Function at 0x14001bab0
Capabilities:
Encode data using base64
Encode data using xor
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x141dda6b8]
mov eax, dword [0x141dc1358]
sub eax, dword [0x141dc135c]
or eax, 0x5dbff73f
cmp eax, 0x33057a40
jne 0x14001bb00
mov edx, 4
xor ecx, ecx
call fcn.1400bf230
nop word cs:[rax + rax]
mov ebp, dword [0x141dc1360]
or ebp, dword [0x141dc1364]
add ebp, 0xd8783c9c
or ebp, 0xa0160404
and ebp, 0xe0d63516
mov edx, 4
xor ecx, ecx
call fcn.1400bf230
cmp ebp, 0x7489ea1a
je 0x14001bb00
mov rsi, rax
mov eax, 0x992fccb3
nop word [rax + rax]
mov ecx, dword [0x141dc1368]
sub ecx, dword [0x141dc136c]
imul rcx, rax
shr rcx, 0x3f
xor ecx, 0xcc0a27fb
imul ecx, ecx, 0xe6c18d0c
cmp ecx, 0xa19dffb2
jb 0x14001bb40
test rsi, rsi
je 0x14001bc02
mov eax, dword [r15]
mov dword [rsi], eax
add rbx, r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140083450
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp qword [rsp + 0x50], 0
je 0x14001bd21
mov eax, dword [0x141dc1388]
sub eax, dword [0x141dc138c]
add eax, 0xd20d5eba
and eax, 0x544a1c7b
imul eax, eax, 0x532e8e2
cmp eax, 0xa98c4a0f
jbe 0x14001bc85
jmp 0x14001bcae
mov eax, dword [0x141dc1370]
xor edx, edx
div dword [0x141dc1374]
imul rax, rax, 0x3a9aca5b
shr rax, 0x3d
or eax, 0x81f92b1e
imul eax, eax, 0xc5f5a776
cmp eax, 0xc605524e
jne 0x14001bc30
ud2
mov eax, dword [0x141dc1378]
or eax, dword [0x141dc137c]
imul eax, eax, 0x3c9f4ee7
or eax, 0x8cca17fc
imul eax, eax, 0x39ce5bb8
ud2
mov eax, dword [0x141dc1390]
and eax, dword [0x141dc1394]
xor eax, 0xa61c0901
and eax, 0xee9e1917
xor eax, 0xdc8814a
mov r14, qword [0x141dda6a0]
cmp eax, 0x755d05cb
jae 0x14001bcb7
mov rax, qword [0x141dda6a0]
jmp 0x14001bc85
mov eax, dword [0x141dc1398]
add eax, dword [0x141dc139c]
imul eax, eax, 0x16b250bb
add eax, 0xa01b650c
xor eax, 0x27031f3e
cmp eax, 0x9d225ed9
jae 0x14001bce8
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov ebp, dword [0x141dc13a0]
and ebp, dword [0x141dc13a4]
or ebp, 0x6f642571
add ebp, 0x4549780
or ebp, 0x8673e733
mov rcx, r14
xor edx, edx
mov r8, rbx
call r15
cmp ebp, 0xe6c1cbdb
je 0x14001bcf0
mov eax, dword [0x141dc13a8]
or eax, dword [0x141dc13ac]
imul eax, eax, 0xb208cc79
add eax, 0x43dc1dce
and eax, 0x29fbeee
cmp eax, 0x80a1d31c
jbe 0x14001bd56
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov ebp, dword [0x141dc13b0]
add ebp, dword [0x141dc13b4]
or ebp, 0x8d19183e
xor ebp, 0xe85b86f
add ebp, 0xbd57dcff
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0xe9370d95
ja 0x14001bd60
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret