Function at 0x14005a9d0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0xe8]
sub rsp, 0x1e8
mov rax, qword [0x1401160c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [str.glectfxIOLZ.5]
mov eax, dword [str.2_3_]
xor r14d, r14d
cmp dword [reloc.WS2_32.dll_accept], 2
mov r8d, r14d
movups xmm1, xmmword [0x140102050]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140102060]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
jl 0x14005ab71
movdqa xmm0, xmmword [0x140102a40]
lea rcx, [rsp + 0x54]
movdqa xmm4, xmmword [0x140102990]
movdqa xmm3, xmmword [0x140102fa0]
movdqa xmm5, xmmword [str.1111]
movdqa xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
movaps xmmword [rsp + 0x1c0], xmm6
movdqa xmm6, xmmword [0x140102a00]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x28
jl 0x14005aa80
movaps xmm6, xmmword [rsp + 0x1c0]
cmp r8d, 0x2c
jge 0x14005abb1
movsxd rax, r8d
lea r9, [rsp + 0x50]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 0x2c
jl 0x14005ab80
mov qword [rsp + 0x200], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x208], rsi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x210], rdi
mov r9d, 0x20019
mov qword [rsp + 0x1e0], r12
xor r8d, r8d
mov qword [rsp + 0x1d8], r13
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005af92
cmp byte [0x140102359], r14b
movzx eax, word [0x140102358]
mov word [rsp + 0x38], ax
mov dword [rbp - 0x78], 0x100
je 0x14005ac33
xor byte [rsp + 0x39], 0x35
mov byte [rsp + 0x38], Ordinal_50
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
lea rax, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005af88
xorps xmm0, xmm0
lea rax, [rbp - 0x50]
mov rsi, 0xffffffffffffffff
movups xmmword [rbp - 0x70], xmm0
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], r14b
jne 0x14005ac77
movabs r13, 0x7fffffffffffffff
cmp rdi, r13
ja 0x14005afde
cmp rdi, 0xf
ja 0x14005accb
mov r8, rdi
mov qword [rbp - 0x60], rdi
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x70], r14b
mov r13, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x70]
jmp 0x14005ad5c
mov rax, rdi
or rax, 0xf
cmp rax, r13
jbe 0x14005ad04
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400d2e18
test rax, rax
je 0x14005af2f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14005ad3c
mov ecx, reloc.WLDAP32.dll_Ordinal_22
mov r13, rax
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
test rcx, rcx
je 0x14005ad3c
cmp rcx, 0x1000
jb 0x14005ad34
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005afe4
jmp 0x14005ace5
call fcn.1400d2e18
mov r14, rax
mov r8, rdi
mov qword [rbp - 0x70], r14
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x60], rdi
mov rcx, r14
mov qword [rbp - 0x58], r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
mov eax, dword [0x140102630]
mov cl, 0x56
mov dword [rsp + 0x30], eax
mov r15, rsi
movzx eax, word [0x140102634]
xor byte [rsp + 0x31], 0x35
xor byte [rsp + 0x32], 0x36
xor byte [rsp + 0x33], 0x37
mov word [rsp + 0x34], ax
movzx eax, byte [0x140102636]
xor byte [rsp + 0x34], 0x38
xor byte [rsp + 0x35], 0x39
xor al, 0x3a
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x36], al
lea rax, [rsp + 0x30]
inc r15
cmp byte [rax + r15], 0
jne 0x14005ada6
cmp r13, 0xf
lea r12, [rbp - 0x70]
cmova r12, r14
cmp r15, rdi
ja 0x14005ae48
mov rax, rdi
sub rax, r15
mov qword [rsp + 0x40], rax
test r15, r15
je 0x14005af3f
lea r8, [rax + 1]
movsx edx, cl
add r8, r12
mov rcx, r12
sub r8, r12
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14005ae48
nop word [rax + rax]
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005ae3c
mov r8, qword [rsp + 0x40]
mov cl, 0x56
inc r8
movsx edx, cl
add r8, r12
inc rbx
sub r8, rbx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14005ae00
jmp 0x14005ae48
sub rbx, r12
cmp rbx, rsi
jne 0x14005af3f
mov eax, dword [str.bwyo8]
mov cl, 0x56
mov dword [rsp + 0x30], eax
movzx eax, byte [0x140102148]
xor byte [rsp + 0x31], 0x35
xor byte [rsp + 0x32], 0x36
xor byte [rsp + 0x33], 0x37
xor al, 0x38
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x34], al
lea rax, [rsp + 0x30]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14005ae80
cmp r13, 0xf
lea r15, [rbp - 0x70]
cmova r15, r14
cmp rsi, rdi
ja 0x14005af04
sub rdi, rsi
test rsi, rsi
je 0x14005af3f
movsx r12d, cl
lea r8, [r15 + 1]
add r8, rdi
mov edx, r12d
sub r8, r15
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14005af04
nop word [rax + rax]
mov r8, rsi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005af36
inc rbx
lea r8, [r15 + 1]
add r8, rdi
mov edx, r12d
sub r8, rbx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14005aed0
cmp r13, 0xf
jbe 0x14005af88
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14005af80
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005af80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x14005af04
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13, 0xf
jbe 0x14005af7c
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14005af74
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005af2f
mov rcx, r14
call fcn.1400d29e0
mov al, 1
jmp 0x14005af94
mov rcx, r14
call fcn.1400d29e0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov r15, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1400d2720
add rsp, 0x1e8
pop r14
pop rbp
ret
call fcn.140048d30
int3
call fcn.140045230
int3