Function at 0x140202210
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
xor ebx, ebx
mov dword [rsp + 0x7e], 0x6e0053
mov ecx, ebx
mov dword [rbp - 0x7e], 0x770064
mov dword [rbp - 0x7a], 0x640073
mov dword [rbp - 0x76], 0x620074
mov dword [rbp - 0x72], 0x440054
mov dword [rbp - 0x6e], 0x680063
mov dword [rbp - 0x6a], 0x62007e
mov dword [rbp - 0x66], 0x60007d
mov dword [rbp - 0x62], 0x650076
mov dword [rbp - 0x5e], 0x44004e
mov dword [rbp - 0x5a], 0x7b007d
mov dword [rbp - 0x56], 0x780072
mov dword [rbp - 0x52], 0x6a006f
mov dword [rbp - 0x4e], 0x580046
mov dword [rbp - 0x4a], 0x6f0069
mov dword [rbp - 0x46], 0x7a006c
mov dword [rbp - 0x42], 0x55004e
mov dword [rbp - 0x3e], 0x460074
mov dword [rbp - 0x3a], 0x560056
mov dword [rbp - 0x36], 0x48004f
mov dword [rbp - 0x32], 0x750046
mov dword [rbp - 0x2e], 0x53006f
mov dword [rbp - 0x2a], 0x41005c
mov dword [rbp - 0x26], 0x5d0041
mov dword [rbp - 0x22], 0x430055
mov dword [rbp - 0x1e], 0x72006e
mov dword [rbp - 0x1a], 0x430050
mov dword [rbp - 0x16], 0x590057
mov dword [rbp - 0x12], 0x5c005b
mov dword [rbp - 0xe], 0x5e
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x7e], cx
inc ecx
cmp ecx, 0x3b
jb 0x140202310
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x7e]
lea rcx, [rbp - 8]
mov word [rbp - 0xc], bx
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp - 8], rbx
call fcn.14013edcc
cmp qword [rbp + 0x10], 8
lea rax, [rbp + 0x88]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp - 8]
cmovae rdx, qword [rbp - 8]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x88], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rdi, rbx
lea rcx, [rbp - 8]
test eax, eax
cmove rdi, qword [rbp + 0x88]
call fcn.14013ed68
test rdi, rdi
je 0x140202548
xor eax, eax
mov dword [rsp + 0x70], 0x680048
mov word [rsp + 0x7c], ax
mov ecx, ebx
mov dword [rsp + 0x74], 0x670066
mov dword [rsp + 0x78], 0x6b0061
nop dword [rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x70], cx
inc ecx
cmp ecx, 6
jb 0x1402023d0
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x7c], bx
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rbx
call fcn.14013edcc
cmp qword [rsp + 0x68], 8
lea rax, [rbp + 0x80]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], 4
cmovae rdx, qword [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rbp + 0x80], 2
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
lea rcx, [rsp + 0x50]
call fcn.14013ed68
mov eax, ebx
mov dword [rsp + 0x50], 0x690053
mov dword [rsp + 0x54], 0x74006d
mov dword [rsp + 0x58], 0x700057
mov dword [rsp + 0x5c], 0x620076
mov dword [rsp + 0x60], 0x41007a
mov dword [rsp + 0x64], 0x6f0063
mov dword [rsp + 0x68], 0x680068
mov dword [rsp + 0x6c], 0x60
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
xor word [rsp + rcx*2 + 0x50], ax
inc eax
cmp eax, 0xf
jb 0x1402024a0
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x18]
mov word [rsp + 0x6e], bx
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x18], rbx
call fcn.14013edcc
cmp qword [rbp + 0x30], 8
lea rax, [rbp + 0x80]
lea rdx, [rbp + 0x18]
mov dword [rsp + 0x28], 4
cmovae rdx, qword [rbp + 0x18]
mov r9d, 4
xor r8d, r8d
mov dword [rbp + 0x80], ebx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
lea rcx, [rbp + 0x18]
call fcn.14013ed68
mov eax, 0x80000000
add rax, rdi
cmp rax, 5
jbe 0x140202548
cmp rdi, 0xffffffff80000007
je 0x140202548
cmp rdi, 0xffffffff80000060
je 0x140202548
cmp rdi, 0xffffffff80000050
je 0x140202548
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret