Function at 0x14004c6c0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0x500], rax
mov rdi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov r10d, dword [0x1401cbd80]
lea r9d, [r10 + 1]
imul r9d, r10d
mov eax, 0x30c30c31
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r9d, edx
xor r12d, r12d
cmp r9d, 0x10
jne 0x14004c7da
mov edx, r12d
nop word [rax + rax]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r10d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r10d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r10d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r10d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r10d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r10d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r10d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r10d
sar ecx, 1
xor eax, ecx
add r10d, eax
inc edx
cmp edx, 0x100
jl 0x14004c740
mov dword [0x1401cbd80], r10d
mov rsi, r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], pe_nt_image_headers64
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14004c875
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004c92f
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], r12d
mov rcx, qword [r15]
mov eax, r12d
test rcx, rcx
setne al
test eax, eax
jne 0x14004c899
lea ebx, [rax + 0xd]
jmp 0x14004c8d2
or rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14004c8a0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [0x1401cbd80]
lea r8d, [rcx + 1]
imul r8d, ecx
mov eax, 0x78787879
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x11
sub r8d, edx
cmp r8d, 0xf
jne 0x14004c90a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401cbd80], eax
test rsi, rsi
je 0x14004c920
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, r12
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
test ebx, ebx
sete bl
jmp 0x14004ca89
mov edx, dword [0x1401cbd80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 7
jne 0x14004ca87
mov rbx, r12
mov edi, 0xaf
nop
call fcn.1400d2038
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 - 0x80], xmm0
inc rbx
cmp rbx, rdi
jb 0x14004c970
mov r9, r12
mov r10d, 0xae
nop word [rax + rax]
mov edx, 0xae
cmp r9, rdx
jge 0x14004ca78
cmp r10, 4
jl 0x14004ca4d
lea rcx, [rbp + 0x4e0]
mov r8d, 0xaa
sub r8, r9
shr r8, 2
inc r8
lea rax, [r8*4]
sub rdx, rax
nop word [rax + rax]
movsd xmm0, qword [rcx + 0x10]
movsd xmm1, qword [rcx + 8]
comisd xmm0, xmm1
jbe 0x14004c9fa
movsd qword [rcx + 0x10], xmm1
movsd qword [rcx + 8], xmm0
movsd xmm0, qword [rcx + 8]
movsd xmm1, qword [rcx]
comisd xmm0, xmm1
jbe 0x14004ca12
movsd qword [rcx + 8], xmm1
movsd qword [rcx], xmm0
movsd xmm0, qword [rcx]
movsd xmm1, qword [rcx - 8]
comisd xmm0, xmm1
jbe 0x14004ca2a
movsd qword [rcx], xmm1
movsd qword [rcx - 8], xmm0
movsd xmm0, qword [rcx - 8]
movsd xmm1, qword [rcx - 0x10]
comisd xmm0, xmm1
jbe 0x14004ca44
movsd qword [rcx - 8], xmm1
movsd qword [rcx - 0x10], xmm0
sub rcx, 0x20
dec r8
jne 0x14004c9e0
cmp rdx, r9
jle 0x14004ca78
movsd xmm0, qword [rbp + rdx*8 - 0x80]
movsd xmm1, qword [rsp + rdx*8 + 0x78]
comisd xmm0, xmm1
jbe 0x14004ca70
movsd qword [rbp + rdx*8 - 0x80], xmm1
movsd qword [rsp + rdx*8 + 0x78], xmm0
dec rdx
cmp rdx, r9
jg 0x14004ca52
inc r9
dec r10
dec rdi
jne 0x14004c9a0
xor bl, bl
test rsi, rsi
je 0x14004ca9c
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r12
movzx eax, bl
mov dword [rsp + 0x60], r12d
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.1400d1680
add rsp, 0x610
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret