Function at 0x140001294
Capabilities:
Encode data using xor
Persist via windows service
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rsi, rcx
mov ebx, 1
mov dword [rbp + 0x67], ebx
mov dword [rbp + 0x6f], 3
mov r8, rcx
lea rdx, [0x140037278]
lea rcx, [rbp + 0xf]
call fcn.140001c7c
nop
lea rdi, [rsi + 0x20]
mov r8, rdi
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x11]
call fcn.140001c7c
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
lea r8, [rbp + 0x7f]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140001457
mov r8, qword [rsi + 0x30]
cmp qword [rdi + 0x18], 0x10
jb 0x14000131f
mov rdi, qword [rdi]
mov dword [rbp - 0x21], 0x5071a36
mov dword [rbp - 0x1d], 0x3701161a
mov dword [rbp - 0x19], 0x19161b
xor edx, edx
mov sil, 0x72
movsxd rcx, edx
lea eax, [rsi + rdx]
xor byte [rbp + rcx - 0x21], al
add edx, ebx
cmp edx, 0xb
jb 0x140001339
mov byte [rbp - 0x16], 0
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rdi
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea r8, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae r8, qword [rbp + 0xf]
mov dword [rbp - 0x21], 0x12151e3b
mov dword [rbp - 0x1d], 0xd192713
mov word [rbp - 0x19], 0x12
xor edx, edx
movsxd rcx, edx
lea eax, [rsi + rdx]
xor byte [rbp + rcx - 0x21], al
add edx, ebx
cmp edx, 9
jb 0x140001390
mov byte [rbp - 0x18], 0
mov eax, dword [rbp + 0x1f]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0x21]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x77], 0x10040a26
mov edi, 4
xor eax, eax
mov byte [rbp + 0x7b], al
xor edx, edx
movsxd rcx, edx
lea eax, [rsi + rdx]
xor byte [rbp + rcx + 0x77], al
add edx, ebx
cmp edx, edi
jb 0x1400013db
mov byte [rbp + 0x7b], 0
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x77]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x77], 0x7150721
mov word [rbp + 0x7b], 2
xor edx, edx
movsxd rcx, edx
lea eax, [rsi + rdx]
xor byte [rbp + rcx + 0x77], al
add edx, ebx
cmp edx, 5
jb 0x14000141f
mov byte [rbp + 0x7c], 0
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x77]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x140001459
xor bl, bl
mov edi, 0x1000
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140001491
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, rdi
jb 0x14000148c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014e9
call fcn.1400075cc
movdqa xmm0, xmmword [0x140037500]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x1400014d5
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, rdi
jb 0x1400014d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014e3
call fcn.1400075cc
mov al, bl
add rsp, 0x98
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000b47c
nop
call fcn.14000b47c
nop
int3