Function at 0x140001dc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r15, rdx
mov r14, rcx
xor edi, edi
mov r13, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x1400021cf
cmp qword [r14 + 0x18], 0xf
jbe 0x140001e1a
mov r14, qword [r14]
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x69], xmm1
lea r12, [r13 + 1]
mov ebx, 0xf
lea rsi, [rbp - 0x79]
cmp r12, rbx
jbe 0x140001eb8
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001e73
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005040
test rax, rax
je 0x140001e9b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001eb4
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ea2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400021d5
jmp 0x140001e58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001eb1
call fcn.140005040
mov rsi, rax
jmp 0x140001eb4
mov rsi, rdi
mov qword [rbp - 0x79], rsi
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x61], rbx
mov byte [rsi], 0x22
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], dil
mov rcx, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x61]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140001f10
lea rax, [rcx + 2]
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x79]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x79]
mov word [rax + rcx], 0x2022
mov byte [rax + rcx + 2], 0
lea rax, [rbp - 0x79]
jmp 0x140001f2e
mov qword [rsp + 0x20], 2
lea r9, [0x1400075b4]
mov edx, 2
lea rcx, [rbp - 0x79]
call fcn.140004cb0
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x59], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x49], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140001f68
mov r9, qword [r15]
mov rsi, qword [r15 + 0x10]
mov rcx, qword [rbp - 0x49]
mov rdx, qword [rbp - 0x41]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140001faf
lea rax, [rcx + rsi]
mov qword [rbp - 0x49], rax
lea rbx, [rbp - 0x59]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x59]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
lea rax, [rbp - 0x59]
jmp 0x140001fc0
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x59]
call fcn.140004cb0
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x14000202b
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002026
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002026
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x14000207a
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002075
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
movdqa xmm0, xmmword [0x1400076b0]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
movdqa xmm0, xmmword [0x1400076e0]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400076f0]
movdqu xmmword [rbp - 0x29], xmm1
mov dword [rbp - 0x19], 0x7e4c6d76
mov dword [rbp - 0x15], 0x70776e6e
mov dword [rbp - 0x11], 0x56707d4e
mov word [rbp - 0xd], 0x4a
mov byte [rbp - 0xb], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdi - 8]
xor byte [rbp + rdi - 0x39], al
inc rdi
cmp rdi, 0x2d
jb 0x1400020d0
mov byte [rbp - 0xb], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000214d
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0xf
cmova rcx, qword [rbp - 1]
mov eax, dword [rbp + 0xf]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SystemRuntime
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000216a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400049b0
mov rcx, rax
lea rdx, [0x140004b60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x1400021a8
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000507c
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140005020
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3