Function at 0x14004e050
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
xor r15d, r15d
lea r12, [0x1400b61c0]
movdqa xmm0, xmmword [0x1400a5500]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400a5530]
movdqu xmmword [rsp + 0x70], xmm1
mov word [rbp - 0x80], 0xd7d0
mov byte [rbp - 0x7e], 0xa5
mov ecx, r15d
lea rdx, [rsp + 0x60]
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x22
jb 0x14004e0b0
mov byte [rbp - 0x7e], r15b
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x14004e0e0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400608e0
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004e3a1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xc0]
call fcn.140090d00
mov dword [rbp + 0x208], 1
mov dword [rbp + 0x200], 0x104
mov dword [rsp + 0x30], 0xe7e0f0d0
mov dword [rsp + 0x34], 0xe3e5cbea
mov dword [rsp + 0x38], 0xcaf9e2ee
mov word [rsp + 0x3c], 0xfce3
mov byte [rsp + 0x3e], 0x91
mov ecx, r15d
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xe
jb 0x14004e190
mov byte [rsp + 0x3e], 0
lea rax, [rbp + 0x200]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x208]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004e3a1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14004e201
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.1400608e0
nop
lea rbx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14004e29f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp + 0x18], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x1d]
call fcn.140090d00
mov byte [rbp + 0x1c], 1
lea rax, [rdi - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax - 0x40], 0
jne 0x14004e29a
cmp rcx, rbx
je 0x14004e29f
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax - 0x40], 0
je 0x14004e288
sub rcx, rbx
jmp 0x14004e2a6
mov rcx, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movsxd r8, ecx
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400608e0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14004e319
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e426
call fcn.1400624fc
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm1
mov rcx, qword [rbp + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x1400b61c0], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x1400b61d0], xmm1
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14004e408
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e403
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e420
jmp 0x14004e403
mov rcx, qword [rbp + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [0x1400b61c0], xmm0
mov qword [0x1400b61d0], r15
mov qword [0x1400b61d8], 0xf
mov byte [0x1400b61c0], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14004e408
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e403
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e41a
call fcn.1400624fc
mov rax, r12
add rsp, 0x2d0
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.1400788cc
int3
call fcn.1400788cc
nop
call fcn.1400788cc
nop
int3