Function at 0x14001af80
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r15, r9
mov rbx, r8
mov r14, rdx
mov qword [rbp], rcx
mov eax, dword [0x141f2f2b0]
xor eax, dword [0x141f2f2b4]
and eax, 0x5a15074d
imul eax, eax, 0x6d268f4c
xor eax, 0x29b4a0ba
cmp eax, 0x4665f243
jb 0x14001b009
mov eax, dword [0x141f2f2b8]
sub eax, dword [0x141f2f2bc]
or eax, 0x6e5091c1
and eax, 0xfed2d1c1
imul rcx, rax, 0x19e8a743
shr rcx, 0x3a
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r13, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
cmp ecx, 0x451ae233
jbe 0x14001b025
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
jmp 0x14001afc0
movzx eax, byte [0x141f49078]
mov eax, dword [0x141f2f2c0]
xor edx, edx
div dword [0x141f2f2c4]
imul eax, eax, 0xe9804268
add eax, 0xaaee5fa8
cmp eax, 0x6ff062b5
jae 0x14001b060
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
mov eax, dword [0x141f2f2c8]
or eax, dword [0x141f2f2cc]
or eax, 0x8c2fa0e5
add eax, 0xa0a0276c
imul rsi, rax, 0x77275929
shr rsi, 0x3e
sub rsp, 0x20
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
cmp esi, 0xa1eea5d0
je 0x14001b060
mov rdi, rax
test rax, rax
je 0x14001b1f7
mov eax, dword [r15]
mov dword [rdi], eax
add rbx, r14
mov qword [r13], r14
mov qword [r13 + 8], rbx
mov word [r13 + 0x10], 0
mov word [r13 + 0x18], 1
nop word [rax + rax]
mov eax, dword [0x141f2f2e0]
or eax, dword [0x141f2f2e4]
imul eax, eax, 0x80deaa96
or eax, 0xa0d4103
and eax, 0x2a3f4d23
cmp eax, 0xba158e13
ja 0x14001b0d0
mov word [r13 + 0x1a], 0
sub rsp, 0x20
mov rcx, r12
mov rdx, r13
call fcn.140088da0
add rsp, 0x20
mov rbx, qword [r12 + 8]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rcx, qword [rbp]
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
mov esi, eax
cmp qword [r12], 0
je 0x14001b1cd
mov r14, qword [0x141f49060]
mov eax, dword [0x141f2f2e8]
imul eax, dword [0x141f2f2ec]
and eax, 0x34ba513d
add eax, 0x760ce7e6
cmp eax, 0x2ba47ad0
jae 0x14001b185
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141f2f2f0]
or eax, dword [0x141f2f2f4]
imul r12d, eax, 0x416b193b
xor r12d, 0x9ba4d829
add r12d, 0x85e509e5
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call r15
add rsp, 0x20
cmp r12d, 0x2445e29a
jb 0x14001b190
mov rbx, qword [0x141f49060]
mov eax, dword [0x141f2f2f8]
and eax, dword [0x141f2f2fc]
imul eax, eax, 0xdb019dcf
or eax, 0x14b1b8e0
cmp eax, 0xc02755ca
jne 0x14001b244
jmp 0x14001b28a
mov eax, dword [0x141f2f2d0]
sub eax, dword [0x141f2f2d4]
or eax, 0x84008202
xor eax, 0x40000
and eax, 0xa41c8622
cmp eax, 0x5adea698
jb 0x14001b23e
mov eax, dword [0x141f2f2d8]
imul eax, dword [0x141f2f2dc]
or eax, 0x2918f8f6
add eax, 0x6b6b911b
and eax, 0xc8ac1718
ud2
ud2
mov eax, dword [0x141f2f300]
mov ecx, dword [0x141f2f304]
add eax, ecx
add eax, 0xb6f99aea
shr eax, 1
imul r14, rax, 0x42c91e05
shr r14, 0x3d
or r14d, 0x984b2d64
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r14d, 0x71018173
jne 0x14001b2a2
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14001b244
mov r8, rsi
shl r8, 0x20
xor r9d, r9d
mov r10d, 0xb6ccd423
or r8, 2
nop word cs:[rax + rax]
mov eax, dword [0x141f2f308]
xor edx, edx
div dword [0x141f2f30c]
mov ecx, eax
imul rcx, r10
shr rcx, 0x3e
add ecx, 0xf78a682
test esi, esi
mov rax, r8
cmove rax, r9
cmp ecx, 0xa3a81fd
jb 0x14001b2c0
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret