Function at 0x14001b6f0
Capabilities:
Encode data using base64
Encode data using xor
Set registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov eax, dword [0x141dc51f8]
and eax, dword [0x141dc51fc]
imul eax, eax, 0x7036c068
xor eax, 0xc174221
or eax, 0xf00881ce
cmp eax, 0x149755a9
jne 0x14001b740
movzx eax, byte [0x141dde6f8]
nop word cs:[rax + rax]
mov eax, dword [0x141dc5200]
add eax, dword [0x141dc5204]
imul rax, rax, 0x5251f825
shr rax, 0x3d
add eax, 0x7b3f08d7
movzx ecx, byte [0x141dde6f8]
cmp eax, 0x2468f487
jb 0x14001b740
xor eax, eax
test al, al
je 0x14001b780
mov edx, 4
xor ecx, ecx
call fcn.1400c29b0
nop dword [rax]
mov ebp, dword [0x141dc5208]
or ebp, dword [0x141dc520c]
add ebp, 0x467fe54d
and ebp, 0x7fc0f7b1
mov edx, 4
xor ecx, ecx
call fcn.1400c29b0
cmp ebp, 0x593b957b
ja 0x14001b780
mov rsi, rax
test rax, rax
je 0x14001b7ea
mov eax, dword [0x141dc5220]
xor eax, dword [0x141dc5224]
add eax, 0xfc4b137c
and eax, 0xceaebfdc
imul rcx, rax, 0x2ba329f9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xcae4ad79
jne 0x14001b83e
jmp 0x14001b86b
mov eax, dword [0x141dc5210]
add eax, dword [0x141dc5214]
xor eax, 0x11812008
or eax, 0x460ade17
xor eax, 0x67568ff7
cmp eax, 0xef2a77a5
jbe 0x14001b810
ud2
mov eax, dword [0x141dc5218]
xor edx, edx
div dword [0x141dc521c]
or eax, 0x3eb63a4e
xor eax, 0x6fd3a0be
imul rax, rax, 0xe0fca59
shr rax, 0x3b
ud2
mov eax, dword [0x141dc5228]
add eax, dword [0x141dc522c]
mov ecx, dword [r15]
mov dword [rsi], ecx
or eax, 0xcec17b0e
imul eax, eax, 0xfa7995a9
add eax, 0xbdaf3102
mov qword [rsp + 0x30], rbx
cmp eax, 0x17f07e8
jae 0x14001b877
mov eax, dword [r15]
mov dword [rsi], eax
mov qword [rsp + 0x30], rbx
jmp 0x14001b83e
add rbx, r14
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x40], 0
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140086180
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
mov ecx, dword [str._r6_]
or ecx, dword [0x141dc5234]
cmp ecx, 0xab87b6a9
je 0x14001b8d0
test rax, rax
je 0x14001b928
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xedbcd47f
mov ecx, dword [0x141dc5238]
or ecx, dword [0x141dc523c]
imul ecx, ecx, 0xd40fda2a
imul rcx, rax
shr rcx, 0x3f
or ecx, 0xdaf5c086
cmp ecx, 0x22ba9870
je 0x14001b900
mov eax, dword [0x141dc5240]
and eax, dword [0x141dc5244]
imul rax, rax, 0x6222d41f
shr rax, 0x3d
imul eax, eax, 0xd0da28b8
mov ecx, 0xb7e98763
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xe48e7cc
je 0x14001b995
mov eax, dword [0x141dc5248]
xor edx, edx
div dword [0x141dc524c]
mov ecx, 0x879c55c3
imul rcx, rax
shr rcx, 0x3f
imul ebx, ecx, 0xa80061d3
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xa698d5f6
jne 0x14001b9a9
mov rcx, qword [0x141dde6e0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001b95a
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
mov edx, 0x91394405
xor r8d, r8d
nop dword [rax]
mov eax, dword [0x141dc5250]
sub eax, dword [0x141dc5254]
imul rax, rdx
shr rax, 0x3d
imul r9d, eax, 0xa8ced271
xor r9d, 0xf293db26
test edi, edi
mov rax, rcx
cmove rax, r8
cmp r9d, 0x5c6f8ed3
ja 0x14001b9c0
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret