx
mov r13d, ebx
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call fcn.1800014ac
mov eax, r13d
jmp 0x18003af5e
mov qword [r15], rdi
mov dword [r14], ebx
jmp 0x18003b08c
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18003b0e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x18003af5e
mov rdx, qword [rsi]
sub rdx, 0x18
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18003b109
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x18003af76