Function at 0x140002310
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov eax, 0x10038
call fcn.1400111e0
sub rsp, rax
xor edx, edx
lea r8d, [rax - 0x38]
lea rcx, [rsp + 0x30]
call fcn.140007ee0
xor ecx, ecx
lea r9, [0x140000000]
xor r8d, r8d
xor eax, eax
nop dword [rax + rax]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d908]
mov byte [rsp + rax + 0x30], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d909]
mov byte [rsp + rax + 0x31], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90a]
mov byte [rsp + rax + 0x32], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90b]
mov byte [rsp + rax + 0x33], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90c]
mov byte [rsp + rax + 0x34], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90d]
mov byte [rsp + rax + 0x35], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90e]
mov byte [rsp + rax + 0x36], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d90f]
mov byte [rsp + rax + 0x37], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d910]
mov byte [rsp + rax + 0x38], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d911]
mov byte [rsp + rax + 0x39], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
lea rax, [rax + 0x10]
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d902]
mov byte [rsp + rax + 0x2a], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d903]
mov byte [rsp + rax + 0x2b], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d904]
mov byte [rsp + rax + 0x2c], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d905]
mov byte [rsp + rax + 0x2d], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d906]
mov byte [rsp + rax + 0x2e], cl
lea ecx, [rdx + 1]
xor edx, edx
cmp ecx, 0x40
cmovb edx, ecx
add r8d, 0x10
movsxd rcx, edx
movzx ecx, byte [rcx + r9 + 0x1a430]
xor cl, byte [rax + r9 + 0x1d907]
mov byte [rsp + rax + 0x2f], cl
lea ecx, [rdx + 1]
cmp r8d, 0x10
jb 0x140002340
call fcn.140002250
lea rcx, [rsp + 0x10040]
mov qword [rsp + 0x10040], 0
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000261b
mov rcx, qword [rsp + 0x10040]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 0x10
lea rdx, [0x140019c80]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x10030], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x10040]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x10030]
jne 0x14000261b
mov al, 1
add rsp, 0x10038
ret
xor al, al
add rsp, 0x10038
ret