Function at 0x14001a0d0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov al, byte [0x1401a3d84]
neg al
sbb rbx, rbx
add rbx, 0xffffffff80000002
mov r9d, dword [0x1401a3d80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
xor r15d, r15d
cmp r8d, 0xa
jne 0x14001a184
mov r8d, r15d
mov edx, r8d
mov r10d, 8
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
dec r10
jne 0x14001a155
add r9d, edx
inc r8d
cmp r8d, 0x100
jl 0x14001a14c
mov dword [0x1401a3d80], r9d
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov qword [rbp - 0x41], r15
lea rcx, [0x14019b9a8]
mov rax, qword [0x14019b9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, [0x140134108]
lea rcx, [rbp - 0x31]
call fcn.140002d94
nop
mov r8, rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.14000dac8
nop
lea r8, [0x1401a41b8]
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14000dac8
nop
lea r8, [0x140134098]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140018bf8
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.14000dac8
nop
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.1400021c4
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
or r12d, 0xffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a24e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a26f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a290
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a2b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a2d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x140134108]
lea rcx, [rbp - 1]
call fcn.140002d94
nop
mov r8, rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x11]
call fcn.14000dac8
nop
lea r8, [0x1401a41b8]
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.14000dac8
nop
lea r8, [0x140134098]
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140018bf8
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14000dac8
nop
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
mov r8, qword [rax]
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400198e4
test eax, eax
setne bl
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a36d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a38e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a3af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a3d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a3f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001a497
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a419
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14001a42c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a451
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a471
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a490
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001a675
mov dword [rbp + 0x7f], r14d
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rdi]
mov rbx, qword [rbp - 0x51]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001a55e
test rbx, rbx
je 0x14001a4dc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a501
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14001a514
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a539
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a559
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14001a471
test rbx, rbx
je 0x14001a570
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov ecx, dword [0x1401a3d80]
mov eax, ecx
imul eax, ecx
and eax, 0x80000003
jge 0x14001a58d
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 2
jne 0x14001a5da
movsd xmm3, qword [0x140138420]
xorps xmm2, xmm2
movd xmm4, ecx
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x14001a5c2
subsd xmm2, xmm3
divsd xmm3, qword [0x140138448]
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x140138418]
ja 0x14001a5a5
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a5fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14001a60e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r15
mov dword [rbp - 0x49], r15d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a633
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x14001a653
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov ecx, r12d
lock xadd dword [rdx + 0x10], ecx
add ecx, r12d
test ecx, ecx
jg 0x14001a673
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, 1
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret