Function at 0x140205480
Capabilities:
Acquire debug privileges
Delete registry key
Encode data using xor
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
xor ebx, ebx
mov r15, r8
mov qword [rsp + 0x40], rbx
mov rsi, rdx
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [rbx + 0x20]
call qword [sym.imp.advapi32.dll_OpenProcessToken]
lea r14d, [rbx + 1]
test eax, eax
je 0x140205524
lea r8, [rsp + 0x70]
xor ecx, ecx
lea rdx, [0x1404cb618]
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140205524
mov rax, qword [rsp + 0x70]
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rbp - 0x7c], rax
mov dword [rbp - 0x80], r14d
mov dword [rbp - 0x74], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140205524
add rsp, 0x2a0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x2e0], r12
call qword [sym.imp.kernel32.dll_CloseHandle]
movdqa xmm0, xmmword [0x1404cec10]
lea rcx, [rsp + 0x50]
mov rdx, r15
mov qword [rsp + 0x50], rbx
movdqu xmmword [rsp + 0x60], xmm0
call fcn.14013edcc
mov r12d, 0x5c
mov ecx, ebx
mov dword [rbp + 0x1d0], r12d
nop
movsxd rax, ecx
xor word [rbp + rax*2 + 0x1d0], cx
inc ecx
cmp ecx, r14d
jb 0x140205570
mov rdi, 0xffffffffffffffff
mov word [rbp + 0x1d2], bx
mov r8, rdi
lea rax, [rbp + 0x1d0]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1402055a0
lea rdx, [rbp + 0x1d0]
lea rcx, [rsp + 0x50]
call fcn.14013ec14
nop dword [rax + rax]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x1402055c0
mov r8, rdi
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.14013ec14
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
cmovae rcx, qword [rsp + 0x50]
call fcn.140205220
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegDeleteKeyW]
test eax, eax
je 0x14020562f
lea rax, [rsp + 0x48]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x140205663
cmp eax, 2
jne 0x140205632
mov ebx, r14d
mov r14d, ebx
mov ebx, r14d
lea rcx, [rsp + 0x50]
call fcn.14013ed68
mov r12, qword [rsp + 0x2e0]
mov eax, ebx
mov rdi, qword [rsp + 0x2d8]
add rsp, 0x2a0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsi + rcx*2 - 2], r12w
lea rdi, [rsi + rcx*2]
je 0x140205686
mov word [rdi], r12w
add rdi, 2
mov word [rdi], bx
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1e8]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x70]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x1e8], 0x104
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1402057a7
nop dword [rax]
mov word [rdi], bx
mov ecx, 0x208
mov rax, rsi
nop dword [rax + rax]
cmp word [rax], bx
je 0x1402056ee
add rax, 2
sub rcx, r14
jne 0x1402056e0
mov eax, 0x208
sub rax, rcx
test rcx, rcx
cmove rax, rbx
je 0x14020574e
mov edx, 0x208
sub rdx, rax
lea rax, [rsi + rax*2]
je 0x140205740
lea r9, [rbp - 0x70]
mov ecx, 0x7ffffffe
sub r9, rax
nop dword [rax]
test rcx, rcx
je 0x140205740
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x140205740
mov word [rax], r8w
dec rcx
add rax, 2
sub rdx, r14
jne 0x140205720
test rdx, rdx
lea rcx, [rax - 2]
cmovne rcx, rax
mov word [rcx], bx
mov r8, r15
mov rdx, rsi
mov rcx, 0xffffffff80000002
call fcn.140205480
test eax, eax
je 0x1402057a7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x1e8]
mov qword [rsp + 0x30], rbx
lea r8, [rbp - 0x70]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x1e8], 0x104
call qword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x1402056d0
mov word [rdi - 2], bx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegDeleteKeyW]
test eax, eax
je 0x140205635
jmp 0x140205638