Function at 0x140049820
Capabilities:
Encode data using base64
Encode data using xor
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov qword [rbp], r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov eax, dword [0x141589998]
xor edx, edx
div dword [0x14158999c]
add eax, 0xafbd7391
mov ecx, eax
not ecx
and ecx, 0x6d2311c3
mov edx, eax
and edx, 0x92dcee3c
imul edx, ecx
mov ecx, eax
and ecx, 0x6d2311c3
or eax, 0x6d2311c3
imul eax, ecx
add eax, edx
imul rcx, rax, 0x33a52449
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xd8997a95
jbe 0x14004989f
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov ecx, 0xe9c57827
nop word cs:[rax + rax]
mov eax, dword [0x1415899a0]
xor edx, edx
div dword [0x1415899a4]
imul rax, rcx
shr rax, 0x3f
imul edx, eax, 0x8bb296bc
add edx, 0x4de3bfd
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov rbx, rsp
cmp edx, 0x74ac996e
ja 0x1400498b0
mov eax, dword [0x1415899a8]
add eax, dword [0x1415899ac]
mov ecx, 0x985861dd
imul rcx, rax
shr rcx, 0x3a
mov eax, ecx
not eax
or eax, 0x3a20a952
add eax, ecx
inc eax
and eax, 0xb0dd8166
cmp eax, 0x8a0948f6
ja 0x140049965
mov eax, dword [0x1415899b0]
xor edx, edx
div dword [0x1415899b4]
imul r13d, eax, 0xf6b785e7
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov r12, rsp
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1401ac910
add rsp, 0x20
cmp r13d, 0x344e1741
jne 0x14004998f
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.14020ae90
add rsp, 0x20
jmp 0x14004991c
mov rdi, rax
nop word cs:[rax + rax]
mov eax, dword [0x1415899b8]
sub eax, dword [0x1415899bc]
mov ecx, eax
xor ecx, 0xd624896
xor eax, 0x60f2c6b5
or ecx, 0x70100400
and ecx, eax
and ecx, 0x7d908e23
cmp ecx, 0x70ff5bc8
je 0x1400499a0
test rdi, rdi
je 0x140049a29
mov rax, qword [rbp]
mov eax, dword [rax]
mov dword [rdi], eax
mov eax, dword [0x1415899d8]
or eax, dword [0x1415899dc]
add eax, 0xc5a412af
mov ecx, eax
not ecx
and ecx, 0xa8eabff0
mov edx, eax
and edx, 0x5715400f
imul edx, ecx
mov ecx, eax
and ecx, 0xa8eabff0
or eax, 0xa8eabff0
imul eax, ecx
add eax, edx
xor eax, 0x4995179f
cmp eax, 0xa2ea9515
jbe 0x140049b0c
jmp 0x140049b66
mov eax, dword [0x1415899c0]
mov ecx, dword [0x1415899c4]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
add eax, 0xa9e3d60b
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xb7951b9a
and ecx, 0x486ae465
imul ecx, edx
mov edx, eax
and edx, 0x486ae465
or eax, 0x486ae465
imul eax, edx
add eax, ecx
and eax, 0xbf59746e
cmp eax, 0x510b478c
jb 0x140049ab8
mov eax, dword [0x1415899c8]
or eax, dword [0x1415899cc]
mov ecx, eax
not ecx
and ecx, 0x11b23260
mov edx, eax
and edx, 0xe4dcd9f
imul edx, ecx
mov ecx, eax
and ecx, 0x11b23260
or eax, 0x11b23260
imul eax, ecx
add eax, edx
or eax, 0xefefeffd
ud2
ud2
mov eax, dword [0x1415899e0]
mov ecx, dword [0x1415899e4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x40f4d46
mov ecx, eax
and ecx, 0x772ac113
add ecx, ecx
sub eax, ecx
add eax, 0x387978cb
lea rcx, [r15 + r14]
mov qword [rbx], r15
mov qword [rbx + 8], rcx
mov word [rbx + 0x10], 0
cmp eax, 0xec8d709e
jae 0x140049b79
lea rax, [r15 + r14]
mov qword [rbx], r15
mov qword [rbx + 8], rax
mov word [rbx + 0x10], 0
jmp 0x140049b0c
mov eax, dword [0x1415899e8]
mov ecx, dword [0x1415899ec]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
mov ecx, eax
xor ecx, 0xdfce85af
or eax, 0x20317a50
and eax, ecx
mov ecx, eax
xor ecx, 0xa34f2065
or eax, 0x5cb0df9a
and eax, ecx
mov ecx, eax
xor ecx, 0xf2d5a2d1
and eax, 0xd2a5d2e
add eax, eax
sub eax, ecx
cmp eax, 0x568de08d
jbe 0x140049c09
mov dword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, r12
mov rdx, rbx
call fcn.140051660
add rsp, 0x20
mov rdx, qword [r12 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, rsi
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
mov r13, rsi
nop dword [rax]
mov eax, dword [0x1415899f0]
mov ecx, dword [0x1415899f4]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x6e9392b7
mov ecx, 0x9ca2e0e1
imul rax, rcx
shr rax, 0x3f
imul esi, eax, 0x77e338
mov dword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, r12
mov rdx, rbx
call fcn.140051660
add rsp, 0x20
mov r15, qword [r12 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, r13
mov rdx, r15
xor r8d, r8d
mov r9d, 4
call fcn.14020b340
add rsp, 0x30
cmp esi, 0x106e90e
ja 0x140049c10
mov r14d, eax
cmp qword [r12], 0
je 0x140049d6e
mov rsi, qword [0x1415acb98]
mov eax, dword [0x1415899f8]
add eax, dword [0x1415899fc]
imul eax, eax, 0x4bfdcd2a
add eax, 0xb8023db2
mov ecx, 0xa6db9c87
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xb596dcf3
jne 0x140049d00
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov ebx, dword [0x141589a00]
add ebx, dword [str.UdN6]
or ebx, 0x53cd982e
add ebx, 0x7cb7cc29
and ebx, 0xfc37efff
xor ebx, 0x2220bf57
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call fcn.14020ae70
add rsp, 0x20
cmp ebx, 0xed88ca78
je 0x140049d00
nop word cs:[rax + rax]
mov eax, dword [0x141589a08]
and eax, dword [0x141589a0c]
and eax, 0x8ace7ede
imul eax, eax, 0x7c53708f
cmp eax, 0xec4f2cd7
je 0x140049d50
mov rsi, qword [0x1415acb98]
mov eax, dword [0x141589a10]
xor edx, edx
div dword [0x141589a14]
shr eax, 1
imul rax, rax, 0x4f05c837
shr rax, 0x3d
xor eax, 0xaf2d0593
add eax, 0x98e3cca0
cmp eax, 0xefa075c8
ja 0x140049df3
mov eax, dword [0x141589a18]
xor edx, edx
div dword [0x141589a1c]
mov r15d, eax
xor ebx, ebx
add r15d, 0x340f94da
or r15d, 0xa81bc241
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rax, r14
shl rax, 0x20
or rax, 2
test r14d, r14d
cmovne rbx, rax
cmp r15d, 0xcfafb51
jae 0x140049e0b
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140049da1
mov eax, dword [0x141589a20]
xor edx, edx
div dword [0x141589a24]
nop dword [rax]
mov eax, dword [0x141589a28]
mov ecx, dword [0x141589a2c]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
imul rax, rax, 0x429d2bc7
shr rax, 0x3d
not eax
and eax, 0x508552ef
add eax, 0xaa1b7c70
cmp eax, 0x1ef3d455
jb 0x140049e20
mov rax, rbx
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret