Function at 0x1000d400
Capabilities:
Encode data using xor
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031c90
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x1003a008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1e0], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0xc]
push 0x3c
mov dword [ebp - 0x1dc], eax
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.1001fb10
add esp, 0xc
mov dword [ebp - 0x1d0], 0
xor eax, eax
mov dword [ebp - 0x1c0], 0
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x1bc], 7
mov word [ebp - 0x1d0], ax
push eax
push 0x10037c8c
call fcn.1000a3a0
mov dword [ebp - 4], 0
xor ecx, ecx
movsd xmm0, qword [0x10037db8]
movsd qword [0x1003a920], xmm0
movsd xmm0, qword [0x10037dd8]
movsd qword [0x1003a910], xmm0
movsd xmm0, qword [0x10037dc0]
movsd qword [0x1003a928], xmm0
movsd xmm0, qword [0x10037db0]
movsd qword [0x1003a918], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x1a8], 0xd0b4e7f7
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x1a4], 0xf6f4e7ee
movaps xmm0, xmmword [0x10037ee0]
movups xmmword [ebp - 0x1b8], xmm0
mov dword [ebp - 0x1a0], 0xeefee8
nop word [eax + eax]
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x1b8], al
inc ecx
cmp ecx, 0x1b
jb 0x1000d520
xor eax, eax
mov byte [ebp - 0x19d], 0
cmp byte [ebp - 0x50], al
je 0x1000d548
nop
inc eax
cmp byte [ebp + eax - 0x50], 0
jne 0x1000d540
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x1d4], 0
add eax, ecx
mov dword [ebp - 0x19c], 0xb1beb3b0
xorps xmm0, xmm0
mov dword [ebp - 0x1e4], eax
lea edi, [ebp - 0x1b8]
mov dword [ebp - 0x198], 0xb9bbbdb7
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x194], 0
xor ecx, ecx
movups xmmword [ebp - 0x20], xmm0
nop dword [eax + eax]
mov al, cl
sub al, 0x7e
xor byte [ebp + ecx - 0x19c], al
inc ecx
cmp ecx, 8
jb 0x1000d590
mov al, byte [ebp - 0x19c]
mov byte [ebp - 0x194], 0
mov byte [ebp - 0x30], al
test al, al
je 0x1000d5d2
xor ecx, ecx
nop word [eax + eax]
lea ecx, [ecx + 1]
mov al, byte [ebp + ecx - 0x19c]
mov byte [ebp + ecx - 0x30], al
test al, al
jne 0x1000d5c0
movsx ecx, byte [ebp - 0x1b8]
mov esi, 3
mov al, cl
mov dword [ebp - 0x1e8], ecx
add al, al
add cl, al
add cl, byte [ebp - 0x30]
inc cl
mov byte [ebp - 0x30], cl
mov ecx, 0xc
movsx eax, byte [ebp - 0x30]
cdq
idiv ecx
mov al, byte [ebp - 0x2f]
or edx, dword [ebp - 0x1e8]
add al, dl
mov byte [ebp - 0x2f], al
mov al, byte [ebp - 0x2f]
mov cl, byte [ebp - 0x30]
and cl, al
add cl, cl
dec cl
add cl, byte [ebp - 0x2d]
mov byte [ebp - 0x2d], cl
movsx ecx, byte [ebp - 0x2d]
mov al, byte [ebp - 0x2c]
sar ecx, 6
add al, cl
mov byte [ebp - 0x2c], al
xor eax, eax
nop
movsx edx, byte [ebp + esi - 0x30]
movsx ecx, byte [ebp + esi - 0x31]
add edx, edx
add ecx, edx
inc esi
lea eax, [eax + ecx*2]
cmp esi, 0x11
jl 0x1000d630
mov ecx, dword [ebp - 0x1d4]
cdq
lea ecx, [ecx*2 + 0x31]
idiv ecx
test edx, edx
jne 0x1000d6a5
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xe
jle 0x1000d67a
mov dword [ebp - 0x1d4], 1
mov edx, dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1b8]
mov al, byte [ebp - 0x1b8]
mov byte [edx], al
test al, al
je 0x1000d6cd
mov eax, ecx
sub edx, eax
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
mov byte [edx + ecx], al
test al, al
jne 0x1000d696
jmp 0x1000d6cd
mov ecx, dword [ebp - 0x1e4]
mov al, byte [ebp - 0x1b8]
mov byte [ecx], al
test al, al
je 0x1000d6cd
lea eax, [ebp - 0x1b8]
sub ecx, eax
nop
mov al, byte [edi + 1]
lea edi, [edi + 1]
mov byte [ecx + edi], al
test al, al
jne 0x1000d6c0
push 0x40
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.1001fb10
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x90]
push 0x10037bd4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
movsd xmm4, qword [0x1003a918]
lea eax, [ebp - 0x90]
movsd xmm6, qword [0x10037da8]
movaps xmm1, xmm4
movsd xmm5, qword [0x1003a928]
addsd xmm1, xmm6
movaps xmm0, xmm5
movsd xmm3, qword [0x1003a910]
movsd xmm2, qword [0x1003a920]
add esp, 0x18
divsd xmm0, xmm1
push 0
push 0
push 0
push 0
push eax
movaps xmm1, xmm4
subsd xmm3, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm6
movsd qword [0x1003a910], xmm3
divsd xmm1, xmm0
movaps xmm0, xmm3
subsd xmm5, xmm1
movaps xmm1, xmm2
addsd xmm0, xmm6
movsd qword [0x1003a928], xmm5
addsd xmm5, xmm6
divsd xmm1, xmm0
divsd xmm3, xmm5
subsd xmm4, xmm1
subsd xmm2, xmm3
movsd qword [0x1003a918], xmm4
movsd qword [0x1003a920], xmm2
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, dword [ebp - 0x1e0]
mov dword [edi + 4], eax
test eax, eax
jne 0x1000d7aa
or esi, 0xffffffff
jmp 0x1000dece
call dword [sym.imp.WINHTTP.dll_WinHttpCheckPlatform]
test eax, eax
jne 0x1000d7bc
lea esi, [eax - 2]
jmp 0x1000dece
movsd xmm1, qword [0x1003a920]
movsd xmm2, qword [0x10037da8]
movaps xmm0, xmm1
movsd xmm5, qword [0x1003a918]
addsd xmm0, xmm2
movsd xmm4, qword [0x1003a910]
movsd xmm3, qword [0x1003a928]
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x228], 0x3c
divsd xmm5, xmm0
mov dword [ebp - 0x214], 0xffffffff
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x208], 0xffffffff
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x1f8], 0xffffffff
mov dword [ebp - 0x1f0], 0xffffffff
movaps xmm0, xmm4
addsd xmm0, xmm2
addsd xmm5, xmm4
divsd xmm1, xmm0
movaps xmm0, xmm3
addsd xmm0, xmm2
addsd xmm1, xmm3
divsd xmm4, xmm0
movaps xmm0, xmm5
addsd xmm0, xmm2
addsd xmm4, xmm5
divsd xmm3, xmm0
movaps xmm0, xmm5
addsd xmm3, xmm1
movaps xmm2, xmm3
mulsd xmm2, xmm4
addsd xmm2, xmm1
movaps xmm1, xmm5
mulsd xmm1, xmm3
mulsd xmm0, xmm2
addsd xmm1, xmm4
movsd qword [0x1003a920], xmm2
addsd xmm0, xmm3
movsd qword [0x1003a910], xmm1
mulsd xmm1, xmm2
movsd qword [0x1003a928], xmm0
addsd xmm1, xmm5
movsd qword [0x1003a918], xmm1
jb 0x1000d8b3
mov eax, dword [eax]
mov ecx, eax
call fcn.1000b700
mov esi, eax
lea ecx, [ebp - 0x1d0]
push esi
call fcn.1000a150
push esi
call fcn.1001e327
movsd xmm3, qword [0x1003a918]
lea ecx, [ebp - 0x228]
movsd xmm1, qword [0x1003a910]
lea eax, [ebp - 0x1d0]
movsd xmm2, qword [0x1003a920]
movaps xmm4, xmm3
mulsd xmm4, qword [0x1003a928]
movaps xmm0, xmm1
add esp, 4
cmp dword [ebp - 0x1bc], 8
mulsd xmm0, xmm2
cmovae eax, dword [ebp - 0x1d0]
mulsd xmm3, xmm2
push ecx
subsd xmm4, xmm2
push 0
push 0
subsd xmm3, xmm1
push eax
subsd xmm0, xmm4
movsd qword [0x1003a928], xmm4
mulsd xmm4, xmm1
movsd qword [0x1003a918], xmm3
movsd qword [0x1003a920], xmm0
subsd xmm4, xmm3
movsd qword [0x1003a910], xmm4
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x1000d965
lea esi, [eax - 3]
jmp 0x1000dece
push dword [ebp - 0x214]
lea ecx, [edi + 0x10]
push dword [ebp - 0x218]
call fcn.1000a3a0
push dword [ebp - 0x1f8]
lea esi, [edi + 0x28]
push dword [ebp - 0x1fc]
mov ecx, esi
call fcn.1000a3a0
push dword [ebp - 0x1f0]
add edi, 0x40
push dword [ebp - 0x1f4]
mov ecx, edi
call fcn.1000a3a0
mov ecx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1d4], edi
mov dword [ecx + 0x58], eax
mov ax, word [ebp - 0x210]
mov word [ecx + 0x5c], ax
cmp dword [edi + 0x14], 8
jb 0x1000d9d3
mov eax, dword [edi]
mov dword [ebp - 0x1d4], eax
mov ecx, dword [edi + 0x10]
mov edi, dword [esi + 0x14]
mov eax, edi
mov edx, dword [esi + 0x10]
sub eax, edx
cmp ecx, eax
ja 0x1000da1b
lea eax, [ecx + edx]
mov dword [ebp - 0x1d8], eax
mov dword [esi + 0x10], eax
cmp edi, 8
jb 0x1000d9f7
mov esi, dword [esi]
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x1d4]
lea eax, [esi + edx*2]
push eax
call fcn.10021000
mov eax, dword [ebp - 0x1d8]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x1000da37
push ecx
push dword [ebp - 0x1d4]
mov byte [ebp - 0x1d8], 0
push dword [ebp - 0x1d8]
push ecx
mov ecx, esi
call fcn.1000a6d0
movsd xmm4, qword [0x1003a920]
movsd xmm5, qword [0x10037da8]
movaps xmm0, xmm4
movsd xmm3, qword [0x1003a918]
addsd xmm0, xmm5
movsd xmm2, qword [0x1003a910]
movsd xmm1, qword [0x1003a928]
mov eax, dword [ebp - 0x1ec]
divsd xmm3, xmm0
cmp dword [eax + 0x14], 0x10
movaps xmm0, xmm2
addsd xmm0, xmm5
addsd xmm3, xmm2
divsd xmm4, xmm0
movaps xmm0, xmm1
movsd qword [0x1003a918], xmm3
addsd xmm0, xmm5
addsd xmm4, xmm1
divsd xmm2, xmm0
movsd qword [0x1003a920], xmm4
addsd xmm2, xmm3
addsd xmm3, xmm5
movsd qword [0x1003a910], xmm2
divsd xmm1, xmm3
addsd xmm1, xmm4
movsd qword [0x1003a928], xmm1
jb 0x1000dac6
mov eax, dword [eax]
mov ecx, eax
call fcn.1000b700
mov edi, dword [ebp - 0x1e0]
mov esi, eax
push esi
lea ecx, [edi + 0x6c]
call fcn.1000a150
push esi
call fcn.1001e327
movsd xmm3, qword [0x1003a928]
lea eax, [ebp - 0x190]
movsd xmm1, qword [0x1003a918]
movaps xmm4, xmm3
mulsd xmm4, qword [0x1003a910]
movaps xmm2, xmm1
push 0xff
mulsd xmm2, xmm3
push 0
push eax
addsd xmm4, qword [0x1003a920]
addsd xmm2, qword [0x1003a910]
movaps xmm0, xmm4
movsd qword [0x1003a920], xmm4
mulsd xmm0, xmm1
movsd qword [0x1003a910], xmm2
mulsd xmm2, xmm4
addsd xmm0, xmm3
addsd xmm2, xmm1
movsd qword [0x1003a928], xmm0
movsd qword [0x1003a918], xmm2
call fcn.1001fb10
add esp, 0x10
lea ecx, [ebp - 0x190]
call fcn.1000ca40
test al, al
je 0x1000dba5
lea ecx, [ebp - 0x190]
call fcn.1000b700
mov esi, eax
mov edx, esi
lea eax, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000db80
sub edx, eax
lea ecx, [edi + 0x84]
sar edx, 1
push edx
push esi
call fcn.1000a3a0
push esi
call fcn.1001e327
add esp, 4
movsd xmm7, qword [0x1003a918]
movsd xmm6, qword [0x10037da8]
movaps xmm1, xmm7
movsd xmm2, qword [0x1003a928]
addsd xmm1, xmm6
movaps xmm0, xmm2
movsd xmm3, qword [0x1003a910]
movsd xmm4, qword [0x1003a920]
mov ecx, dword [ebp - 0x1dc]
divsd xmm0, xmm1
test dword [ecx + 4], 0xffff0000
movaps xmm1, xmm7
subsd xmm3, xmm0
movaps xmm0, xmm4
addsd xmm0, xmm6
movsd qword [0x1003a910], xmm3
divsd xmm1, xmm0
movaps xmm0, xmm3
subsd xmm2, xmm1
movaps xmm1, xmm4
addsd xmm0, xmm6
movsd qword [0x1003a928], xmm2
divsd xmm1, xmm0
movaps xmm0, xmm2
addsd xmm0, xmm6
subsd xmm7, xmm1
movaps xmm1, xmm3
divsd xmm1, xmm0
movsd qword [0x1003a918], xmm7
subsd xmm4, xmm1
movsd qword [0x1003a920], xmm4
je 0x1000de33
mov ecx, dword [ecx]
add ecx, 0x198
cmp dword [ecx + 0x14], 0x10
jb 0x1000dc58
mov ecx, dword [ecx]
call fcn.1000b700
mov esi, eax
mov edx, esi
lea eax, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000dc64
sub edx, eax
lea ecx, [edi + 0x84]
sar edx, 1
push edx
push esi
call fcn.1000a3a0
push esi
call fcn.1001e327
movsd xmm3, qword [0x1003a918]
add esp, 4
movsd xmm1, qword [0x1003a910]
movaps xmm4, xmm3
mulsd xmm4, qword [0x1003a928]
movaps xmm0, xmm1
mov ecx, dword [ebp - 0x1dc]
movsd xmm2, qword [0x1003a920]
mulsd xmm0, xmm2
mov ecx, dword [ecx]
subsd xmm4, xmm2
mulsd xmm3, xmm2
add ecx, 0x1c8
cmp dword [ecx + 0x14], 0x10
subsd xmm0, xmm4
movsd qword [0x1003a928], xmm4
subsd xmm3, xmm1
mulsd xmm4, xmm1
movsd qword [0x1003a920], xmm0
movsd qword [0x1003a918], xmm3
subsd xmm4, xmm3
movsd qword [0x1003a910], xmm4
jb 0x1000dd01
mov ecx, dword [ecx]
call fcn.1000b700
mov esi, eax
mov edx, esi
lea eax, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000dd10
sub edx, eax
lea ecx, [edi + 0x9c]
sar edx, 1
push edx
push esi
call fcn.1000a3a0
push esi
call fcn.1001e327
movsd xmm4, qword [0x1003a920]
add esp, 4
movsd xmm5, qword [0x10037da8]
movaps xmm0, xmm4
movsd xmm3, qword [0x1003a918]
addsd xmm0, xmm5
movsd xmm2, qword [0x1003a910]
movsd xmm1, qword [0x1003a928]
mov eax, dword [ebp - 0x1dc]
divsd xmm3, xmm0
mov ecx, dword [eax]
add ecx, 0x1f8
cmp dword [ecx + 0x14], 0x10
movaps xmm0, xmm2
addsd xmm0, xmm5
addsd xmm3, xmm2
divsd xmm4, xmm0
movaps xmm0, xmm1
movsd qword [0x1003a918], xmm3
addsd xmm0, xmm5
addsd xmm4, xmm1
divsd xmm2, xmm0
movsd qword [0x1003a920], xmm4
addsd xmm2, xmm3
addsd xmm3, xmm5
movsd qword [0x1003a910], xmm2
divsd xmm1, xmm3
addsd xmm1, xmm4
movsd qword [0x1003a928], xmm1
jb 0x1000ddcc
mov ecx, dword [ecx]
call fcn.1000b700
mov esi, eax
mov edx, esi
lea eax, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000dde0
sub edx, eax
lea ecx, [edi + 0xb4]
sar edx, 1
push edx
push esi
call fcn.1000a3a0
push esi
call fcn.1001e327
movsd xmm4, qword [0x1003a920]
add esp, 4
movsd xmm3, qword [0x1003a910]
movsd xmm2, qword [0x1003a928]
movsd xmm7, qword [0x1003a918]
movsd xmm6, qword [0x10037da8]
mov ecx, dword [ebp - 0x1dc]
movaps xmm5, xmm2
mov eax, dword [ecx]
mulsd xmm5, xmm3
xor esi, esi
mov ecx, dword [ecx + 4]
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], ecx
addsd xmm5, xmm4
movaps xmm4, xmm7
mulsd xmm4, xmm2
addsd xmm4, xmm3
movaps xmm3, xmm5
mulsd xmm3, xmm7
addsd xmm3, xmm2
movaps xmm2, xmm4
mulsd xmm2, xmm5
movaps xmm1, xmm3
addsd xmm2, xmm7
movaps xmm0, xmm2
addsd xmm0, xmm6
divsd xmm1, xmm0
movaps xmm0, xmm5
subsd xmm4, xmm1
movaps xmm1, xmm2
addsd xmm0, xmm6
movsd qword [0x1003a910], xmm4
divsd xmm1, xmm0
movaps xmm0, xmm4
subsd xmm3, xmm1
movaps xmm1, xmm5
addsd xmm0, xmm6
movsd qword [0x1003a928], xmm3
addsd xmm3, xmm6
divsd xmm1, xmm0
divsd xmm4, xmm3
subsd xmm2, xmm1
subsd xmm5, xmm4
movsd qword [0x1003a918], xmm2
movsd qword [0x1003a920], xmm5
mov edx, dword [ebp - 0x1bc]
cmp edx, 8
jb 0x1000df0a
mov ecx, dword [ebp - 0x1d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000df00
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000df27
push edx
push ecx
call fcn.1001e35c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001e319
mov esp, ebp
pop ebp
ret
call fcn.10023c5c
int3