>However, there is a second stage which is handled by a native library which is obfuscated to hell
That native obfuscated crap still has to do an HTTP request, that's essentially a base64