Function at 0x180014430
Capabilities:
Encode data using xor
Hash data with crc32
Set registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0x108], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x180071080]
xor rax, rsp
mov qword [rsp + 0x138], rax
and dword [rsp + 0x98], 0xfffffe00
xor esi, esi
mov qword [r11 - 0xc8], rsi
mov qword [r11 - 0xc0], rsi
mov qword [r11 - 0xb8], rsi
and dword [rsp + 0x70], 0xfffffe00
mov qword [rsp + 0x78], rsi
mov qword [r11 - 0xe8], rsi
mov qword [r11 - 0xe0], rsi
mov r15d, esi
mov rbx, qword [rcx + 0x30]
mov qword [rsp + 0x58], rbx
mov rdi, qword [rbx]
mov r13, qword [rcx]
lea rbp, [0x180073760]
test r13, r13
je 0x1800144cd
cmp r13, r13
je 0x1800144d2
call fcn.18003c72c
cmp rdi, rbx
je 0x1800148b7
test r13, r13
jne 0x1800144ea
call fcn.18003c72c
mov r11, rsi
jmp 0x1800144ee
mov r11, qword [r13]
cmp rdi, qword [r11 + 0x30]
jne 0x1800144f9
call fcn.18003c72c
mov rsi, qword [rdi + 0x30]
test r13, r13
jne 0x18001450c
call fcn.18003c72c
xor r11d, r11d
jmp 0x180014510
mov r11, qword [r13]
cmp rdi, qword [r11 + 0x30]
jne 0x18001451b
call fcn.18003c72c
cmp qword [rdi + 0x38], 8
jb 0x180014528
mov r8, qword [rdi + 0x20]
jmp 0x18001452c
lea r8, [rdi + 0x20]
or edx, 0xffffffff
lea eax, [rsi + rsi]
test eax, eax
jle 0x18001455e
mov r9d, eax
nop dword [rax]
movzx ecx, dl
movzx eax, byte [r8]
xor rcx, rax
mov eax, edx
shr eax, 8
mov edx, dword [rbp + rcx*4]
xor edx, eax
inc r8
sub r9, 1
jne 0x180014540
not edx
add r15d, edx
test r13, r13
jne 0x180014574
call fcn.18003c72c
xor esi, esi
mov r11, rsi
jmp 0x18001457a
mov r11, qword [r13]
xor esi, esi
cmp rdi, qword [r11 + 0x30]
jne 0x180014585
call fcn.18003c72c
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0xe0]
call fcn.180001390
nop
mov r14d, dword [rsp + 0x38]
and r14d, 0xffffff04
or r14d, 0x104
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov rdx, qword [rax + 0x18]
cmp qword [rax + 0x20], 0x10
jb 0x1800145cf
mov rcx, qword [rax + 8]
jmp 0x1800145d3
lea rcx, [rax + 8]
call fcn.180029120
mov r12, rax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.18002991c
mov rbp, rax
movsx ecx, byte [rsp + 0x70]
test ecx, ecx
js 0x180014725
cmp ecx, 5
jle 0x180014721
cmp ecx, 6
je 0x180014634
cmp ecx, 7
jne 0x180014725
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x38]
jmp 0x180014727
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x38], 0
je 0x18001471d
mov rsi, qword [rax + 0x30]
mov qword [rsp + 0xd8], rsi
mov rax, qword [rax]
mov qword [rsp + 0xd0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [rsp + 0xc0], xmm0
test rax, rax
jne 0x180014676
call fcn.18003c72c
cmp byte [rsi + 0x51], 0
je 0x18001468d
mov rbx, qword [rsi + 0x10]
cmp byte [rbx + 0x51], 0
je 0x1800146ed
call fcn.18003c72c
jmp 0x1800146ed
mov rbx, qword [rsi]
cmp byte [rbx + 0x51], 0
jne 0x1800146af
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x51], 0
jne 0x1800146ed
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x51], 0
je 0x1800146a0
jmp 0x1800146ed
mov rax, qword [rsi + 8]
cmp byte [rax + 0x51], 0
jne 0x1800146d5
mov rbx, qword [rsp + 0xc8]
cmp rbx, qword [rax]
jne 0x1800146dd
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x51], 0
je 0x1800146c1
jmp 0x1800146dd
mov rbx, qword [rsp + 0xc8]
cmp byte [rbx + 0x51], 0
je 0x1800146ea
call fcn.18003c72c
jmp 0x1800146ed
mov rbx, rax
mov rax, qword [rsp + 0xc0]
test rax, rax
jne 0x180014706
call fcn.18003c72c
xor esi, esi
mov r11, rsi
jmp 0x18001470b
mov r11, qword [rax]
xor esi, esi
cmp rbx, qword [r11 + 0x30]
jne 0x180014716
call fcn.18003c72c
mov ecx, dword [rbx + 0x20]
inc ecx
jmp 0x180014727
mov ecx, esi
jmp 0x180014727
mov ecx, esi
jmp 0x180014727
mov ecx, esi
mov edx, ecx
lea rcx, [rsp + 0x68]
call fcn.18002a6b8
mov r11, rax
movsx edx, byte [rax + 8]
movzx ecx, byte [rbp + 8]
mov byte [rax + 8], cl
mov byte [rbp + 8], dl
cmp rax, rbp
je 0x180014757
mov rcx, qword [rax]
mov rdx, qword [rbp]
mov qword [rax], rdx
mov qword [rbp], rcx
mov ecx, dword [rax + 8]
mov edx, ecx
shr edx, 8
and edx, 1
mov eax, ecx
xor eax, dword [rbp + 8]
and eax, 0x100
xor eax, ecx
mov dword [r11 + 8], eax
and dword [rbp + 8], 0xfffffeff
and edx, 1
shl edx, 8
or dword [rbp + 8], edx
lea rdx, [rbp + 0x10]
lea r8, [r11 + 0x10]
cmp r8, rdx
je 0x18001479b
mov rcx, qword [r8]
mov rax, qword [rdx]
mov qword [r8], rax
mov qword [rdx], rcx
lea rdx, [rbp + 0x18]
lea r8, [r11 + 0x18]
cmp r8, rdx
je 0x1800147b4
mov rcx, qword [r8]
mov rax, qword [rdx]
mov qword [r8], rax
mov qword [rdx], rcx
lea rdx, [rbp + 0x20]
add r11, 0x20
cmp r11, rdx
je 0x1800147cd
mov rcx, qword [r11]
mov rax, qword [rdx]
mov qword [r11], rax
mov qword [rdx], rcx
mov rcx, rbp
call fcn.180029ac8
nop
movsx eax, byte [rsp + 0x38]
cmp eax, 4
je 0x1800147ff
add eax, 0xfffffffa
cmp eax, 1
ja 0x18001480f
test r12, r12
je 0x18001480f
mov rcx, r12
call fcn.18002e1e8
mov rcx, r12
call fcn.18003c784
jmp 0x18001480f
bt r14d, 8
jae 0x18001480f
mov rcx, r12
call fcn.18003dd10
nop
cmp qword [rsp + 0x100], 0x10
jb 0x180014827
mov rcx, qword [rsp + 0xe8]
call fcn.18003c784
test r13, r13
jne 0x180014831
call fcn.18003c72c
cmp byte [rdi + 0x41], 0
je 0x18001484d
call fcn.18003c72c
mov rbx, qword [rsp + 0x58]
lea rbp, [0x180073760]
jmp 0x1800144c3
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x41], 0
jne 0x180014880
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
jne 0x18001486f
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x180014863
mov rbx, qword [rsp + 0x58]
lea rbp, [0x180073760]
jmp 0x1800144c3
mov rax, qword [rdi + 8]
cmp byte [rax + 0x41], 0
jne 0x1800148a3
nop word [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x1800148a3
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], 0
je 0x180014890
mov rdi, rax
mov rbx, qword [rsp + 0x58]
lea rbp, [0x180073760]
jmp 0x1800144c3
lea rax, [rsp + 0x110]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x110]
call fcn.18002991c
mov rbx, rax
lea r8, [0x18005d541]
lea rdx, [0x18005d538]
lea rcx, [rsp + 0x90]
call fcn.18002aa7c
mov r11, rax
movsx edx, byte [rax + 8]
movzx ecx, byte [rbx + 8]
mov byte [rax + 8], cl
mov byte [rbx + 8], dl
cmp rax, rbx
je 0x180014916
mov rcx, qword [rax]
mov rdx, qword [rbx]
mov qword [rax], rdx
mov qword [rbx], rcx
mov ecx, dword [rax + 8]
mov edx, ecx
shr edx, 8
and edx, 1
mov eax, ecx
xor eax, dword [rbx + 8]
and eax, 0x100
xor eax, ecx
mov dword [r11 + 8], eax
and dword [rbx + 8], 0xfffffeff
and edx, 1
shl edx, 8
or dword [rbx + 8], edx
lea rdx, [rbx + 0x10]
lea r8, [r11 + 0x10]
cmp r8, rdx
je 0x18001495a
mov rcx, qword [r8]
mov rax, qword [rdx]
mov qword [r8], rax
mov qword [rdx], rcx
lea rdx, [rbx + 0x18]
lea r8, [r11 + 0x18]
cmp r8, rdx
je 0x180014973
mov rcx, qword [r8]
mov rax, qword [rdx]
mov qword [r8], rax
mov qword [rdx], rcx
lea rdx, [rbx + 0x20]
add r11, 0x20
cmp r11, rdx
je 0x18001498c
mov rcx, qword [r11]
mov rax, qword [rdx]
mov qword [r11], rax
mov qword [rdx], rcx
mov rcx, rbx
call fcn.180029ac8
lea r11, [rsp + 0x30]
mov qword [rsp + 0x60], r11
mov byte [rsp + 0x38], 1
btr dword [rsp + 0x38], 8
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
movsxd rax, r15d
mov qword [rsp + 0x30], rax
lea r8, [0x18005d549]
lea rdx, str.cksum
lea rcx, [rsp + 0x90]
call fcn.18002aa7c
mov r11, rax
movsx edx, byte [rax + 8]
movzx ecx, byte [rsp + 0x38]
mov byte [rax + 8], cl
mov byte [rsp + 0x38], dl
lea rax, [rsp + 0x30]
cmp r11, rax
je 0x180014a08
mov rcx, qword [r11]
mov rdx, qword [rsp + 0x30]
mov qword [r11], rdx
mov qword [rsp + 0x30], rcx
mov ecx, dword [r11 + 8]
mov edx, ecx
shr edx, 8
and edx, 1
mov eax, dword [rsp + 0x38]
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [r11 + 8], eax
shl edx, 8
mov eax, dword [rsp + 0x38]
xor edx, eax
and edx, 0x100
xor eax, edx
mov dword [rsp + 0x38], eax
lea rdx, [r11 + 0x10]
lea rax, [rsp + 0x40]
cmp rdx, rax
je 0x180014a58
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x40], rcx
lea rdx, [r11 + 0x18]
lea rax, [rsp + 0x48]
cmp rdx, rax
je 0x180014a76
mov rcx, qword [rdx]
mov rax, qword [rsp + 0x48]
mov qword [rdx], rax
mov qword [rsp + 0x48], rcx
add r11, 0x20
lea rax, [rsp + 0x50]
cmp r11, rax
je 0x180014a94
mov rcx, qword [r11]
mov rax, qword [rsp + 0x50]
mov qword [r11], rax
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
call fcn.180029ac8
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x90]
call fcn.18002b430
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.180009450
cmp qword [rax + 0x20], 8
jb 0x180014ace
mov rbx, qword [rax + 8]
jmp 0x180014ad2
lea rbx, [rax + 8]
test rbx, rbx
je 0x180014ae2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x180014ae4
mov eax, esi
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
lea r8, str.shareList
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smpcache_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp qword [rsp + 0x50], 8
jb 0x180014b24
mov rcx, qword [rsp + 0x38]
call fcn.18003c784
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rsi
mov word [rsp + 0x38], si
cmp qword [rsp + 0x100], 0x10
jb 0x180014b50
mov rcx, qword [rsp + 0xe8]
call fcn.18003c784
nop
movsx eax, byte [rsp + 0x70]
cmp eax, 4
je 0x180014b7e
add eax, 0xfffffffa
cmp eax, 1
ja 0x180014b90
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x180014b90
mov rcx, rbx
call fcn.18002e1e8
mov rcx, rbx
call fcn.18003c784
jmp 0x180014b90
bt dword [rsp + 0x70], 8
jae 0x180014b90
mov rcx, qword [rsp + 0x68]
call fcn.18003dd10
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x180014bbb
lea rbx, [rcx - 8]
lea r9, [0x1800294a0]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18004bf1c
mov rcx, rbx
call fcn.18004bcec
nop
movsx eax, byte [rsp + 0x98]
cmp eax, 4
je 0x180014bef
add eax, 0xfffffffa
cmp eax, 1
ja 0x180014c07
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x180014c07
mov rcx, rbx
call fcn.18002e1e8
mov rcx, rbx
call fcn.18003c784
jmp 0x180014c07
bt dword [rsp + 0x98], 8
jae 0x180014c07
mov rcx, qword [rsp + 0x90]
call fcn.18003dd10
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x180014c34
lea rbx, [rcx - 8]
lea r9, [0x1800294a0]
mov r8d, dword [rbx]
mov edx, 8
call fcn.18004bf1c
mov rcx, rbx
call fcn.18004bcec
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.18003c160
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret