Function at 0x14035e110
Capabilities:
Encode data using xor
Set registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140045baf
xor edx, edx
mov r8d, 0x230
lea rcx, [rbp - 0x80]
call fcn.140057410
movabs rax, 0x964b40d0b807cba5
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
mov r8, rsi
lea edx, [rbx + 0x10]
lea rcx, [rbp - 0x78]
call fcn.1400631c0
nop
mov r8, r14
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140063798
xor r9d, r9d
lea rax, [rbp - 0x80]
mov r10d, 1
sub r10, rax
lea rax, [rbp - 0x80]
mov r11d, 2
sub r11, rax
lea rax, [rbp - 0x80]
mov ebx, 3
sub rbx, rax
lea rax, [rbp - 0x80]
mov edi, 4
sub rdi, rax
nop
lea r8, [rbp - 0x80]
add r8, r9
mov rax, r15
mul r9
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x30]
xor byte [r8], al
lea rcx, [r10 + r8]
mov rax, r15
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x31]
xor byte [r8 + 1], al
lea rcx, [r11 + r8]
mov rax, r15
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x32]
xor byte [r8 + 2], al
lea rcx, [rbx + r8]
mov rax, r15
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x33]
xor byte [r8 + 3], al
lea rcx, [rdi + r8]
mov rax, r15
mul rcx
shr rdx, 2
lea rax, [rdx + rdx*4]
mov rcx, r9
sub rcx, rax
movzx eax, byte [rsp + rcx + 0x34]
xor byte [r8 + 4], al
add r9, 5
cmp r9, 0x230
jb 0x140045960
movabs rcx, 0xe9a8cce14f91f345
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], r12
movabs rax, 0xe99accb14fd8f301
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x1c8], r12
movabs rax, 0x7355eecf8500c737
mov qword [rbp + 0x1d0], rax
movabs rax, 0x873a067e0934a3f8
mov qword [rbp + 0x1d8], rax
movabs rax, 0x23cc71ed3c3544a9
mov qword [rbp + 0x1e0], rax
movabs rax, 0x6412e89c66fcd55a
mov qword [rbp + 0x1e8], rax
movabs rcx, 0xe9fccca74fdef316
mov qword [rsp + 0x50], rcx
movabs rcx, 0xb80e6ad2b5d49821
mov qword [rsp + 0x58], rcx
movabs rcx, 0x7336eea6854dc76b
mov qword [rsp + 0x60], rcx
movabs rcx, 0x8755060d095ba38a
mov qword [rsp + 0x68], rcx
movabs rcx, 0x23cc71ed3c4144cf
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rbp + 0x1d0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp + 0x1b0], 0
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140045baf
mov dword [rsp + 0x28], 0x230
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140045baf
mov al, 1
jmp 0x140045bb1
xor al, al
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140052a40
add rsp, 0x300
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
ja 0x140488905
push rdi
xor al, 0xcc
int3
mov r12, qword [rsp + rsi - 0x2024]
shl word [rsp + rsi*2 - 0x4040], 0x93
mov r10b, byte [rsp + 0x6b]
cmovne r9d, dword [rsp + 0x59]
js 0x1400458c8
and r9d, 0xce2a2699
xor rsi, r10
add byte [rsp + 0x58], 0x14
mov r10, qword [rsp + 0x80]
add qword [rsp + 0x48], 0xffffffffbf903167
cmp word [rsp + 0x58], 0x1a08
call int.14052117d
sub r11, 0xffffffffcda95523
xchg qword [rsp + 0x38], rax
mov r13, qword [rsp + 0x30]
and r11, 0x2ba10028
jle 0x14058beef
shl r11d, cl
mov r11, qword [rsp + 0x18]
call fcn.1404a6101