Function at 0x140006300
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401973d0]
xor rax, rsp
mov qword [rbp + 8], rax
xor r15d, r15d
mov qword [rbp - 0x10], r15
mov dword [rbp - 0x58], 0x19
mov dword [rbp - 0x54], 0x56006b
mov dword [rbp - 0x50], 0x4f005c
mov dword [rbp - 0x4c], 0x5c004b
mov dword [rbp - 0x48], 0x5a004c
mov dword [rbp - 0x44], 0x17001c
mov dword [rbp - 0x40], 0x2f0023
mov dword [rbp - 0x3c], 0x200032
mov dword [rbp - 0x38], 0x14001a
mov dword [rbp - 0x34], 0x2c003c
mov dword [rbp - 0x30], 0x26002b
mov dword [rbp - 0x2c], 0x220038
mov dword [rbp - 0x28], 0x230021
mov dword [rbp - 0x24], 0x510023
mov edx, r15d
nop
mov eax, edx
lea rcx, [rbp - 0x54]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp - 0x58]
cmp edx, eax
jb 0x1400063a0
mov word [rbp + rax*2 - 0x54], r15w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400067ea
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 8], rax
lea rax, [rbp - 0x54]
mov r14, 0xffffffffffffffff
cmp rax, 0x10000
lea rax, [rbp - 0x54]
jae 0x140006403
movzx edx, ax
lea rcx, [rbp - 8]
call fcn.14000c690
jmp 0x140006429
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006410
lea rdx, [rbp - 0x54]
lea rcx, [rbp - 8]
call fcn.14000c910
nop
lea rax, [rbp]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rbp - 8]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
mov ecx, 0x104
call fcn.14011e058
mov rsi, rax
mov qword [rax], 0xb145453
mov dword [rax + 8], 0x33e0f0d
mov dword [rax + 0xc], 0x70
mov dword [rax + 0x10], 0x135b9c78
mov dword [rax + 0x14], 0xcdc221
mov dword [rax + 0x18], 0x38815f04
mov dword [rax + 0x1c], 0x1819183
mov dword [rax + 0x20], 0x618e088
mov dword [rax + 0x24], 0x80c8f9d0
mov dword [rax + 0x28], 0x2e388705
mov dword [rax + 0x2c], 0x210e0000
mov dword [rax + 0x30], 0x58ac8b02
lea rcx, [rax + 0x34]
xor edx, edx
mov r8d, 0xd0
call fcn.140120b10
test edi, edi
je 0x140006726
lea rax, [rsp + 0x68]
mov qword [rbp - 0x20], rax
lea rax, [rsp + 0x60]
mov qword [rbp - 0x18], rax
mov eax, 2
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], 0x790363e8
mov dword [rsp + 0x58], 0x3a
mov edx, r15d
test eax, eax
je 0x14000653b
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x54]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x50]
cmp edx, eax
jb 0x140006520
mov word [rsp + rax*2 + 0x54], r15w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400067f5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x54]
cmp rax, 0x10000
lea rax, [rsp + 0x54]
jae 0x140006582
movzx edx, ax
lea rcx, [rsp + 0x68]
call fcn.14000c690
jmp 0x1400065a0
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x140006585
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x68]
call fcn.14000c910
nop
mov eax, 0xc
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0x5c007f
mov dword [rsp + 0x78], 0x69004e
mov dword [rsp + 0x7c], 0x5a0059
mov dword [rbp - 0x80], 0x5e0078
mov dword [rbp - 0x7c], 0x32002c
mov dword [rbp - 0x78], 0xff420027
mov dword [rbp - 0x74], 0x44
mov edx, r15d
test eax, eax
je 0x14000660b
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x74]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x70]
cmp edx, eax
jb 0x1400065f0
mov word [rsp + rax*2 + 0x74], r15w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400067df
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x74]
cmp rax, 0x10000
lea rax, [rsp + 0x74]
jae 0x140006652
movzx edx, ax
lea rcx, [rsp + 0x60]
call fcn.14000c690
jmp 0x140006670
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x140006655
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x60]
call fcn.14000c910
nop
cmp dword [0x1401a2bb8], 0
jne 0x140006696
mov r9d, 0x40
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x1401a2bb0]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400066b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400066d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 8]
xor dil, dil
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400066f5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
movzx eax, dil
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14011e030
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400066d8
mov eax, 6
mov dword [rbp - 0x70], eax
mov dword [rbp - 0x6c], 0x56005b
mov dword [rbp - 0x68], 0x5d0054
mov dword [rbp - 0x64], 0x5a0055
mov dword [rbp - 0x60], 0x3e
mov edx, r15d
test eax, eax
je 0x140006799
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x6c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp - 0x70]
cmp edx, eax
jb 0x140006780
mov word [rbp + rax*2 - 0x6c], r15w
mov dword [rsp + 0x28], 0x34
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp - 0x6c]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400066d8
mov dil, 1
jmp 0x1400066db
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
int3