Function at 0x140018e84
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
mov al, byte [0x1401a8d84]
neg al
sbb rbx, rbx
add rbx, 0xffffffff80000002
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
xor r12d, r12d
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov qword [rbp - 0x41], r12
lea rcx, [0x1401a09a8]
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, [0x1401399d0]
lea rcx, [rbp - 0x31]
call fcn.140002c48
nop
mov r8, rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x19]
call fcn.14000d870
nop
lea r8, [0x1401a9150]
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14000d870
nop
lea r8, [0x140139960]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140017bcc
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.14000d870
nop
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140001ff8
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
or r15, 0xffffffffffffffff
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140018f98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140018fb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140018fda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140018ffb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001901b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x1401399d0]
lea rcx, [rbp - 1]
call fcn.140002c48
nop
mov r8, rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x11]
call fcn.14000d870
nop
lea r8, [0x1401a9150]
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.14000d870
nop
lea r8, [0x140139960]
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.140017bcc
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.14000d870
nop
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
mov r8, qword [rax]
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400186cc
test eax, eax
setne bl
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400190b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400190d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400190f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001911a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001913a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x140019245
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 0xa
jne 0x1400191a6
mov r9d, r12d
mov edx, r9d
mov r10d, 8
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
dec r10
jne 0x140019177
add r8d, edx
inc r9d
cmp r9d, 0x100
jl 0x14001916e
mov dword [0x1401a8d80], r8d
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400191c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400191da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400191ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001921f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001923e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x140019409
mov dword [rbp + 0x7f], r14d
mov r14d, 4
mov dword [rsp + 0x28], r14d
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
mov rdx, qword [rdi]
mov rbx, qword [rbp - 0x51]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14001930f
test rbx, rbx
je 0x14001928d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400192b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400192c5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400192ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001930a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14001921f
test rbx, rbx
je 0x140019321
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
call fcn.140018a1c
test al, al
jne 0x14001936f
mov r8d, dword [0x1401a8d80]
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov rax, r14
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140019390
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400193a3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400193c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400193e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140019407
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret