Function at 0x1400011c0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
movdqa xmm3, xmmword [0x140005550]
xor r12d, r12d
movdqa xmm4, xmmword [0x140005570]
mov ecx, r12d
mov dword [rsp + 0x60], 0xf3adf3a0
mov edx, 0xf3fa
mov dword [rsp + 0x64], 0xf3a2f3a6
mov dword [rsp + 0x68], 0xf3b5f3b2
mov dword [rsp + 0x6c], 0xf3b9f3a5
mov dword [rsp + 0x70], 0xf38ef38e
mov dword [rsp + 0x74], 0xf39bf38f
mov dword [rsp + 0x78], 0xf474f391
mov dword [rsp + 0x7c], 0xf46df442
mov dword [rbp - 0x80], 0xf470f46d
mov dword [rbp - 0x7c], 0xf469f477
mov dword [rbp - 0x78], 0xf45bf46b
mov dword [rbp - 0x74], 0xf47ef46c
mov dword [rbp - 0x70], 0xf45ff457
mov dword [rbp - 0x6c], 0xf47cf468
mov dword [rbp - 0x68], 0xf479f479
mov dword [rbp - 0x64], 0xf477f472
mov dword [rbp - 0x60], 0xf448f460
mov dword [rbp - 0x5c], 0xf47ff451
mov dword [rbp - 0x58], 0xf473f464
mov dword [rbp - 0x54], 0xf45ff445
mov dword [rbp - 0x50], 0xf469f475
mov dword [rbp - 0x4c], 0xf470
mov byte [rbp - 0x48], 1
nop word [rax + rax]
movd xmm1, dword [rsp + rcx*2 + 0x60]
lea rax, [rdx - 5]
xorps xmm0, xmm0
movq xmm2, rcx
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rdx - 3]
movd dword [rsp + rcx*2 + 0x60], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rcx*2 + 0x64]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
lea rax, [rdx - 1]
movd dword [rsp + rcx*2 + 0x64], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rcx*2 + 0x68]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rdx
movd dword [rsp + rcx*2 + 0x68], xmm1
add rdx, 8
movd xmm1, dword [rsp + rcx*2 + 0x6c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rcx*2 + 0x6c], xmm1
add rcx, 8
cmp rdx, 0xf422
jb 0x1400012b0
cmp rcx, 0x2b
jae 0x1400013b5
mov edx, 0xc0d
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x60], ax
inc rcx
cmp rcx, 0x2b
jb 0x1400013a1
lea rax, [rbp - 0x40]
mov byte [rbp - 0x48], r12b
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400013e8
xor al, al
jmp 0x140001690
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x320], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x328], r14
xor r9d, r9d
mov qword [rsp + 0x330], r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor r15b, r15b
mov dword [rbp - 0x38], 0x200
mov dword [rsp + 0x50], 0x30
mov byte [rsp + 0x54], r12b
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000166a
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140002960
mov ebx, 0xf3f4
mov dword [rsp + 0x40], 0xf3b9f3a5
mov ecx, ebx
mov dword [rsp + 0x44], 0xf397f382
mov dword [rsp + 0x48], 0xf39df385
lea rdx, [rsp + 0x40]
mov word [rsp + 0x4c], r12w
mov r8d, 3
mov byte [rsp + 0x4e], 1
nop dword [rax + rax]
movd xmm1, dword [rdx]
lea rax, [rcx - 1]
movq xmm0, rcx
lea rdx, [rdx + 4]
movq xmm2, rax
add rcx, 2
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 4], xmm1
sub r8, 1
jne 0x140001490
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x4e], r12b
lea rcx, [rbp - 0x30]
call fcn.1400027f0
mov r14, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x30]
cmp rax, 0xffffffffffffffff
jne 0x140001620
mov dword [rsp + 0x30], 0xf3b6f3a5
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], 0xf3aef3ba
mov edx, 2
mov word [rsp + 0x38], r12w
mov byte [rsp + 0x3a], 1
nop dword [rax + rax]
movd xmm1, dword [rcx]
lea rax, [rbx - 1]
movq xmm0, rbx
lea rcx, [rcx + 4]
movq xmm2, rax
add rbx, 2
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx - 4], xmm1
sub rdx, 1
jne 0x140001520
mov byte [rsp + 0x3a], r12b
lea rax, [rsp + 0x30]
mov r10, 0xffffffffffffffff
inc r10
cmp word [rax + r10*2], r12w
jne 0x140001572
mov rax, qword [rbp - 0x20]
lea rbx, [rbp - 0x30]
cmp r14, 7
cmova rbx, rdi
cmp r10, rax
ja 0x140001623
sub rax, r10
test r10, r10
je 0x140001620
movzx r11d, word [rsp + 0x30]
inc rax
lea rsi, [rbx + rax*2]
mov rax, rbx
mov rcx, rsi
mov rdx, r12
sub rcx, rax
sar rcx, 1
je 0x1400015db
cmp word [rax], r11w
je 0x1400015d8
cmp rcx, 1
je 0x1400015db
add rax, 2
dec rcx
cmp word [rax], r11w
jne 0x1400015c5
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140001623
lea rdx, [rsp + 0x30]
mov r8, r10
test r10, r10
je 0x140001614
lea rcx, [rsp + 0x30]
mov r9, rax
sub r9, rcx
nop dword [rax + rax]
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x140001659
add rdx, 2
sub r8, 1
jne 0x140001600
sub rax, rbx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x140001623
mov r15b, 1
cmp r14, 7
jbe 0x14000166a
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001662
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, 2
jmp 0x1400015b1
mov rcx, rdi
call fcn.14000328c
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x328]
movzx eax, r15b
mov r15, qword [rsp + 0x330]
mov rdi, qword [rsp + 0x320]
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140003160
mov rbx, qword [rsp + 0x338]
add rsp, 0x300
pop r12
pop rsi
pop rbp
ret