Function at 0x140009d40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140016040]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x140011c70]
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 0x39]
mov word [rbp + 0x34], 0x67
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp + 0x2f], 0x69676775
mov byte [rbp + 0x33], 0x6e
mov byte [rbp + 0x36], 0
mov word [rbp - 0x2c], 0x6b
mov dword [rbp - 0x39], 0x6c756d45
mov dword [rbp - 0x35], 0x726f7461
mov dword [rbp - 0x31], 0x65684320
mov byte [rbp - 0x2d], 0x63
mov byte [rbp - 0x2a], 0
call fcn.14000b6f0
mov ecx, 0x578
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x21]
mov dword [rbp - 0x21], 0xc5b3c588
mov dword [rbp - 0x1d], 0xc5aac5bb
xor ebx, ebx
mov dword [rbp - 0x19], 0xc581c5a8
mov dword [rbp - 0x15], 0xc587c593
mov dword [rbp - 0x11], 0xc5b0c5bf
mov dword [rbp - 0xd], 0xc588c580
mov dword [rbp - 9], 0xc58dc584
mov dword [rbp - 5], 0xc59ec587
mov dword [rbp - 1], 0xc5a1c5b7
mov dword [rbp + 3], 0xc58cc582
mov dword [rbp + 7], 0xc59cc586
mov dword [rbp + 0xb], 0xc5b5c594
mov dword [rbp + 0xf], 0xc599c592
mov dword [rbp + 0x13], 0xc5a6c590
mov dword [rbp + 0x17], 0xc5b4
mov byte [rbp + 0x1b], 1
call fcn.1400084e0
mov rdx, rax
mov r9d, 2
lea rax, [rbp + 0x37]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009f89
movdqa xmm2, xmmword [0x140011be0]
xorps xmm0, xmm0
mov dword [rbp - 0x39], 0xc840c862
mov eax, 8
movd xmm1, dword [rbp - 0x39]
mov edx, 0x37dd
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
mov dword [rbp - 0x35], 0xc862c847
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmmword [0x140011bf0]
pshuflw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
movd dword [rbp - 0x39], xmm1
movd xmm1, dword [rbp - 0x35]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
mov dword [rbp - 0x31], 0xc85bc84e
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmmword [0x140011c00]
pshuflw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
movd dword [rbp - 0x35], xmm1
movd xmm1, dword [rbp - 0x31]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
mov dword [rbp - 0x2d], 0xc848c848
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmmword [0x140011c10]
pshuflw xmm1, xmm0, 0xd8
xorps xmm0, xmm0
movd dword [rbp - 0x31], xmm1
movd xmm1, dword [rbp - 0x2d]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
mov dword [rbp + 0x3f], ebx
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x2d], xmm1
mov dword [rbp - 0x29], 0xc849c847
mov word [rbp - 0x25], bx
mov byte [rbp - 0x23], 1
nop
movzx ecx, ax
sub cx, dx
xor word [rbp + rax*2 - 0x39], cx
inc rax
cmp rax, 0xa
jb 0x140009f40
mov rcx, qword [rbp + 0x37]
lea rax, [rbp + 0x3f]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x39]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov byte [rbp - 0x23], bl
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14000e9a0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret