Function at 0x14001e0d8
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x1401567f8]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp - 0x40], rdx
call fcn.140006284
mov rcx, rax
test rax, rax
je 0x14001e3bf
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x40], rbx
mov dword [rbp - 0x44], 1
mov dword [rbp - 0x4c], 0x1000
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x1008
sub eax, edx
or eax, ecx
jge 0x14001e161
lea rcx, [rbp - 0x40]
call fcn.1400262ec
mov rbx, qword [rbp - 0x40]
mov dword [rbp - 0x48], 0xb1475086
mov r14d, 4
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r14 + rdi]
cmp dword [0x140160524], eax
jle 0x14001e1c3
lea rcx, [0x140160524]
call fcn.1400b77a0
cmp dword [0x140160524], 0xffffffff
jne 0x14001e1c3
mov byte [0x140160890], 1
mov eax, dword [rbp - 0x48]
mov dword [0x14016088c], eax
lea rcx, [0x1400ff668]
call fcn.1400b7e90
lea rcx, [0x140160524]
call fcn.1400b7740
lea r12, [0x14016088c]
movabs r8, 0xfbd30f43b12339e1
cmp byte [0x140160890], 0
je 0x14001e201
xor edx, edx
mov cl, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r12], al
inc rdx
cmp rdx, 4
jb 0x14001e1df
mov byte [0x140160890], 0
movdqa xmm6, xmmword [0x14013e0d0]
movdqu xmmword [rbp - 0x38], xmm6
mov dword [rbp - 0x28], 0xd2556a8c
mov byte [rbp - 0x24], 0x43
mov eax, dword [r14 + rdi]
cmp dword [0x1401605d4], eax
jle 0x14001e275
lea rcx, [0x1401605d4]
call fcn.1400b77a0
cmp dword [0x1401605d4], 0xffffffff
jne 0x14001e26b
mov word [0x140160b5c], 0x143
movups xmmword [0x140160b48], xmm6
mov eax, dword [rbp - 0x28]
mov dword [0x140160b58], eax
lea rcx, [0x1400ff670]
call fcn.1400b7e90
lea rcx, [0x1401605d4]
call fcn.1400b7740
movabs r8, 0xfbd30f43b12339e1
lea r10, [0x140160b48]
cmp byte [0x140160b5d], 0
je 0x14001e2a9
xor edx, edx
mov cl, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r10], al
inc rdx
cmp rdx, 0x15
jb 0x14001e287
mov byte [0x140160b5d], 0
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x44]
mov r8, r12
mov rdx, r10
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test rbx, rbx
jne 0x14001e2d7
xor eax, eax
jmp 0x14001e2eb
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400be194
test eax, eax
js 0x14001e3ca
cmp eax, dword [rbx - 0xc]
jg 0x14001e3ca
mov dword [rbx - 0x10], eax
mov eax, eax
mov byte [rax + rbx], 0
lea rdi, [rsi + 0x70]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rbx + rsi], 0
jne 0x14001e305
cmp rsi, qword [rdi + 0x18]
ja 0x14001e33a
mov r12, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14001e321
mov r12, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov rdx, rbx
mov rcx, r12
call fcn.1400b9a70
mov byte [r12 + rsi], 0
jmp 0x14001e348
mov r9, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14002a7c0
xorps xmm0, xmm0
movups xmmword [r15], xmm0
and qword [r15 + 0x10], 0
and qword [r15 + 0x18], 0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x14001e367
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, r15
call fcn.14002abb4
nop
or ecx, 0xffffffff
lock xadd dword [rbx - 8], ecx
sub ecx, 1
jg 0x14001e38f
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rioctlsocket + 8]
mov rax, r15
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.1400b7620
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400020e0
nop
mov ecx, 0x80070057
call fcn.1400020e0
int3