Function at 0x140202570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor eax, eax
mov dword [rsp + 0x60], 0x580053
xor ebx, ebx
mov dword [rsp + 0x64], 0x570051
mov ecx, ebx
mov dword [rsp + 0x68], 0x480041
mov dword [rsp + 0x6c], 0x44005a
mov esi, 4
mov dword [rsp + 0x70], 0x7b007d
mov dword [rsp + 0x74], 0x6e0078
mov dword [rsp + 0x78], 0x790062
mov dword [rsp + 0x7c], 0x60004d
mov dword [rbp - 0x80], 0x65007e
mov dword [rbp - 0x7c], 0x7c0060
mov dword [rbp - 0x78], 0x460078
mov dword [rbp - 0x74], 0x630073
mov dword [rbp - 0x70], 0x5a0044
mov dword [rbp - 0x6c], 0x750075
mov dword [rbp - 0x68], 0x6f0068
mov dword [rbp - 0x64], 0x730071
mov dword [rbp - 0x60], 0x65007c
mov dword [rbp - 0x5c], 0x550047
mov dword [rbp - 0x58], 0x46004d
mov dword [rbp - 0x54], 0x600043
mov dword [rbp - 0x50], 0x48005d
mov dword [rbp - 0x4c], 0x4f0058
mov dword [rbp - 0x48], 0x7e0070
mov dword [rbp - 0x44], 0x4a004d
mov dword [rbp - 0x40], 0x50005e
mov dword [rbp - 0x3c], 0x5a0040
mov dword [rbp - 0x38], 0x46005b
mov dword [rbp - 0x34], 0x7f006a
mov dword [rbp - 0x30], 0x490041
mov dword [rbp - 0x2c], 0x49005f
mov dword [rbp - 0x28], 0x54004a
mov dword [rbp - 0x24], 0x50004d
mov dword [rbp - 0x20], 0x40032
mov dword [rbp - 0x1c], 0x25002c
mov dword [rbp - 0x18], 0x37002b
mov dword [rbp - 0x14], 0x220025
mov dword [rbp - 0x10], 0xa002c
mov dword [rbp - 0xc], 0x2f0025
mov dword [rbp - 8], 0x40029
mov dword [rbp - 4], 0x3b0020
mov dword [rbp], 0x360035
mov dword [rbp + 4], 0x3a0020
mov dword [rbp + 8], 0x2c0020
mov word [rbp + 0xc], ax
movsxd rax, ecx
xor word [rsp + rax*2 + 0x60], cx
inc ecx
cmp ecx, 0x56
jb 0x1402026d0
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
mov word [rbp + 0xc], bx
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x10], rbx
call fcn.14013edcc
cmp qword [rbp + 0x28], 8
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0xa0], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rdi, rbx
lea rcx, [rbp + 0x10]
test eax, eax
cmove rdi, qword [rbp + 0xa0]
call fcn.14013ed68
test rdi, rdi
je 0x140202862
mov dword [rsp + 0x50], 0x6f0045
mov eax, ebx
mov dword [rsp + 0x54], 0x610063
mov dword [rsp + 0x58], 0x600068
mov dword [rsp + 0x5c], 0x62
nop dword [rax]
movsxd rcx, eax
xor word [rsp + rcx*2 + 0x50], ax
inc eax
cmp eax, 7
jb 0x140202790
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x30]
mov word [rsp + 0x5e], bx
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x30], rbx
call fcn.14013edcc
cmp qword [rbp + 0x48], 8
lea rax, [rbp + 0x98]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
cmovae r8, qword [rbp + 0x30]
lea rax, [rbp + 0x90]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rbp + 0x90], ebx
mov dword [rbp + 0x98], esi
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 0x10]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ebx, dword [rbp + 0x90]
lea rcx, [rbp + 0x30]
test eax, eax
mov esi, 0xffffffff
cmovne ebx, esi
call fcn.14013ed68
mov eax, 0x80000000
add rax, rdi
cmp rax, 5
jbe 0x140202854
cmp rdi, 0xffffffff80000007
je 0x140202854
cmp rdi, 0xffffffff80000060
je 0x140202854
cmp rdi, 0xffffffff80000050
je 0x140202854
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 2
cmp ebx, esi
cmove ebx, eax
mov eax, ebx
jmp 0x140202867
mov eax, 2
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret