Function at 0x140071170
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14033b600]
xor rax, rsp
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [0x140311760]
xor ebx, ebx
movdqa xmm1, xmmword [0x140311a20]
mov ecx, ebx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x100fecb
movdqu xmmword [rsp + 0x40], xmm1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x22
jb 0x1400711c0
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x1403119b0]
mov rcx, rbx
mov qword [rbp - 0x70], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xffccc4
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x54], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x23
jb 0x140071210
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x140311990]
mov rcx, rbx
mov qword [rbp - 0x68], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xcec2b4b5
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x54], 0xfd
mov byte [rsp + 0x56], 1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x140071260
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x140311980]
mov rcx, rbx
mov qword [rbp - 0x60], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xcec2b4b2
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x54], 0xfd
mov byte [rsp + 0x56], 1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x1400712b0
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x140311a20]
mov rcx, rbx
mov qword [rbp - 0x58], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x100fecb
movdqu xmmword [rsp + 0x40], xmm1
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x22
jb 0x1400712f0
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x1403119b0]
mov rcx, rbx
mov qword [rbp - 0x50], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xffccc4
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x54], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x23
jb 0x140071340
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x140311990]
mov rcx, rbx
mov qword [rbp - 0x48], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xcec2b4b5
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x54], 0xfd
mov byte [rsp + 0x56], 1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x140071390
movdqa xmm0, xmmword [0x140311760]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x140311980]
mov rcx, rbx
mov qword [rbp - 0x40], rax
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0xcec2b4b2
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x54], 0xfd
mov byte [rsp + 0x56], 1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x25
jb 0x1400713e0
movdqa xmm0, xmmword [0x1403117d0]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x38], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x5635542b
mov dword [rsp + 0x44], 0x4a415644
mov dword [rsp + 0x48], 0x7343c
mov byte [rsp + 0x4c], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x140071430
movdqa xmm0, xmmword [0x140311800]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x3d45444a
mov dword [rsp + 0x44], 0x49593857
mov dword [rsp + 0x48], 0x394d4955
mov dword [rsp + 0x4c], 0x100fa37
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140071480
movdqa xmm0, xmmword [0x1403117e0]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x28], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x5635542b
mov dword [rsp + 0x44], 0x4a4d5644
mov dword [rsp + 0x48], 0x7343c
mov byte [rsp + 0x4c], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x1400714d0
movdqa xmm0, xmmword [0x140311810]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x20], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x3d454444
mov dword [rsp + 0x44], 0x49593857
mov dword [rsp + 0x48], 0x394d4a55
mov dword [rsp + 0x4c], 0x100fa37
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140071520
movdqa xmm0, xmmword [0x1403117b0]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x18], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x5635542b
mov dword [rsp + 0x44], 0x4a4e5644
mov dword [rsp + 0x48], 0x7343c
mov byte [rsp + 0x4c], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x140071570
movdqa xmm0, xmmword [0x140311820]
lea rax, [rsp + 0x30]
mov qword [rbp - 0x10], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x3d454445
mov dword [rsp + 0x44], 0x49593857
mov dword [rsp + 0x48], 0x394d4555
mov dword [rsp + 0x4c], 0x100fa37
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x1400715c0
movdqa xmm0, xmmword [0x1403117c0]
lea rax, [rsp + 0x30]
mov qword [rbp - 8], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x5635542b
mov dword [rsp + 0x44], 0x4a4f5644
mov dword [rsp + 0x48], 0x7343c
mov byte [rsp + 0x4c], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x140071610
movdqa xmm0, xmmword [0x140311790]
lea rax, [rsp + 0x30]
mov qword [rbp], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x56454442
mov dword [rsp + 0x44], 0x544a5837
mov dword [rsp + 0x48], 0x363a4c4d
mov word [rsp + 0x4c], 5
mov byte [rsp + 0x4e], 1
nop
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1d
jb 0x140071660
movdqa xmm0, xmmword [0x1403117a0]
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x5635542b
mov dword [rsp + 0x44], 0x4a415644
mov dword [rsp + 0x48], 0x7343c
mov byte [rsp + 0x4c], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1b
jb 0x1400716b0
movdqa xmm0, xmmword [0x140311840]
lea rax, [rsp + 0x30]
movdqa xmm1, xmmword [0x1403114b0]
mov rcx, rbx
mov qword [rbp + 0x10], rax
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x50], 1
movdqu xmmword [rsp + 0x40], xmm1
nop dword [rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1f
jb 0x1400716f0
lea rax, [rsp + 0x30]
mov qword [rbp + 0x18], rax
call fcn.140232ff4
and eax, 0x80000003
jge 0x14007171c
dec eax
or eax, 0xfffffffc
inc eax
movdqa xmm0, xmmword [0x1403116c0]
mov rcx, rbx
movdqa xmm1, xmmword [str.:8]
mov rdi, qword [rbp + rax*8 - 0x70]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x78], 0xd6e9e5f1
movdqu xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x7c], 0xefeae7f5
mov dword [rbp - 0x80], 0xfce2fff8
mov dword [rbp - 0x7c], 0x100a0d3
nop
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 0x2e
jb 0x140071760
movdqa xmm0, xmmword [0x1403113c0]
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rbp - 0x79], bl
mov dword [rsp + 0x40], 0x121a1a
mov byte [rsp + 0x44], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x13
jb 0x1400717a0
lea rax, [rbp + 0x20]
mov byte [rsp + 0x44], bl
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp + 0x20], rbx
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], bl
jne 0x1400717e3
mov rcx, qword [rbp + 0x20]
lea rdx, [rsp + 0x30]
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14007194b
movdqa xmm0, xmmword [str.8O8F_8_J8]
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xf191806
mov dword [rsp + 0x44], 0x15092b57
mov dword [rsp + 0x48], 0x1a181a14
mov dword [rsp + 0x4c], 0x100a15f
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x1e
jb 0x140071850
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x4f], bl
call fcn.140239ef0
movdqa xmm0, xmmword [0x140311910]
mov rcx, rbx
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1005a5d
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x12
jb 0x140071890
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x43], bl
call fcn.140239ef0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 0x20], rbx
je 0x140071997
movdqa xmm0, xmmword [str.8O8F5_.J8]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xf191806
mov dword [rsp + 0x44], 0x15153b57
mov dword [rsp + 0x48], 0x5e191908
mov word [rsp + 0x4c], 0x5e
mov byte [rsp + 0x4e], 1
nop
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 0x1d
jb 0x140071900
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x4e], 0
call fcn.140239ef0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140223ef0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
movdqa xmm0, xmmword [0x140311650]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x101a1b03
mov dword [rsp + 0x44], 0x5a1e161e
mov word [rsp + 0x48], 0x5a
mov byte [rsp + 0x4a], 1
call fcn.140071140
mov rcx, rax
call fcn.140239ef0
call fcn.140239dac
mov ecx, 1
call fcn.140234cac
int3
movdqa xmm0, xmmword [0x140311720]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x1f061b1f
mov dword [rsp + 0x44], 0x5b591f19
mov word [rsp + 0x48], 0x100
call fcn.1400719e0
mov rcx, rax
call fcn.140239ef0
call fcn.140239dac
mov ecx, 1
call fcn.140234cac
int3