Function at 0x140016d80
Capabilities:
Encode data using xor
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rax - 0x6e8]
sub rsp, 0x7c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rbp + 0x640], rax
lea r14, [rbp + 0x6e8]
xor edi, edi
mov rbx, qword [r14]
mov qword [rbp - 0x80], rbx
mov qword [r14], rdi
call fcn.140016ca0
movups xmm0, xmmword [0x14002be90]
mov ecx, edi
movups xmm1, xmmword [0x14002bea0]
mov esi, dword [0x140030010]
mov eax, dword [0x14002bed8]
movdqa xmm7, xmmword [0x14002c530]
movdqa xmm9, xmmword [str.cccccccc]
movdqa xmm8, xmmword [0x14002c540]
movdqa xmm6, xmmword [0x14002c5d0]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [0x14002beb0]
movups xmmword [rbp - 0x50], xmm0
movsd xmm0, qword [0x14002bed0]
movups xmmword [rbp - 0x60], xmm1
movups xmm1, xmmword [0x14002bec0]
movsd qword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
movups xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x28], eax
cmp esi, 2
jl 0x140016f36
lea rdx, [rbp - 0x70]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm7
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm7
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x140016e50
cmp ecx, 0x26
jge 0x140016f84
movsxd rax, ecx
lea r8, [rbp - 0x70]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2aaaaaab
lea r8, [r8 + 2]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
add ax, ax
add dx, ax
movzx eax, cx
add dx, dx
inc ecx
sub ax, dx
add ax, 0x63
xor word [r8 - 2], ax
cmp ecx, 0x26
jl 0x140016f50
lea rax, [rbp - 0x20]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400174e1
mov qword [rsp + 0x7f0], r12
lea rcx, [rbp + 0x430]
mov qword [rsp + 0x7f8], r13
xor edx, edx
mov r13, qword [rbp - 0x20]
mov r8d, 0x208
mov qword [rsp + 0x78], r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rdi
lea r9, [rbp]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x430]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], rdi
mov r12d, edi
mov dword [rbp], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400174c8
mov qword [rsp + 0x800], r15
xor ebx, ebx
movaps xmmword [rsp + 0x770], xmm10
movdqa xmm10, xmmword [0x14002c580]
movaps xmmword [rsp + 0x760], xmm11
movdqa xmm11, xmmword [0x14002c570]
movaps xmmword [rsp + 0x750], xmm12
movdqa xmm12, xmmword [0x14002c550]
nop dword [rax + rax]
lea rax, [rbp - 0x18]
mov qword [rbp - 0x18], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x430]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001745d
mov r15, qword [rbp - 0x18]
lea rcx, [rbp + 0x220]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 4]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x220]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rbx
mov r14d, ebx
mov dword [rbp - 4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140017454
mov r13d, 0x45
nop dword [rax + rax]
lea rax, [rbp - 0x10]
mov qword [rbp - 0x10], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x220]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017412
mov rdi, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp - 8], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x10]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140017407
nop dword [rax + rax]
movups xmm4, xmmword [0x140029288]
mov eax, dword [0x1400292a8]
xor ecx, ecx
mov dword [rsp + 0x70], eax
movups xmm0, xmmword [0x140029298]
movups xmmword [rsp + 0x50], xmm4
movups xmmword [rsp + 0x60], xmm0
cmp esi, 2
jl 0x14001732f
movdqa xmm2, xmm7
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
punpckldq xmm2, xmm7
pmuldq xmm2, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm7
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
pshufd xmm3, xmm1, 0xd8
movq xmm1, xmm4
paddw xmm3, xmm2
movdqa xmm2, xmm12
xorps xmm3, xmm1
punpckldq xmm2, xmm12
pmuldq xmm2, xmm6
movq qword [rsp + 0x50], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm12
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x58]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movdqa xmm2, xmm11
xorps xmm3, xmm0
punpckldq xmm2, xmm11
pmuldq xmm2, xmm6
movdqa xmm0, xmm11
punpckhdq xmm0, xmm11
pmuldq xmm0, xmm6
movq qword [rsp + 0x58], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm11
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x60]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movdqa xmm2, xmm10
xorps xmm3, xmm0
punpckldq xmm2, xmm10
pmuldq xmm2, xmm6
movdqa xmm0, xmm10
punpckhdq xmm0, xmm10
pmuldq xmm0, xmm6
movq qword [rsp + 0x60], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm10
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm0, qword [rsp + 0x68]
mov ecx, 0x10
xorps xmm3, xmm0
movq qword [rsp + 0x68], xmm3
mov eax, ecx
lea r8, [rsp + 0x50]
lea r8, [r8 + rax*2]
nop word [rax + rax]
mov eax, 0x2aaaaaab
lea r8, [r8 + 2]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
add ax, ax
add dx, ax
movzx eax, cx
add dx, dx
inc ecx
sub ax, dx
add ax, 0x63
xor word [r8 - 2], ax
cmp ecx, 0x12
jl 0x140017340
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rdi
test eax, eax
je 0x1400173c3
xor eax, eax
mov dword [rbp - 8], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x10]
mov qword [rsp + 0x28], rax
inc ebx
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140017170
jmp 0x140017407
movsd xmm0, qword [str.___g]
lea r8, [rsp + 0x40]
movzx eax, word [0x140029860]
lea rdx, [rbp + 0x10]
movsd qword [rsp + 0x40], xmm0
xor ax, 0x67
xor word [rsp + 0x42], 0x64
xor word [rsp + 0x44], 0x65
xor word [rsp + 0x46], 0x66
mov word [rsp + 0x48], ax
mov word [rsp + 0x40], r13w
call fcn.140016b90
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 4]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x220]
inc r14d
mov qword [rsp + 0x28], rbx
mov edx, r14d
mov qword [rsp + 0x20], rbx
mov rcx, r15
mov dword [rbp - 4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400170f0
mov r13, qword [rsp + 0x78]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x430]
inc r12d
mov qword [rsp + 0x28], rbx
mov edx, r12d
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov dword [rbp], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140017060
movaps xmm12, xmmword [rsp + 0x750]
lea r14, [rbp + 0x6e8]
movaps xmm11, xmmword [rsp + 0x760]
movaps xmm10, xmmword [rsp + 0x770]
mov r15, qword [rsp + 0x800]
mov rbx, qword [rbp - 0x80]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0x7f8]
mov r12, qword [rsp + 0x7f0]
mov eax, 1
mov qword [r14], rbx
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.140026270
lea r11, [rsp + 0x7c0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret