Function at 0x140035af0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r12, rdx
mov qword [rsp + 0x60], rdx
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
xor r13d, r13d
test eax, eax
jne 0x140035b7e
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
xor r8d, r8d
lea rdx, [0x140284a60]
mov rcx, r14
call fcn.14000a430
jmp 0x140036686
cmp dword [rsp + 0x30], r13d
jne 0x140035b90
cmp qword [rsp + 0x38], r13
je 0x140035c7e
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbx, rax
test rax, rax
je 0x140035c7e
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140035bd3
mov dword [rbp + 0x50], 2
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x6c], 1
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140035bf3
mov rdx, qword [r12]
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x140035c75
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140035c66
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rdx + rdi*2], r13w
jne 0x140035c30
mov r8, rdi
lea rcx, [rbp + 0x10]
call fcn.14000a430
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [r14 + 0x10], xmm1
jmp 0x140036686
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140035c75
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp qword [rsp + 0x40], r13
je 0x140035b54
mov rdi, 0xffffffffffffffff
cmp qword [rsp + 0x48], r13
je 0x140035f07
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r13w
lea r8d, [rdi + 2]
lea rdx, [0x14028bfd0]
lea rcx, [rbp + 0x10]
call fcn.14000a430
nop
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 7
mov rdx, qword [rsp + 0x48]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140035ce0
lea rcx, [rbp + 0x50]
call fcn.14000a430
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x68]
call fcn.140039740
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140035d47
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035d42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366f5
call fcn.1402434a4
mov r15, qword [rsp + 0x68]
mov rbx, r15
mov r14, qword [rsp + 0x70]
cmp r15, r14
je 0x140035eab
mov rsi, rbx
cmp qword [rbx + 0x18], 8
jb 0x140035d6a
mov rsi, qword [rbx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
lea rax, [rbp + 0x70]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], 0xff
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x140035db0
mov rcx, qword [r12]
lea r9, [rbp - 0x60]
xor r8d, r8d
mov edx, dword [r12 + 0x10]
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 7
test eax, eax
jne 0x140035de2
xor r8d, r8d
lea rdx, [0x140284a60]
jmp 0x140035dff
lea rax, [rbp + 0x70]
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140035df0
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x30]
call fcn.14000a430
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rcx, qword [rbp + 0x30]
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov esi, eax
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140035e61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035e5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366fb
call fcn.1402434a4
test esi, esi
jne 0x140035e71
add rbx, 0x20
cmp rbx, r14
jmp 0x140035d57
mov r14, qword [rsp + 0x50]
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
xor r8d, r8d
lea rdx, [0x140284a60]
mov rcx, r14
call fcn.14000a430
nop
lea rcx, [rsp + 0x68]
call fcn.14001c680
jmp 0x140036686
test r15, r15
je 0x140035f02
mov rbx, r15
cmp r15, r14
je 0x140035ec9
mov rcx, rbx
call fcn.14000a1d0
add rbx, 0x20
cmp rbx, r14
jne 0x140035eb8
mov rdx, qword [rsp + 0x78]
sub rdx, r15
and rdx, 0xffffffffffffffe0
mov rax, r15
cmp rdx, 0x1000
jb 0x140035efa
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366e9
mov rcx, r15
call fcn.1402434a4
mov r14, qword [rsp + 0x50]
mov edx, 0x3d
mov rcx, qword [rsp + 0x40]
call fcn.14024635c
test rax, rax
jne 0x140035f4d
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
mov rdx, qword [rsp + 0x40]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140035f33
mov r8, rdi
mov rcx, r14
call fcn.14000a430
jmp 0x140036686
mov rsi, qword [r12 + 0x10]
mov r10, r12
mov r14, qword [r12 + 0x18]
cmp r14, 8
jb 0x140035f64
mov r10, qword [r12]
cmp rsi, 6
jb 0x140036000
lea r11, [rsi - 5]
lea r11, [r10 + r11*2]
mov rbx, r10
lea r15, str.https:
mov rax, r11
sub rax, rbx
sar rax, 1
mov rcx, r13
je 0x140035faa
cmp word [rbx], 0x68
je 0x140035fa7
cmp rax, 1
je 0x140035faa
dec rax
add rbx, 2
cmp word [rbx], 0x68
jne 0x140035f94
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140036000
mov r8d, 6
mov rax, r15
movzx ecx, word [rcx]
mov edx, 0x68
cmp cx, dx
jb 0x140035fed
mov r9, rbx
sub r9, r15
cmp cx, dx
ja 0x140035fed
cmp r8, 1
je 0x140035ff3
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140035fd1
add rbx, 2
jmp 0x140035f80
sub rbx, r10
sar rbx, 1
mov qword [rsp + 0x58], rbx
jmp 0x140036005
mov qword [rsp + 0x58], rdi
mov r10, r12
cmp r14, 8
jb 0x140036012
mov r10, qword [r12]
cmp rsi, 5
jb 0x1400360af
lea r11, [rsi - 4]
lea r11, [r10 + r11*2]
mov r12, r10
lea rbx, str.http:
nop
mov rax, r11
sub rax, r12
sar rax, 1
mov rcx, r13
je 0x14003605e
cmp word [r12], 0x68
je 0x14003605b
cmp rax, 1
je 0x14003605e
dec rax
add r12, 2
cmp word [r12], 0x68
jne 0x140036046
mov rcx, r12
mov r12, rcx
test rcx, rcx
je 0x1400360af
mov r8d, 5
mov rax, rbx
movzx ecx, word [rcx]
mov edx, 0x68
cmp cx, dx
jb 0x1400360a1
mov r9, r12
sub r9, rbx
cmp cx, dx
ja 0x1400360a1
cmp r8, 1
je 0x1400360a7
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140036085
add r12, 2
jmp 0x140036030
sub r12, r10
sar r12, 1
jmp 0x1400360b2
mov r12, rdi
mov r11, qword [rsp + 0x60]
cmp r14, 8
jb 0x1400360c0
mov r11, qword [r11]
cmp rsi, 6
jb 0x14003615d
lea r10, [rsi - 5]
lea r10, [r11 + r10*2]
mov r14, r11
lea rbx, str.socks:
nop dword [rax]
mov rax, r10
sub rax, r14
sar rax, 1
mov rcx, r13
je 0x14003610c
cmp word [r14], 0x73
je 0x140036109
cmp rax, 1
je 0x14003610c
dec rax
add r14, 2
cmp word [r14], 0x73
jne 0x1400360f5
mov rcx, r14
mov r14, rcx
test rcx, rcx
je 0x14003615d
mov r8d, 6
mov rax, rbx
movzx ecx, word [rcx]
mov edx, reloc.WS2_32.dll_WSAStartup
cmp cx, dx
jb 0x14003614f
mov r9, r14
sub r9, rbx
cmp cx, dx
ja 0x14003614f
cmp r8, 1
je 0x140036155
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140036133
add r14, 2
jmp 0x1400360e0
sub r14, r11
sar r14, 1
jmp 0x140036160
mov r14, rdi
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r13w
mov r8d, 1
lea rdx, [0x14028bfd0]
lea rcx, [rbp + 0x10]
call fcn.14000a430
nop
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov rdx, qword [rsp + 0x40]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x1400361a1
mov r8, rdi
lea rcx, [rbp - 0x80]
call fcn.14000a430
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x30]
call fcn.140039740
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140036209
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036204
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036701
call fcn.1402434a4
mov rdi, qword [rbp + 0x30]
mov rbx, rdi
mov rsi, qword [rbp + 0x38]
cmp rdi, rsi
je 0x1400364f7
lea rdi, [0x14028c010]
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r13w
mov r8d, 1
lea rdx, [0x14028c008]
lea rcx, [rbp + 0x50]
call fcn.14000a430
nop
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov rsi, qword [rbx + 0x10]
mov r15, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003626d
mov r15, qword [rbx]
cmp rsi, 8
jae 0x140036285
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x28], 7
jmp 0x1400362cc
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x10]
call fcn.14000a240
mov qword [rbp + 0x10], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140245860
mov qword [rbp + 0x28], rdi
lea rdi, [0x14028c010]
mov qword [rbp + 0x20], rsi
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x68]
call fcn.140039740
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x140036323
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003631e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366e3
call fcn.1402434a4
mov rsi, qword [rsp + 0x68]
cmp qword [rsp + 0x58], 0
jne 0x140036381
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x14003633d
mov r9, qword [rsi]
cmp qword [rsi + 0x10], 5
jne 0x140036381
mov r8d, 5
mov rax, rdi
movzx ecx, word [r9]
mov edx, 0x68
cmp cx, dx
jb 0x140036381
sub r9, rdi
cmp cx, dx
ja 0x140036381
cmp r8, 1
je 0x1400365c4
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140036361
test r12, r12
jne 0x1400363de
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x140036393
mov r9, qword [rsi]
cmp qword [rsi + 0x10], 4
jne 0x1400363de
mov r8d, 4
lea r10, [0x14028c020]
mov rax, r10
movzx ecx, word [r9]
mov edx, 0x68
cmp cx, dx
jb 0x1400363de
sub r9, r10
cmp cx, dx
ja 0x1400363de
cmp r8, 1
je 0x1400365c4
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400363be
test r14, r14
jne 0x14003643b
mov r9, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400363f0
mov r9, qword [rsi]
cmp qword [rsi + 0x10], 5
jne 0x14003643b
mov r8d, 5
lea r10, [0x14028c030]
mov rax, r10
movzx ecx, word [r9]
mov edx, reloc.WS2_32.dll_WSAStartup
cmp cx, dx
jb 0x14003643b
sub r9, r10
cmp cx, dx
ja 0x14003643b
cmp r8, 1
je 0x1400365c4
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x14003641b
test rsi, rsi
je 0x1400364e2
mov rdi, rsi
mov r15, qword [rsp + 0x70]
cmp rsi, r15
je 0x1400364a9
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140036490
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003648b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400366ef
mov rcx, r8
call fcn.1402434a4
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
add rdi, 0x20
cmp rdi, r15
jne 0x140036451
mov rdx, qword [rsp + 0x78]
sub rdx, rsi
and rdx, 0xffffffffffffffe0
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400364da
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366ef
mov rcx, rsi
call fcn.1402434a4
add rbx, 0x20
mov rsi, qword [rbp + 0x38]
cmp rbx, rsi
jne 0x14003621d
mov rdi, qword [rbp + 0x30]
mov r14, qword [rsp + 0x50]
mov qword [r14], r13
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
xor r8d, r8d
lea rdx, [0x140284a60]
mov rcx, r14
call fcn.14000a430
nop
test rdi, rdi
je 0x140036686
mov rbx, rdi
cmp rdi, rsi
je 0x14003658b
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140036572
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003656d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400366e9
mov rcx, r8
call fcn.1402434a4
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
add rbx, 0x20
cmp rbx, rsi
jne 0x140036533
mov rdx, qword [rbp + 0x40]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003667d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366e9
jmp 0x14003667d
lea rdx, [rsi + 0x20]
mov r14, qword [rsp + 0x50]
mov rcx, r14
call fcn.140018490
nop
mov rbx, rsi
mov rdi, qword [rsp + 0x70]
cmp rsi, rdi
je 0x1400365f4
mov rcx, rbx
call fcn.14000a1d0
add rbx, 0x20
cmp rbx, rdi
jne 0x1400365e3
mov rdx, qword [rsp + 0x78]
sub rdx, rsi
and rdx, 0xffffffffffffffe0
mov rax, rsi
cmp rdx, 0x1000
jb 0x140036625
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366ef
mov rcx, rsi
call fcn.1402434a4
nop
mov rdi, qword [rbp + 0x30]
test rdi, rdi
je 0x140036686
mov rbx, rdi
mov rsi, qword [rbp + 0x38]
nop
mov rcx, rbx
call fcn.14000a1d0
add rbx, 0x20
cmp rbx, rsi
jne 0x140036640
mov rdx, qword [rbp + 0x40]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003667d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400366e9
mov rcx, rdi
call fcn.1402434a4
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140036696
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400366a6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400366b6
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rax, r14
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1402435c0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14024a84c
nop
call fcn.14024a84c
nop
call fcn.14024a84c
nop
call fcn.14024a84c
int3
call fcn.14024a84c
nop
call fcn.14024a84c
int3