Function at 0x1400ebbf0
Capabilities:
Check http status code
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x13430
call fcn.1401da720
sub rsp, rax
mov qword [rsp + 0x13400], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0x13428], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x13160], rax
cmp qword [rsp + 0x13160], 0
jne 0x1400ebc62
xor eax, eax
jmp 0x1400ec50f
xor eax, eax
mov word [rsp + 0x2750], ax
lea rdi, [rsp + 0x2752]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x2530], ax
lea rdi, [rsp + 0x2532]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x13180], ax
lea rdi, [rsp + 0x13182]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x2310], ax
lea rdi, [rsp + 0x2312]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x2070], ax
lea rdi, [rsp + 0x2072]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x50], ax
lea rdi, [rsp + 0x52]
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
mov dword [rsp + 0x2290], 0x68
lea rax, [rsp + 0x2750]
mov qword [rsp + 0x2298], rax
lea rax, [rsp + 0x2530]
mov qword [rsp + 0x22a8], rax
lea rax, [rsp + 0x13180]
mov qword [rsp + 0x22b8], rax
lea rax, [rsp + 0x2310]
mov qword [rsp + 0x22c8], rax
lea rax, [rsp + 0x2070]
mov qword [rsp + 0x22d8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x22e8], rax
mov dword [rsp + 0x22a0], 0x104
mov dword [rsp + 0x22b0], 0x104
mov dword [rsp + 0x22c0], 0x104
mov dword [rsp + 0x22d0], 0x104
mov dword [rsp + 0x22e0], 0x104
mov dword [rsp + 0x22f0], 0x1000
mov rdx, qword [rsp + 0x13440]
lea rcx, [rsp + 0x133d0]
call fcn.1400eba10
mov qword [rsp + 0x13408], rax
mov rcx, qword [rsp + 0x13408]
call fcn.14000f8f0
lea r9, [rsp + 0x2290]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
lea rcx, [rsp + 0x133d0]
call fcn.140001490
xor r9d, r9d
movzx r8d, word [rsp + 0x22b4]
mov rdx, qword [rsp + 0x22a8]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rsp + 0x2280], rax
cmp qword [rsp + 0x2280], 0
jne 0x1400ebe3f
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x1400ec50f
mov dword [rsp + 0x2748], 0x100
movzx eax, word [rsp + 0x22b4]
cmp eax, 0x1bb
jne 0x1400ebe6c
mov eax, dword [rsp + 0x2748]
or eax, 0x800000
mov dword [rsp + 0x2748], eax
mov rcx, qword [rsp + 0x22d8]
call fcn.1400a8944
mov rdi, rax
mov rcx, qword [rsp + 0x22e8]
call fcn.1400a8944
lea rcx, [rdi + rax + 1]
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.140072250
mov qword [rsp + 0x133d8], rax
mov rax, qword [rsp + 0x133d8]
mov qword [rsp + 0x13170], rax
mov rdx, qword [rsp + 0x22d8]
mov rcx, qword [rsp + 0x13170]
call fcn.1400a99dc
mov rdx, qword [rsp + 0x22e8]
mov rcx, qword [rsp + 0x13170]
call fcn.1400a99b0
mov edx, dword [rsp + 0x2748]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x13170]
lea rdx, [0x14021d708]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rsp + 0x2060], rax
cmp qword [rsp + 0x2060], 0
jne 0x1400ebf7b
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rsp + 0x13170]
mov qword [rsp + 0x133e0], rax
mov rcx, qword [rsp + 0x133e0]
call fcn.140072248
xor eax, eax
jmp 0x1400ec50f
mov rax, qword [rsp + 0x13170]
mov qword [rsp + 0x133e8], rax
mov rcx, qword [rsp + 0x133e8]
call fcn.140072248
mov rdx, qword [rsp + 0x13460]
lea rcx, [rsp + 0x133f0]
call fcn.1400eba10
mov qword [rsp + 0x13410], rax
mov rax, qword [rsp + 0x13410]
mov qword [rsp + 0x13418], rax
mov rdx, qword [rsp + 0x13458]
lea rcx, [rsp + 0x133f8]
call fcn.1400eba10
mov qword [rsp + 0x13420], rax
mov rcx, qword [rsp + 0x13418]
call fcn.14000f8f0
mov rdi, rax
mov rcx, qword [rsp + 0x13420]
call fcn.14000f8f0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
mov r9, rax
mov r8d, 1
xor edx, edx
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
lea rcx, [rsp + 0x133f8]
call fcn.140001490
nop
lea rcx, [rsp + 0x133f0]
call fcn.140001490
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1400ec0a5
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x1400ec50f
xor edx, edx
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [rsp + 0x2520], 0
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2520]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
cmp dword [rsp + 0x2520], 0xc8
je 0x1400ec167
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp dword [rsp + 0x2520], 0x191
jne 0x1400ec148
mov ecx, 0x41
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rsp + 0x2520], 0x192
jne 0x1400ec160
mov ecx, 0x701
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400ec50f
xor eax, eax
mov word [rsp + 0x12960], ax
lea rdi, [rsp + 0x12962]
xor eax, eax
mov ecx, 0x7fe
rep stosb byte [rdi], al
mov dword [rsp + 0x13168], 0x400
mov qword [rsp + 0x2308], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x13168]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x12960]
xor r8d, r8d
mov edx, 5
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x1400ec1e6
lea rcx, [rsp + 0x12960]
call fcn.1400a9a04
mov qword [rsp + 0x2308], rax
mov qword [rsp + 0x2740], 0
cmp qword [rsp + 0x13450], 0
je 0x1400ec219
mov r9d, 0x640000
xor r8d, r8d
mov edx, 0x401
mov rcx, qword [rsp + 0x13450]
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 3
mov edx, 0x40000000
mov rcx, qword [rsp + 0x13448]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x2300], rax
cmp qword [rsp + 0x2300], 0xffffffffffffffff
jne 0x1400ec292
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x1400ec50f
cmp qword [rsp + 0x13468], 0
je 0x1400ec2e9
mov rax, qword [rsp + 0x13468]
cmp dword [rax], 0
jne 0x1400ec2e9
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x1400ec50f
lea r9, [rsp + 0x2288]
mov r8d, 0x10000
lea rdx, [rsp + 0x2960]
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov dword [rsp + 0x13398], eax
mov eax, dword [rsp + 0x2288]
mov dword [rsp + 0x13394], eax
cmp dword [rsp + 0x13398], 0
je 0x1400ec45d
cmp dword [rsp + 0x2288], 0
jbe 0x1400ec45d
mov ecx, dword [rsp + 0x2288]
mov rax, qword [rsp + 0x2740]
add rax, rcx
mov qword [rsp + 0x2740], rax
cmp qword [rsp + 0x13450], 0
je 0x1400ec3dd
cmp qword [rsp + 0x2308], 0
je 0x1400ec39d
mov rax, qword [rsp + 0x2740]
imul rax, rax, 0x64
xor edx, edx
div qword [rsp + 0x2308]
xor r9d, r9d
mov r8, rax
mov edx, 0x402
mov rcx, qword [rsp + 0x13450]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x133a0]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400ec3dd
lea rcx, [rsp + 0x133a0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x133a0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400ec39d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x13390]
mov r8d, dword [rsp + 0x13394]
lea rdx, [rsp + 0x2960]
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x13390]
cmp dword [rsp + 0x13394], eax
je 0x1400ec45b
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor eax, eax
jmp 0x1400ec50f
jmp 0x1400ec4a5
cmp dword [rsp + 0x13398], 0
jne 0x1400ec4a3
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400ec50f
jmp 0x1400ec4cf
cmp qword [rsp + 0x2308], 0
je 0x1400ec4c4
mov rax, qword [rsp + 0x2308]
cmp qword [rsp + 0x2740], rax
jb 0x1400ec4c4
jmp 0x1400ec4cf
xor eax, eax
cmp eax, 1
jne 0x1400ec292
mov rcx, qword [rsp + 0x2300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2060]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x2280]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x13160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rax, qword [rsp + 0x2740]
mov rcx, qword [rsp + 0x13428]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0x13430
pop rdi
ret