Function at 0x1800481d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [r11 - 0xa8]
sub rsp, 0x190
mov rax, qword [0x18009e040]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r14d, r14d
mov rsi, rdx
cmp qword [0x1800a4848], r14
mov rdi, rcx
jne 0x180048713
cmp byte [0x180088543], r14b
movups xmm2, xmmword [str.qRLzOINXPK]
mov edx, dword [0x180088540]
movdqa xmm4, xmmword [0x1800886e0]
movdqa xmm5, xmmword [0x1800886d0]
mov r9d, dword [0x18009e0a0]
movaps xmmword [r11 - 0x28], xmm6
movdqa xmm6, xmmword [0x1800886c0]
movaps xmmword [r11 - 0x38], xmm7
movdqa xmm7, xmmword [0x180088740]
movaps xmmword [r11 - 0x48], xmm8
movdqa xmm8, xmmword [0x180088730]
movaps xmmword [r11 - 0x58], xmm9
movdqa xmm9, xmmword [str.7777]
movaps xmmword [r11 - 0x68], xmm10
movdqa xmm10, xmmword [0x180088750]
movups xmmword [rsp + 0x48], xmm2
mov dword [rsp + 0x58], edx
je 0x1800484af
mov ecx, r14d
cmp r9d, 2
jl 0x18004847c
movd eax, xmm2
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
movdqa xmm0, xmm6
pmuldq xmm1, xmm7
movdqa xmm2, xmmword [0x1800886f0]
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm6
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, eax
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm5
movd dword [rsp + 0x48], xmm1
movdqa xmm1, xmm5
punpckldq xmm1, xmm5
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm5
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm5
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, dword [rsp + 0x4c]
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm4
movd dword [rsp + 0x4c], xmm1
movdqa xmm1, xmm4
punpckldq xmm1, xmm4
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm4
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm4
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, dword [rsp + 0x50]
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
movd dword [rsp + 0x50], xmm1
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm7
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movdqa xmm3, xmmword [0x180088700]
paddb xmm2, xmm10
movd xmm0, dword [rsp + 0x54]
movdqa xmm1, xmm3
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movdqa xmm0, xmm3
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm7
movd dword [rsp + 0x54], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm3, xmm0
movd xmm0, edx
andps xmm3, xmm8
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm10
xorps xmm3, xmm0
movd dword [rsp + 0x58], xmm3
jmp 0x1800484af
lea r8, [rsp + 0x48]
mov eax, 0x29e4129f
lea r8, [r8 + 1]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x37
movzx eax, cl
inc ecx
sub al, dl
add al, 0x36
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x180048481
movsd xmm0, qword [str.rjw]
mov r8d, r14d
movzx eax, byte [0x180088554]
mov ecx, dword [0x180088550]
movsd qword [rsp + 0x38], xmm0
mov byte [rsp + 0x44], al
mov dword [rsp + 0x40], ecx
cmp r9d, 2
jl 0x180048601
movdqa xmm1, xmm6
movd eax, xmm10
punpckldq xmm1, xmm6
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
mov r8d, reloc.WS2_32.dll_inet_ntoa
pmuldq xmm0, xmm7
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm5
pmulld xmm0, xmm9
psubd xmm6, xmm0
punpckldq xmm1, xmm5
pmuldq xmm1, xmm7
andps xmm6, xmm8
packuswb xmm6, xmm6
packuswb xmm6, xmm6
movd xmm0, eax
paddb xmm6, xmm0
movd xmm0, dword [str.rjw]
xorps xmm6, xmm0
movdqa xmm0, xmm5
punpckhdq xmm0, xmm5
pmuldq xmm0, xmm7
movd dword [rsp + 0x38], xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rsp + 0x3c]
pmulld xmm0, xmm9
psubd xmm5, xmm0
movd xmm0, eax
andps xmm5, xmm8
packuswb xmm5, xmm5
packuswb xmm5, xmm5
paddb xmm5, xmm0
movdqa xmm0, xmm4
punpckhdq xmm0, xmm4
xorps xmm5, xmm1
movdqa xmm1, xmm4
pmuldq xmm0, xmm7
punpckldq xmm1, xmm4
pmuldq xmm1, xmm7
movd dword [rsp + 0x3c], xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, ecx
pmulld xmm0, xmm9
psubd xmm4, xmm0
movd xmm0, eax
andps xmm4, xmm8
packuswb xmm4, xmm4
packuswb xmm4, xmm4
paddb xmm4, xmm0
xorps xmm4, xmm1
movd dword [rsp + 0x40], xmm4
movaps xmm10, xmmword [rsp + 0x140]
lea r9, [rsp + 0x38]
movaps xmm9, xmmword [rsp + 0x150]
movaps xmm8, xmmword [rsp + 0x160]
movaps xmm7, xmmword [rsp + 0x170]
movaps xmm6, xmmword [rsp + 0x180]
mov eax, r8d
add r9, rax
nop word [rax + rax]
mov eax, 0x94f2095
lea r9, [r9 + 1]
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x180048640
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1800480e0
mov rbx, rax
test rax, rax
je 0x180048b69
xor eax, eax
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x38], eax
lea rcx, [rbx + 2]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov r9d, 3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x48], 0x2244cc
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
movsxd rcx, dword [rsp + 0x38]
add rcx, 6
add rcx, rbx
mov qword [0x1800a4850], rcx
je 0x180048b69
call fcn.18004b920
mov qword [0x1800a4848], rax
test rax, rax
je 0x180048b69
mov ecx, 0x400
mov dword [rsp + 0x70], 0xf93d83
mov dword [rsp + 0x74], 0xf010000
mov dword [rsp + 0x78], 0x9685
mov dword [rsp + 0x7c], 0xe905c700
mov dword [rbp - 0x80], r14d
mov dword [rbp - 0x7c], 0x50000000
mov dword [rbp - 0x78], 0x54535251
mov dword [rbp - 0x74], 0x41575655
mov dword [rbp - 0x70], 0x41514150
mov dword [rbp - 0x6c], 0x41534152
mov dword [rbp - 0x68], 0x41554154
mov dword [rbp - 0x64], 0x9c574156
mov dword [rbp - 0x60], 0xec8148
mov dword [rbp - 0x5c], 0x48000002
mov qword [rbp - 0x58], 0xb9
mov qword [rbp - 0x50], 0xba4800
mov dword [rbp - 0x48], 0x49000000
mov qword [rbp - 0x44], 0xb8
mov qword [rbp - 0x3c], 0xb94900
mov dword [rbp - 0x34], 0xff000000
mov dword [rbp - 0x30], 0x215
mov qword [rbp - 0x2c], 0x8eb00
mov dword [rbp - 0x24], 0x48000000
mov byte [rbp - 0x20], 0xa3
mov dword [rbp - 0x17], 0x18d05c7
mov dword [rbp - 0x13], 0x10000
mov dword [rbp - 0xf], 0x81480000
mov dword [rbp - 0xb], 0x200c4
mov dword [rbp - 7], 0x5f419d00
mov dword [rbp - 3], 0x5d415e41
mov dword [rbp + 1], 0x5b415c41
mov dword [rbp + 5], 0x59415a41
mov dword [rbp + 9], 0x5e5f5841
mov dword [rbp + 0xd], 0x5a5b5c5d
mov dword [rbp + 0x11], 0x15ff5859
mov dword [rbp + 0x15], 2
mov word [rbp + 0x19], 0x8eb
mov byte [rbp + 0x23], 0xc3
call fcn.180047f30
mov qword [0x1800a4858], rax
test rax, rax
je 0x180048b69
mov rcx, qword [0x1800a4848]
mov r9d, 3
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov qword [rbp + 0x1b], rcx
xor edx, edx
lea rcx, [rax + 0x200]
mov dword [rsp + 0x28], 0x28
lea rax, [rsp + 0x70]
mov qword [rbp - 0x1f], rcx
mov qword [rsp + 0x58], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffffc0000001
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 0x22451c
mov qword [rsp + 0x60], 0xb4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, qword [0x1800a4850]
mov r9d, 3
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x68], rax
xor edx, edx
lea rax, [rsp + 0x48]
mov dword [rsp + 0x30], r14d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 0x2245e4
mov qword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], 8
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [0x1800a4858]
mov rcx, qword [0x1800a4850]
call fcn.18004b9a0
mov rax, qword [0x1800a4850]
mov r9d, 3
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x58], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 0x2245e4
mov qword [rsp + 0x60], 8
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x1800a4850]
call fcn.18004b920
mov rcx, qword [0x1800a4858]
cmp rax, rcx
jne 0x180048b69
add rcx, 0x39
mov rdx, rsi
call fcn.18004b9a0
mov rcx, qword [0x1800a4858]
mov rdx, rdi
add rcx, 0x67
call fcn.18004b9a0
mov rcx, qword [0x1800a4858]
xor edx, edx
add rcx, 0x200
call fcn.18004b9a0
mov rcx, qword [0x1800a4858]
add rcx, 0x100
call fcn.18004ba30
nop dword [rax + rax]
xor eax, eax
mov dword [rsp + 0x28], 0x28
mov dword [rsp + 0x38], eax
mov r9d, 3
mov rax, qword [0x1800a4858]
xor r8d, r8d
add rax, 0x210
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x50], rax
xor edx, edx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], 0x2244cc
mov qword [rsp + 0x58], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x48]
mov qword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [rsp + 0x38], r14d
je 0x1800489e0
mov rcx, qword [0x1800a4858]
add rcx, 0x200
call fcn.18004b920
mov rcx, qword [0x1800a4850]
mov rbx, rax
call fcn.18004b920
cmp rax, qword [0x1800a4848]
je 0x180048b47
mov rcx, qword [0x1800a4850]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov r9d, 3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x28], 0x28
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x48], 0x2245e4
mov qword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], 8
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [0x1800a4848]
mov rcx, qword [0x1800a4850]
call fcn.18004b9a0
mov rax, qword [0x1800a4850]
mov r9d, 3
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov eax, dword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x58], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x28
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 0x2245e4
mov qword [rsp + 0x60], 8
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x1800a4858]
test rcx, rcx
je 0x180048b58
call fcn.180048030
mov rcx, qword [0x1800a4850]
call fcn.18004b920
mov rax, rbx
jmp 0x180048b70
mov rax, 0xffffffffffffff9c
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.180056f00
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret