Function at 0x180001000
Capabilities:
Contain obfuscated stackstrings
Initialize winhttp library
Prepare http request
Print debug messages
Receive http response

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x180016008]
xor rax, rsp
mov qword [rbp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x450047
lea rcx, str.SSSS
mov dword [rsp + 0x44], 0x54
mov edi, ebx
mov dword [rsp + 0x50], 0x6f004d
mov dword [rsp + 0x54], 0x69007a
mov dword [rsp + 0x58], 0x6c006c
mov dword [rsp + 0x5c], 0x2f0061
mov dword [rsp + 0x60], 0x2e0035
mov dword [rsp + 0x64], 0x200030
mov dword [rsp + 0x68], 0x570028
mov dword [rsp + 0x6c], 0x6e0069
mov dword [rsp + 0x70], 0x6f0064
mov dword [rsp + 0x74], 0x730077
mov dword [rsp + 0x78], 0x4e0020
mov dword [rsp + 0x7c], 0x200054
mov dword [rbp - 0x80], 0x300031
mov dword [rbp - 0x7c], 0x30002e
mov dword [rbp - 0x78], 0x200029
mov dword [rbp - 0x74], 0x700041
mov dword [rbp - 0x70], 0x6c0070
mov dword [rbp - 0x6c], 0x570065
mov dword [rbp - 0x68], 0x620065
mov dword [rbp - 0x64], 0x69004b
mov dword [rbp - 0x60], 0x2f0074
mov dword [rbp - 0x5c], 0x330035
mov dword [rbp - 0x58], 0x2e0037
mov dword [rbp - 0x54], 0x360033
mov dword [rbp - 0x50], 0x280020
mov dword [rbp - 0x4c], 0x48004b
mov dword [rbp - 0x48], 0x4d0054
mov dword [rbp - 0x44], 0x2c004c
mov dword [rbp - 0x40], 0x6c0020
mov dword [rbp - 0x3c], 0x6b0069
mov dword [rbp - 0x38], 0x200065
mov dword [rbp - 0x34], 0x650047
mov dword [rbp - 0x30], 0x6b0063
mov dword [rbp - 0x2c], 0x29006f
mov dword [rbp - 0x28], 0x430020
mov dword [rbp - 0x24], 0x720068
mov dword [rbp - 0x20], 0x6d006f
mov dword [rbp - 0x1c], 0x2f0065
mov dword [rbp - 0x18], 0x320034
mov dword [rbp - 0x14], 0x30002e
mov dword [rbp - 0x10], 0x32002e
mov dword [rbp - 0xc], 0x310033
mov dword [rbp - 8], 0x2e0031
mov dword [rbp - 4], 0x330031
mov dword [rbp], 0x200035
mov dword [rbp + 4], 0x610053
mov dword [rbp + 8], 0x610066
mov dword [rbp + 0xc], 0x690072
mov dword [rbp + 0x10], 0x35002f
mov dword [rbp + 0x14], 0x370033
mov dword [rbp + 0x18], 0x33002e
mov dword [rbp + 0x1c], 0x200036
mov dword [rbp + 0x20], 0x640045
mov dword [rbp + 0x24], 0x650067
mov dword [rbp + 0x28], 0x31002f
mov dword [rbp + 0x2c], 0x2e0032
mov dword [rbp + 0x30], 0x300031
mov dword [rbp + 0x34], 0x330031
mov dword [rbp + 0x38], 0x36
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r14, rax
test rax, rax
je 0x1800012fc
lea r8d, [rbx + 0x50]
xor r9d, r9d
lea rdx, str.google.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
test rax, rax
je 0x1800012d7
mov dword [rsp + 0x30], ebx
lea r8, [0x180014610]
mov qword [rsp + 0x28], rbx
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rdi, rax
test rax, rax
je 0x1800012d7
xor r9d, r9d
lea edx, [rbx + 0x72]
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
je 0x1800012d7
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1800012d7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1800012d7
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpWebSocketCompleteUpgrade]
test rax, rax
je 0x1800012d7
mov rcx, r14
mov ebx, 1
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x1800012e5
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rsi, rsi
je 0x1800012ee
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test rdi, rdi
je 0x1800012fc
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.180001370
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret