Function at 0x44a9e0
Capabilities:
Hash data with md5

Disassembly:
test rdx, rdx
je 0x44b435
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e30]
mov eax, 0x1f30
call fcn.00422ec0
sub rsp, rax
xor r15d, r15d
lea r14, [rdx + 0x190]
mov rsi, r8
mov r13, rdx
cmp word [r14], r15w
je 0x44b41b
lea rbx, [rdx + 0x2e0]
cmp word [rbx], r15w
je 0x44b41b
call fcn.004354d0
and eax, 7
lea edi, [rax + rax*4]
add edi, edi
call fcn.004354d0
and eax, 7
add eax, edi
lea edi, [rax + rax*4]
add edi, edi
call fcn.004354d0
and eax, 7
add eax, edi
lea edi, [rax + rax*4]
add edi, edi
call fcn.004354d0
and eax, 7
add eax, edi
lea edi, [rax + rax*4]
add edi, edi
call fcn.004354d0
and eax, 7
xor ecx, ecx
add eax, 0x2710
add eax, edi
mov dword [rbp + 0x1e78], eax
call fcn.004370d4
mov qword [rbp + 0x1e88], rax
lea r8d, [r15 + 0x42]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], r15d
mov qword [rbp + 0x18], rax
lea rcx, [rbp - 0x40]
lea rax, [0x0048d7b0]
mov dword [rbp + 0x24], 0x800
mov qword [rbp + 0x10], rax
xor edx, edx
lea rax, [rbp + 0x1048]
mov word [rbp + 0x28], r15w
mov qword [rbp + 0x1038], rax
lea rax, [0x0048d7f8]
mov qword [rbp + 0x1030], rax
mov dword [rbp + 0x1040], r15d
mov dword [rbp + 0x1044], 0x400
mov word [rbp + 0x1048], r15w
call fcn.00424830
xor edx, edx
lea r8d, [r15 + 0x58]
lea rcx, [rsp + 0x60]
call fcn.00424830
mov rax, qword [rbp + 0x1e88]
lea rdi, [r13 + 0x90]
xor r8d, r8d
mov byte [rbp - 0x48], r15b
lea r12, [r13 + 0x1d20]
mov qword [rsp + 0x60], r15
lea r15, [r13 + 0x1e0]
mov dword [rsp + 0x50], 0x67452301
lea rcx, [r13 + 0xae0]
mov dword [rsp + 0x54], 0xefcdab89
lea rdx, [r13 + 0xbe0]
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x5c], 0x10325476
cmp word [rdi], r8w
jne 0x44abca
mov qword [rsp + 0x40], rax
mov r9, rdx
mov eax, dword [rbp + 0x1e78]
lea rdx, str._s_s_s_s_s_05u_I64df4CNRGjyeB4Q8d7T5CURPQTh
mov dword [rsp + 0x38], eax
mov r8, rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x1030]
call fcn.004012e8
mov r8, qword [rbp + 0x1e70]
lea rdx, str.https:___s_s_event_s
add r8, 0x2a
mov qword [rsp + 0x20], rbx
mov r9, rsi
lea rcx, [rbp + 0x10]
call fcn.004012e8
jmp 0x44ac2e
mov qword [rsp + 0x48], rax
mov r9, rbx
mov eax, dword [rbp + 0x1e78]
mov r8, rdi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x1030]
mov qword [rsp + 0x20], rdx
lea rdx, str._s_s_s_s_s_s_05u_I64df4CNRGjyeB4Q8d7T5CURPQTh
call fcn.004012e8
mov r8, qword [rbp + 0x1e70]
lea rdx, str.https:___s_s_event_s_s
add r8, 0x2a
mov qword [rsp + 0x28], rbx
mov r9, rsi
mov qword [rsp + 0x20], rdi
lea rcx, [rbp + 0x10]
call fcn.004012e8
mov eax, dword [rbp + 0x1040]
mov edi, 0x20
mov r8, qword [rbp + 0x1038]
xor esi, esi
lea r9d, [rdi + 0xb]
test eax, eax
je 0x44ac76
test r8, r8
je 0x44ac76
mov ecx, esi
test eax, eax
je 0x44ac76
mov edx, ecx
cmp word [r8 + rdx*2], r9w
jne 0x44ac70
mov word [r8 + rdx*2], di
mov eax, dword [rbp + 0x1040]
mov r8, qword [rbp + 0x1038]
inc ecx
cmp ecx, eax
jb 0x44ac55
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0x1850]
or rbx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x5db
mov r9d, ebx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rbp + 0x1850]
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x44acb2
lea rdx, [rbp + 0x1850]
lea rcx, [rsp + 0x50]
call fcn.00460f78
lea rcx, [rsp + 0x50]
call fcn.0046105c
cmp byte [rbp - 0x48], sil
je 0x44ad22
lea r15, [rbp - 0x58]
movzx edi, byte [r15]
lea ecx, [rsi + rsi]
mov eax, ecx
lea r9, [0x00486270]
mov edx, 0x21
mov dword [rsp + 0x20], edi
sub edx, ecx
mov r8, rbx
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
call fcn.004020a8
inc esi
inc r15
cmp esi, 0x10
jb 0x44ace0
xor esi, esi
lea r15, [r13 + 0x1e0]
mov word [rbp], si
mov edx, 0x21
lea rcx, [rbp - 0x40]
call fcn.0043771c
mov r9, qword [rbp + 0x1e88]
lea rdx, str._05u_I64d
mov r8d, dword [rbp + 0x1e78]
lea rcx, [rbp + 0x1030]
call fcn.004012e8
mov rdx, qword [rbp + 0x18]
lea rdi, [rbp + 0x1850]
xor eax, eax
mov ecx, 0x5dc
rep stosb byte [rdi], al
mov ecx, dword [rbp + 0x20]
cmp word [r14], si
je 0x44ae0f
test rdx, rdx
je 0x44aeaf
lea eax, [rcx + 4]
cmp eax, dword [rbp + 0x24]
jae 0x44ada8
mov rax, qword [str.id]
mov qword [rdx + rcx*2], rax
mov eax, dword [rbp + 0x20]
add eax, 4
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], si
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44aeaf
test r14, r14
je 0x44aeaf
mov rdi, rbx
inc rdi
cmp word [r14 + rdi*2], si
jne 0x44adbd
test edi, edi
je 0x44aeaf
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44aeaf
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r14
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
xor r14d, r14d
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
jmp 0x44aeb2
xor r14d, r14d
cmp word [r12], r14w
jne 0x44aeb2
test rdx, rdx
je 0x44ae50
lea eax, [rcx + 4]
cmp eax, dword [rbp + 0x24]
jae 0x44ae50
mov rax, qword [str.id]
mov qword [rdx + rcx*2], rax
mov eax, dword [rbp + 0x20]
add eax, 4
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rsi, qword [rbp + 0x1e70]
lea r9, [rsi + 0x22a]
test rdx, rdx
je 0x44aeb9
test r9, r9
je 0x44aeb9
mov rdi, rbx
inc rdi
cmp word [r9 + rdi*2], r14w
jne 0x44ae6b
test edi, edi
je 0x44aeb9
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44aeb9
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r9
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
jmp 0x44aeb9
xor r14d, r14d
mov rsi, qword [rbp + 0x1e70]
cmp word [r12], r14w
je 0x44af64
test rdx, rdx
je 0x44af64
lea eax, [rcx + 0xd]
cmp eax, dword [rbp + 0x24]
jae 0x44af15
movups xmm0, xmmword [str.utm_company]
movups xmmword [rdx + rcx*2], xmm0
movsd xmm1, qword [0x0048d280]
movsd qword [rdx + rcx*2 + 0x10], xmm1
movzx eax, word [0x0048d288]
mov word [rdx + rcx*2 + 0x18], ax
mov eax, dword [rbp + 0x20]
add eax, 0xd
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44af64
test r12, r12
je 0x44af64
mov rdi, rbx
inc rdi
cmp word [r12 + rdi*2], r14w
jne 0x44af22
test edi, edi
je 0x44af64
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44af64
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r12
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
cmp word [r15], r14w
je 0x44b00e
test rdx, rdx
je 0x44b00e
lea eax, [rcx + 0xd]
cmp eax, dword [rbp + 0x24]
jae 0x44afbf
movups xmm0, xmmword [str.utm_website]
movups xmmword [rdx + rcx*2], xmm0
movsd xmm1, qword [0x0048d2a0]
movsd qword [rdx + rcx*2 + 0x10], xmm1
movzx eax, word [0x0048d2a8]
mov word [rdx + rcx*2 + 0x18], ax
mov eax, dword [rbp + 0x20]
add eax, 0xd
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b00e
test r15, r15
je 0x44b00e
mov rdi, rbx
inc rdi
cmp word [r15 + rdi*2], r14w
jne 0x44afcc
test edi, edi
je 0x44b00e
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44b00e
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r15
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
cmp qword [r13 + 8], r14
jne 0x44b070
lea r9, [rsi + 0x137a]
cmp word [r9], r14w
je 0x44b070
test rdx, rdx
je 0x44b070
test r9, r9
je 0x44b070
mov rdi, rbx
inc rdi
cmp word [r9 + rdi*2], r14w
jne 0x44b02e
test edi, edi
je 0x44b070
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44b070
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r9
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
lea r9, [r13 + 0xae0]
cmp word [r9], r14w
je 0x44b11f
test rdx, rdx
je 0x44b11f
lea eax, [rcx + 0xe]
cmp eax, dword [rbp + 0x24]
jae 0x44b0d0
movaps xmm0, xmmword [0x0048cf50]
movups xmmword [rdx + rcx*2], xmm0
movsd xmm1, qword [0x0048cf60]
movsd qword [rdx + rcx*2 + 0x10], xmm1
mov eax, dword [0x0048cf68]
mov dword [rdx + rcx*2 + 0x18], eax
mov eax, dword [rbp + 0x20]
add eax, 0xe
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b11f
test r9, r9
je 0x44b11f
mov rdi, rbx
inc rdi
cmp word [r9 + rdi*2], r14w
jne 0x44b0dd
test edi, edi
je 0x44b11f
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44b11f
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r9
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
lea r9, [r13 + 0xbe0]
cmp word [r9], r14w
je 0x44b1c4
test rdx, rdx
je 0x44b1c4
lea eax, [rcx + 0xc]
cmp eax, dword [rbp + 0x24]
jae 0x44b175
movaps xmm0, xmmword [0x0048cf90]
movups xmmword [rdx + rcx*2], xmm0
movsd xmm1, qword [0x0048cfa0]
movsd qword [rdx + rcx*2 + 0x10], xmm1
mov eax, dword [rbp + 0x20]
add eax, 0xc
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b1c4
test r9, r9
je 0x44b1c4
mov rdi, rbx
inc rdi
cmp word [r9 + rdi*2], r14w
jne 0x44b182
test edi, edi
je 0x44b1c4
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44b1c4
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r9
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
lea r9, [r13 + 0xce0]
cmp word [r9], r14w
je 0x44b265
cmp word [r9], 0x26
je 0x44b212
test rdx, rdx
je 0x44b351
lea eax, [rcx + 1]
cmp eax, dword [rbp + 0x24]
jae 0x44b212
movzx eax, word [0x0048d018]
mov word [rdx + rcx*2], ax
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b351
test r9, r9
je 0x44b265
mov rdi, rbx
inc rdi
cmp word [r9 + rdi*2], r14w
jne 0x44b223
test edi, edi
je 0x44b265
lea eax, [rcx + rdi]
cmp eax, dword [rbp + 0x24]
jae 0x44b265
lea rcx, [rdx + rcx*2]
mov r8d, edi
add r8, r8
mov rdx, r9
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, edi
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b351
lea eax, [rcx + 0xb]
cmp eax, dword [rbp + 0x24]
jae 0x44b2b2
movups xmm0, xmmword [str.signature]
movups xmmword [rdx + rcx*2], xmm0
mov eax, dword [0x0048d2c0]
mov dword [rdx + rcx*2 + 0x10], eax
movzx eax, word [0x0048d2c4]
mov word [rdx + rcx*2 + 0x14], ax
mov eax, dword [rbp + 0x20]
add eax, 0xb
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b351
lea rax, [rbp - 0x40]
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x44b2bf
test ebx, ebx
je 0x44b304
lea eax, [rcx + rbx]
cmp eax, dword [rbp + 0x24]
jae 0x44b304
mov eax, ecx
mov r8d, ebx
add r8, r8
lea rcx, [rdx + rax*2]
lea rdx, [rbp - 0x40]
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, ebx
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test rdx, rdx
je 0x44b351
mov edi, dword [rbp + 0x1040]
test edi, edi
je 0x44b351
lea eax, [rdi + rcx]
cmp eax, dword [rbp + 0x24]
jae 0x44b351
mov eax, ecx
mov r8d, edi
add r8, r8
lea rcx, [rdx + rax*2]
mov rdx, qword [rbp + 0x1038]
call fcn.00424180
mov eax, dword [rbp + 0x20]
add eax, dword [rbp + 0x1040]
mov dword [rbp + 0x20], eax
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov word [rax + rcx*2], r14w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
test ecx, ecx
je 0x44b386
test rdx, rdx
je 0x44b386
mov eax, r14d
test ecx, ecx
je 0x44b386
mov r8d, 0x20
lea r9d, [r8 + 0xb]
mov edi, eax
cmp word [rdx + rdi*2], r8w
jne 0x44b380
mov word [rdx + rdi*2], r9w
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
inc eax
cmp eax, ecx
jb 0x44b36b
xor eax, eax
lea rdi, [rbp - 0x40]
lea ecx, [rax + 0x42]
rep stosb byte [rdi], al
lea rdi, [rsi + 0x1780]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
mov r8, qword [r13 + 8]
test r8, r8
je 0x44b3d4
lea rdx, str.uniq_I64u
lea rcx, [rbp + 0x1030]
call fcn.004012e8
mov rax, qword [rdi]
lea rdx, str.Cookie
mov r8, qword [rbp + 0x1038]
mov rcx, rdi
call qword [rax + 0x48]
lea r8, [r13 + 0x10]
cmp word [r8], r14w
je 0x44b3ee
mov rax, qword [rdi]
lea rdx, str.X_Forwarded_For
mov rcx, rdi
call qword [rax + 0x48]
mov rdx, qword [rbp + 0x18]
mov rcx, rsi
call fcn.00448c08
mov rdi, qword [rbp + 0x18]
mov dword [rbp + 0x20], r14d
test rdi, rdi
je 0x44b411
mov ecx, dword [rbp + 0x24]
add rcx, rcx
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.00460f44
mov rbx, qword [rsp + 0x1f80]
add rsp, 0x1f30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret