Function at 0x14001b710
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov r15, rdx
mov eax, dword [0x141dc2278]
sub eax, dword [0x141dc227c]
xor eax, 0x34135eb7
imul eax, eax, 0xfd171137
add eax, 0xf5a9c83d
cmp eax, 0xfe3e79e8
ja 0x14001b796
mov eax, dword [0x141dc2280]
or eax, dword [0x141dc2284]
add eax, 0xe9c0c2e9
xor eax, 0xfa837bd7
mov edx, 0x89c83897
imul rdx, rax
shr rdx, 0x3e
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rdi, rsp
cmp edx, 0xeb5f1e7
jbe 0x14001b7b2
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
jmp 0x14001b74b
mov r14, rcx
mov rsi, r8
mov r12, r9
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400bf820
add rsp, 0x20
mov qword [rbp], rax
test rax, rax
je 0x14001b818
mov eax, dword [0x141dc22a0]
mov ecx, dword [0x141dc22a4]
add eax, ecx
add eax, 0xe19f98f6
imul rax, rax, 0x238e0f73
shr rax, 0x3c
cmp eax, 0xde9f4b7e
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rsi
mov r13, qword [rbp]
mov rsi, r14
jne 0x14001b88f
jmp 0x14001b918
mov eax, dword [0x141dc2288]
add eax, dword [0x141dc228c]
shr eax, 2
imul rax, rax, 0x439bac7b
shr rax, 0x3b
or eax, 0x44000010
and eax, 0x44000011
cmp eax, 0xe29442b8
ja 0x14001b867
mov eax, dword [0x141dc2290]
or eax, dword [0x141dc2294]
add eax, 0x955a7170
xor eax, 0x10210540
and eax, 0xd66b3554
ud2
ud2
mov eax, dword [0x141dc22a8]
add eax, dword [0x141dc22ac]
imul r14d, eax, 0x6d9b55ff
add r14d, 0x161dc0de
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
mov dword [r13], eax
mov rax, qword [rbp - 8]
add rax, r15
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov word [rbx + 0x10], 0
mov dword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
mov rdx, rbx
call fcn.140083030
add rsp, 0x20
mov r12, qword [rdi + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x28], 4
mov rcx, rsi
mov rdx, r12
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
cmp r14d, 0xd22ee304
jae 0x14001b980
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
mov dword [r13], eax
mov rax, qword [rbp - 8]
add rax, r15
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov word [rbx + 0x10], 0
mov dword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
mov rdx, rbx
call fcn.140083030
add rsp, 0x20
mov rdx, qword [rdi + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x28], 4
mov rcx, rsi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
jmp 0x14001b88f
mov r14, rax
mov eax, dword [0x141dc22b0]
xor edx, edx
div dword [0x141dc22b4]
mov eax, 0x838d23f3
nop word cs:[rax + rax]
mov ecx, dword [0x141dc22b8]
xor ecx, dword [0x141dc22bc]
or ecx, 0xd7e4b3cc
add ecx, 0xa658a1ef
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xc13800ec
ja 0x14001b9a0
cmp qword [rdi], 0
mov rsi, qword [rbp]
je 0x14001bad9
mov eax, dword [0x141dc22c0]
xor edx, edx
div dword [0x141dc22c4]
and eax, 0xab1abb09
add eax, 0xf23a6a91
cmp eax, 0x60a6648f
jb 0x14001ba28
mov eax, dword [0x141dc22c8]
xor eax, dword [0x141dc22cc]
xor eax, 0x3c92b43
mov ecx, 0xd141d727
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x59f8fa1a
mov rdi, qword [0x141ddb9a0]
cmp ecx, 0xae4e
jae 0x14001ba31
mov rax, qword [0x141ddb9a0]
jmp 0x14001b9f5
mov eax, dword [0x141dc22d0]
sub eax, dword [0x141dc22d4]
xor eax, 0x2008008
or eax, 0xfdfd3ff7
cmp eax, 0x8d27bb62
jb 0x14001ba9a
mov ebx, dword [0x141dc22d8]
or ebx, dword [0x141dc22dc]
and ebx, 0xed695306
mov eax, 0x8c021859
imul rax, rbx
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1e
or ebx, 0xf7fb5ef4
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0x86cf94c3
jae 0x14001bac0
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14001ba4e
mov eax, dword [0x141dc22e0]
xor eax, dword [0x141dc22e4]
imul eax, eax, 0xc6d3aec0
cmp eax, 0xda21820c
je 0x14001bac0
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rdx, r14
mov rax, r14
shl rax, 0x20
or rax, 2
nop word cs:[rax + rax]
mov ecx, dword [0x141dc22e8]
xor ecx, dword [0x141dc22ec]
add ecx, 0xa059e04e
and ecx, 0xe515906f
xor ecx, 0xe0d9fdca
cmp ecx, 0x9ec95c0f
jb 0x14001bb10
xor ecx, ecx
test edx, edx
cmove rax, rcx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret