Function at 0x140002b10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x890]
sub rsp, 0x990
mov rax, qword [0x140035010]
xor rax, rsp
mov qword [rbp + 0x880], rax
mov dword [rbp + 0x60], r9d
mov qword [rbp + 0x68], r8
mov r15, rcx
mov rdi, qword [rbp + 0x8f0]
mov qword [rbp + 0x78], rdi
mov rsi, qword [rbp + 0x8f8]
mov qword [rbp + 0x70], rsi
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x140]
call fcn.14000cae0
movzx ebx, word [0x140031ab4]
mov word [rbp + 0x250], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x252]
call fcn.14000cae0
mov word [rbp + 0x460], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x462]
call fcn.14000cae0
mov word [rbp + 0x670], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x672]
call fcn.14000cae0
mov r10d, 0x23bb
mov word [rsp + 0x40], r10w
lea eax, [r10 + 0x30]
lea ecx, [rax + 9]
lea edx, [rax - 3]
lea r8d, [r10 + 0x34]
xor r9d, r9d
xor ax, r10w
mov word [rsp + 0x42], ax
xor cx, r10w
mov word [rsp + 0x44], cx
xor dx, r10w
mov word [rsp + 0x46], dx
xor r8w, r10w
mov word [rsp + 0x48], r8w
xor r12d, r12d
mov word [rsp + 0x4a], r12w
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], 7
mov word [rbp + 0x118], r12w
lea rax, [rsp + 0x42]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], r9w
jne 0x140002c41
lea rdx, [rsp + 0x42]
lea rcx, [rbp + 0x118]
call fcn.140003f00
nop
mov qword [rbp + 0x108], r12
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r12w
xor r8d, r8d
lea rdx, [0x140031ab4]
lea rcx, [rbp + 0xf8]
call fcn.140003f00
nop
mov qword [rdi], r12
mov dword [rsi], r12d
cmp qword [r15 + 0x10], 0
je 0x14000306e
mov ecx, r12d
mov al, 0x4f
lea r9, str.ObtainUserAgentString
nop dword [rax + rax]
cmp al, 0x7e
ja 0x140002cbf
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x140002cb0
movabs rdi, 0xcbf29ce484222325
mov r8, rdi
movabs r14, 0x100000001b3
test ecx, ecx
je 0x140002d07
mov r10d, ecx
nop dword [rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r14
lea r9, [r9 + 1]
sub r10, 1
jne 0x140002ce0
mov rcx, r8
call fcn.140002230
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x140]
xor ecx, ecx
call rax
mov esi, 0x68
test eax, eax
jne 0x140002d66
lea r8, [rbp + 0x140]
lea rdx, [0x140031b18]
lea rcx, [rbp + 0x250]
call fcn.140004080
lea rax, [rbp + 0x250]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002d50
lea rdx, [rbp + 0x250]
jmp 0x140002fc2
mov dword [rsp + 0x60], 0x71004f
mov dword [rsp + 0x64], 0x6b007c
mov dword [rsp + 0x68], 0x6e006e
mov dword [rsp + 0x6c], 0x220063
mov dword [rsp + 0x70], 0x220031
mov dword [rsp + 0x74], 0x300037
mov dword [rsp + 0x78], 0x220032
mov dword [rsp + 0x7c], 0x59002a
mov dword [rbp - 0x80], 0x70006b
mov dword [rbp - 0x7c], 0x710066
mov dword [rbp - 0x78], 0x750079
mov dword [rbp - 0x74], 0x500022
mov dword [rbp - 0x70], 0x220056
mov dword [rbp - 0x6c], 0x320033
mov dword [rbp - 0x68], 0x320030
mov dword [rbp - 0x64], 0x22003d
mov dword [rbp - 0x60], 0x6b0059
mov dword [rbp - 0x5c], 0x380070
mov dword [rbp - 0x58], 0x3d0036
mov dword [rbp - 0x54], 0x7a0022
mov dword [rbp - 0x50], 0x360038
mov dword [rbp - 0x4c], 0x22002b
mov dword [rbp - 0x48], 0x720043
mov dword [rbp - 0x44], 0x6e0072
mov dword [rbp - 0x40], 0x590067
mov dword [rbp - 0x3c], 0x640067
mov dword [rbp - 0x38], 0x6b004d
mov dword [rbp - 0x34], 0x220076
mov dword [rbp - 0x30], 0x220031
mov dword [rbp - 0x2c], 0x350037
mov dword [rbp - 0x28], 0x300039
mov dword [rbp - 0x24], 0x380035
mov dword [rbp - 0x20], 0x2a0022
mov dword [rbp - 0x1c], 0x4a004d
mov dword [rbp - 0x18], 0x4f0056
mov dword [rbp - 0x14], 0x2e004e
mov dword [rbp - 0x10], 0x6e0022
mov dword [rbp - 0xc], 0x6d006b
mov dword [rbp - 8], 0x220067
mov dword [rbp - 4], 0x670049
mov dword [rbp], 0x6d0065
mov dword [rbp + 4], 0x2b0071
mov dword [rbp + 8], 0x450022
mov dword [rbp + 0xc], 0x74006a
mov dword [rbp + 0x10], 0x6f0071
mov dword [rbp + 0x14], 0x220067
mov dword [rbp + 0x18], 0x220031
mov dword [rbp + 0x1c], 0x320033
mov dword [rbp + 0x20], 0x300036
mov dword [rbp + 0x24], 0x300032
mov dword [rbp + 0x28], 0x390035
mov dword [rbp + 0x2c], 0x3b0034
mov dword [rbp + 0x30], 0x330030
mov dword [rbp + 0x34], 0x3b0038
mov dword [rbp + 0x38], 0x550022
mov dword [rbp + 0x3c], 0x680063
mov dword [rbp + 0x40], 0x740063
mov dword [rbp + 0x44], 0x22006b
mov dword [rbp + 0x48], 0x220031
mov dword [rbp + 0x4c], 0x350037
mov dword [rbp + 0x50], 0x300039
mov dword [rbp + 0x54], 0x380035
xor r12d, r12d
mov word [rbp + 0x58], r12w
mov eax, r12d
movdqa xmm1, xmmword [0x140031ec0]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax*2 + 0x60]
psubw xmm0, xmm1
movdqu xmmword [rsp + rax*2 + 0x60], xmm0
movdqu xmm0, xmmword [rsp + rax*2 + 0x70]
psubw xmm0, xmm1
movdqu xmmword [rsp + rax*2 + 0x70], xmm0
movdqu xmm0, xmmword [rbp + rax*2 - 0x80]
psubw xmm0, xmm1
movdqu xmmword [rbp + rax*2 - 0x80], xmm0
movdqu xmm0, xmmword [rbp + rax*2 - 0x70]
psubw xmm0, xmm1
movdqu xmmword [rbp + rax*2 - 0x70], xmm0
add rax, 0x20
cmp rax, 0x60
jb 0x140002f40
cmp rax, 0x7c
jae 0x140002fae
mov ecx, 0xfffe
nop word [rax + rax]
add word [rsp + rax*2 + 0x60], cx
inc rax
cmp rax, 0x7c
jb 0x140002fa0
lea rax, [rsp + 0x60]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140002fb3
lea rdx, [rsp + 0x60]
mov r8, rbx
lea rcx, [rbp + 0xf8]
call fcn.140003f00
mov ecx, r12d
mov al, 0x57
lea r9, str.WinHttpOpen
nop dword [rax]
cmp al, 0x7e
ja 0x140002fef
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x140002fe0
mov r8, rdi
test ecx, ecx
je 0x140003027
mov r10d, ecx
nop dword [rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r14
lea r9, [r9 + 1]
sub r10, 1
jne 0x140003000
mov rcx, r8
call fcn.140002230
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rcx, qword [rbp + 0xf8]
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call rax
mov r13, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140003145
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor sil, sil
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x1400030b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f3
call fcn.14000b594
mov qword [rbp + 0x108], r12
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r12w
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x140003117
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003112
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035ed
call fcn.14000b594
movzx eax, sil
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.14000adb0
mov rbx, qword [rsp + 0x9d8]
add rsp, 0x990
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, r15
cmp qword [r15 + 0x18], 8
jb 0x140003152
mov rdx, qword [r15]
mov word [rbp + 0x460], r12w
mov word [rbp + 0x670], r12w
mov dword [rsp + 0x54], r12d
lea rbx, str.WinHttpCloseHandle
test rdx, rdx
je 0x14000357e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0x80], esi
mov dword [rbp + 0xa0], 0x104
lea rax, [rbp + 0x460]
mov qword [rbp + 0x98], rax
mov dword [rbp + 0xd0], 0x104
lea rax, [rbp + 0x670]
mov qword [rbp + 0xc8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
lea r8, [rbp + 0x80]
call fcn.140002940
test al, al
je 0x14000357e
mov esi, r12d
mov eax, 0x800000
cmp dword [rsp + 0x54], 4
cmove esi, eax
mov ecx, r12d
mov al, 0x57
lea r9, str.WinHttpConnect
cmp al, 0x7e
ja 0x140003231
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x140003222
mov r8, rdi
test ecx, ecx
je 0x140003267
mov r10d, ecx
nop dword [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r14
lea r9, [r9 + 1]
sub r10, 1
jne 0x140003240
mov rcx, r8
call fcn.140002230
xor r9d, r9d
movzx r8d, word [rsp + 0x50]
lea rdx, [rbp + 0x460]
mov rcx, r13
call rax
mov r12, rax
test rax, rax
jne 0x14000329a
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor sil, sil
jmp 0x140003581
xor eax, eax
mov ecx, eax
mov al, 0x57
lea r9, str.WinHttpOpenRequest
cmp al, 0x7e
ja 0x1400032b6
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x1400032a7
mov r8, rdi
test ecx, ecx
je 0x1400032e7
mov r10d, ecx
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r14
lea r9, [r9 + 1]
sub r10, 1
jne 0x1400032c0
mov rcx, r8
call fcn.140002230
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 8
cmovae rdx, qword [rbp + 0x118]
mov dword [rsp + 0x30], esi
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, [rbp + 0x670]
mov rcx, r12
call rax
mov r14, rax
test rax, rax
jne 0x14000333b
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor sil, sil
jmp 0x140003509
cmp esi, 0x800000
jne 0x1400033e9
mov dword [rbp + 0xf0], 0x3300
xor eax, eax
mov ecx, eax
mov al, 0x57
lea r9, str.WinHttpSetOption
nop
cmp al, 0x7e
ja 0x14000336f
inc ecx
movzx eax, byte [rcx + r9]
cmp al, 0x20
jge 0x140003360
mov r8, rdi
movabs rsi, 0x100000001b3
test ecx, ecx
je 0x1400033b7
mov r10d, ecx
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, rsi
lea r9, [r9 + 1]
sub r10, 1
jne 0x140003390
mov rcx, r8
call fcn.140002230
mov r9d, 4
lea r8, [rbp + 0xf0]
lea edx, [r9 + 0x1b]
mov rcx, r14
call rax
test eax, eax
jne 0x1400033f3
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor sil, sil
xor eax, eax
jmp 0x1400034a4
movabs rsi, 0x100000001b3
xor eax, eax
mov ecx, eax
mov al, 0x57
lea r10, str.WinHttpSetTimeouts
cmp al, 0x7e
ja 0x14000340f
inc ecx
movzx eax, byte [rcx + r10]
cmp al, 0x20
jge 0x140003400
mov r8, rdi
test ecx, ecx
je 0x140003447
mov r11d, ecx
nop dword [rax]
movsx ecx, byte [r10]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, rsi
lea r10, [r10 + 1]
sub r11, 1
jne 0x140003420
mov rcx, r8
call fcn.140002230
mov dword [rsp + 0x20], 0x7530
mov edx, 0x7530
mov r9d, edx
mov r8d, edx
mov rcx, r14
call rax
mov r9d, dword [rbp + 0x60]
mov r8, qword [rbp + 0x68]
mov rdx, r14
mov rcx, r15
call fcn.140003600
test al, al
jne 0x140003485
xor sil, sil
xor eax, eax
jmp 0x1400034a4
mov r9, qword [rbp + 0x70]
mov r8, qword [rbp + 0x78]
mov rdx, r14
call fcn.140003c70
mov cl, 1
movzx esi, cl
test al, al
mov eax, 0
cmove esi, eax
mov ecx, eax
mov al, 0x57
cmp al, 0x7e
ja 0x1400034b6
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x1400034a8
mov r8, rdi
test ecx, ecx
je 0x1400034fc
mov r9, rbx
mov r10d, ecx
movabs r13, 0x100000001b3
nop dword [rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r13
lea r9, [r9 + 1]
sub r10, 1
jne 0x1400034d0
mov r13, qword [rsp + 0x40]
mov rcx, r8
call fcn.140002230
mov rcx, r14
call rax
xor eax, eax
mov ecx, eax
mov al, 0x57
nop
cmp al, 0x7e
ja 0x14000351e
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003510
mov r8, rdi
test ecx, ecx
je 0x14000356c
mov r9, rbx
mov r10d, ecx
movabs r13, 0x100000001b3
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor r8, rax
imul r8, r13
lea r9, [r9 + 1]
sub r10, 1
jne 0x140003540
mov r13, qword [rsp + 0x40]
mov rcx, r8
call fcn.140002230
mov rcx, r12
call rax
xor r12d, r12d
jmp 0x140003581
xor sil, sil
mov ecx, r12d
mov al, 0x57
cmp al, 0x7e
ja 0x140003594
inc ecx
movzx eax, byte [rcx + rbx]
cmp al, 0x20
jge 0x140003586
test ecx, ecx
je 0x1400035db
mov r8d, ecx
movabs r13, 0x100000001b3
nop word [rax + rax]
movsx ecx, byte [rbx]
mov edx, ecx
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
cdqe
xor rdi, rax
imul rdi, r13
lea rbx, [rbx + 1]
sub r8, 1
jne 0x1400035b0
mov r13, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140002230
mov rcx, r13
call rax
jmp 0x140003071
call fcn.1400122ec
nop
call fcn.1400122ec
int3