Function at 0x14054f8d0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x90
mov rax, qword [0x1406dc5c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
xor r8d, r8d
lea rdx, [0x140677ee0]
call fcn.14054ed20
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x40], rbx
movdqa xmm0, xmmword [0x1406c1fa0]
movdqa xmm1, xmmword [0x1406c1200]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov ecx, 0x298
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14054f9a9
or eax, 1
mov dword [rcx + rsi], eax
mov eax, 0x340
mov r14d, eax
add rax, rsi
mov byte [rax + 0x20], 1
lea rcx, [rax + 0x1f]
lea rdx, [rsp + 0x7f]
cmp rax, rdx
ja 0x14054f993
lea rdx, [rsp + 0x60]
cmp rcx, rdx
jb 0x14054f993
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
jmp 0x14054f99a
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
lea rcx, [0x1406429e0]
call fcn.14063c804
nop
jmp 0x14054f9af
mov r14d, 0x340
lea r10, [rsi + r14]
cmp byte [r10 + 0x20], 0
je 0x14054fa0d
lea r9, [r10 + 1]
mov r11, r10
not r11
movabs r14, 0x1cdc31f65f3d5f1
nop
lea ecx, [r9 + r11]
and cl, 7
shl cl, 3
mov rdx, r14
shr rdx, cl
xor byte [r9 - 1], dl
movzx ecx, r9b
sub cl, r10b
and cl, 7
shl cl, 3
mov r8, r14
shr r8, cl
xor byte [r9], r8b
add r9, 2
lea rax, [r11 + r9]
cmp rax, 0x20
jb 0x14054f9d0
mov byte [r10 + 0x20], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14054fb37
mov dword [rsp + 0x58], Ordinal_41
mov dword [rsp + 0x48], 0x411ef002
mov dword [rsp + 0x4c], 0x963e757e
mov dword [rsp + 0x50], 0x2919f83a
mov ecx, 0x2e0
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14054fa9a
or eax, 1
mov dword [rcx + rsi], eax
mov eax, 0x288
mov r14d, eax
mov byte [rax + rsi + 0xc], 1
movsd xmm0, qword [rsp + 0x48]
movsd qword [rax + rsi], xmm0
mov eax, dword [rsp + 0x50]
mov dword [r14 + rsi + 8], eax
lea rcx, [0x1406429c0]
call fcn.14063c804
nop
jmp 0x14054faa0
mov r14d, 0x288
lea rdx, [rsi + r14]
cmp byte [rdx + 0xc], 0
je 0x14054fadf
movabs r8, 0xd15b1b17297d914f
nop dword [rax]
nop dword [rax + rax]
movzx ecx, bl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rbx + rdx], al
inc rbx
cmp rbx, 0xc
jb 0x14054fac0
mov byte [rdx + 0xc], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14054fb2b
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14054fb14
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14054ed20
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, rdi
jmp 0x14054fb41
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14063c0a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret