Function at 0x1800475c0
Capabilities:
Delete registry key
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x120
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x18009e040]
xor rax, rsp
mov qword [rbp], rax
xor r15d, r15d
mov edi, dword [0x18009e0a0]
movdqa xmm7, xmmword [0x180088730]
cmp qword [0x1800a4870], r15
jne 0x180047850
movsd xmm0, qword [str.XCUV]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x180088528]
mov word [rsp + 0x48], ax
cmp byte [0x180088529], r15b
je 0x180047664
mov byte [rsp + 0x40], 0x6e
xor byte [rsp + 0x41], 0x37
xor byte [rsp + 0x42], 0x38
xor byte [rsp + 0x43], 0x39
xor byte [rsp + 0x44], 0x3a
xor byte [rsp + 0x45], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x47], 0x3d
xor byte [rsp + 0x48], 0x3e
xor byte [rsp + 0x49], 0x3f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x180047849
movsd xmm0, qword [str.xCmWVT_YzM_71D]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x180088518]
mov dword [rsp + 0x68], eax
movzx ecx, word [0x18008851c]
mov word [rsp + 0x6c], cx
movzx ecx, byte [0x18008851e]
mov byte [rsp + 0x6e], cl
mov r8d, r15d
cmp edi, 2
jl 0x1800477f5
movdqa xmm4, xmmword [0x180088740]
movdqa xmm5, xmmword [str.7777]
movdqa xmm2, xmmword [0x1800886c0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x180088750]
movd xmm0, dword [str.xCmWVT_YzM_71D]
xorps xmm2, xmm0
movd dword [rsp + 0x60], xmm2
movdqa xmm2, xmmword [0x1800886d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x180088750]
movd xmm0, dword [rsp + 0x64]
xorps xmm2, xmm0
movd dword [rsp + 0x64], xmm2
movdqa xmm3, xmmword [0x1800886e0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x180088750]
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x68], xmm3
mov r8d, reloc.WS2_32.dll_inet_ntoa
mov eax, r8d
lea r9, [rsp + 0x60]
add r9, rax
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xf
jl 0x180047800
lea rdx, [rsp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800a4870], rax
test rax, rax
jne 0x180047850
xor al, al
jmp 0x180047dd4
movups xmm0, xmmword [str.eNKM_V_KM2__7_a_3:]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x1800885f8]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x180088608]
mov word [rbp - 0x70], ax
movzx eax, byte [0x18008860a]
mov byte [rbp - 0x6e], al
mov ecx, r15d
cmp edi, 2
jl 0x1800479a4
movdqa xmm4, xmmword [0x1800886c0]
movdqa xmm3, xmmword [0x180088740]
movdqa xmm5, xmmword [str.7777]
movdqa xmm0, xmmword [0x180088750]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x74]
mov r8d, dword [rsp + 0x60]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x20
jl 0x1800478c0
cmp ecx, 0x23
jge 0x1800479db
movsxd rax, ecx
lea r8, [rsp + 0x70]
add r8, rax
nop
mov eax, 0x94f2095
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
sub al, dl
add al, 0x36
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x23
jl 0x1800479b0
lea rax, [rsp + 0x70]
mov rsi, 0xffffffffffffffff
mov rcx, rsi
nop word [rax + rax]
inc rcx
cmp byte [rax + rcx], r15b
jne 0x1800479f0
mov rdx, qword [0x18009ec48]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rdx
cmp rax, rcx
jb 0x180047e08
lea r14, [0x18009ec38]
mov rax, r14
cmp qword [0x18009ec50], 0x10
cmovae rax, qword [0x18009ec38]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov r8, r14
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.18004ccd0
nop
movups xmm0, xmmword [str.je_SHHOGc_r___ee09__]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x180088620]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x180088630]
movups xmmword [rbp - 0x70], xmm0
mov eax, dword [0x180088640]
mov dword [rbp - 0x60], eax
movzx eax, byte [0x180088644]
mov byte [rbp - 0x5c], al
mov r8d, r15d
cmp edi, 2
jl 0x180047bb7
movdqa xmm4, xmmword [0x1800886c0]
movdqa xmm3, xmmword [0x180088740]
movdqa xmm5, xmmword [str.7777]
movdqa xmm0, xmmword [0x180088750]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x74]
mov edx, dword [rsp + 0x60]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x180047ad0
cmp r8d, 0x35
jge 0x180047bff
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x35
jl 0x180047bd0
lea rax, [rsp + 0x70]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], 0
jne 0x180047c07
mov rdx, qword [0x18009ec48]
sub rbx, rdx
cmp rbx, rcx
jb 0x180047e0e
mov rax, r14
cmp qword [0x18009ec50], 0x10
cmovae rax, qword [0x18009ec38]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov r8, r14
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp - 0x40]
call fcn.18004ccd0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x50], xmm1
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
movzx eax, r15w
test rbx, rbx
je 0x180047c90
mov rax, rsi
inc rax
cmp byte [rbx + rax], 0
jne 0x180047c85
jmp 0x180047c95
mov rbx, qword [rsp + 0x68]
movzx r14d, ax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, r14d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test eax, eax
je 0x180047d0b
lea edx, [rdi + 1]
mov eax, 2
mul rdx
cmovb rax, rsi
mov rcx, rax
call fcn.1800656cc
mov rsi, rax
test rax, rax
je 0x180047d0b
mov qword [rbp - 0x48], rax
movzx edx, di
add dx, dx
lea ecx, [rdx + 2]
mov word [rbp - 0x4e], cx
mov word [rbp - 0x50], dx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov word [rsi + rdi*2], r15w
lea rcx, [rbp - 0x50]
call qword [0x1800a4870]
mov ebx, eax
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x180047d2d
call fcn.1800656d4
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x50], r15d
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180047d89
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047d84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180047e14
call fcn.180057360
movdqa xmm0, xmmword [0x1800886b0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180047dd1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180047dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180047e02
call fcn.180057360
movzx eax, bl
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.180056f00
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm7, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18005daac
int3
call fcn.1800418e0
nop
call fcn.1800418e0
nop
call fcn.18005daac
int3