Function at 0x1053b3b
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt
Set registry value

Disassembly:
mov eax, 0x106bdc7
call fcn.01055bd8
sub esp, 0x20
push ebx
push dword [ebp + 0x14]
xor ebx, ebx
push ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.01047224
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call dword [eax + 8]
test eax, eax
jne 0x1053b85
mov ebx, 0x8007000e
jmp 0x1053d08
mov eax, dword [ebp - 0x2c]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
mov ecx, dword [ebp + 0x14]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push 8
pop edx
cmp dword [ebp + 0x14], edx
jb 0x1053c3f
mov dword [ebp + 0x10], edx
sub dword [ebp + 0x10], eax
mov ecx, eax
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, 0x60b920f7
add eax, 0x3d7e58c2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x20
mov eax, esi
shr eax, 5
mov ebx, esi
shl ebx, 4
xor eax, ebx
add eax, esi
mov ebx, edi
and ebx, 3
mov ebx, dword [ebx*4 + 0x1016408]
add ebx, edi
add edi, dword [ebp - 0x14]
xor eax, ebx
add edx, eax
mov eax, edx
shr eax, 5
mov ebx, edx
shl ebx, 4
xor eax, ebx
mov ebx, edi
shr ebx, 0xb
and ebx, 3
mov ebx, dword [ebx*4 + 0x1016408]
add eax, edx
add ebx, edi
xor eax, ebx
add esi, eax
dec dword [ebp - 0x18]
jne 0x1053be1
mov eax, dword [ebp + 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], esi
inc ecx
add eax, ecx
cmp eax, dword [ebp + 0x14]
jbe 0x1053bc3
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push eax
mov eax, dword [ebp - 0x20]
push 0
push 1
push 0
push dword [eax + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
jne 0x1053caf
call esi
test eax, eax
jg 0x1053c7f
call esi
jmp 0x1053c88
call esi
and eax, 0xffff
or eax, edi
test eax, eax
jge 0x1053ca6
call esi
test eax, eax
jg 0x1053c98
call esi
mov ebx, eax
jmp 0x1053cab
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
jmp 0x1053cab
mov ebx, 0x80004005
test ebx, ebx
jl 0x1053d06
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1053d06
call esi
test eax, eax
jg 0x1053cda
call esi
jmp 0x1053ce3
call esi
and eax, 0xffff
or eax, edi
test eax, eax
jge 0x1053d01
call esi
test eax, eax
jg 0x1053cf3
call esi
mov ebx, eax
jmp 0x1053d06
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
jmp 0x1053d06
mov ebx, 0x80004005
pop edi
pop esi
lea ecx, [ebp - 0x2c]
call fcn.01047206
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10