Function at 0x10526a3
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt
Set registry value

Disassembly:
mov eax, 0x106a7c7
call fcn.01054748
sub esp, 0x20
push ebx
push dword [ebp + 0x14]
xor ebx, ebx
push ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.01045eca
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call dword [eax + 8]
test eax, eax
jne 0x10526ed
mov ebx, 0x8007000e
jmp 0x1052870
mov eax, dword [ebp - 0x2c]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
mov ecx, dword [ebp + 0x14]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push 8
pop edx
cmp dword [ebp + 0x14], edx
jb 0x10527a7
mov dword [ebp + 0x10], edx
sub dword [ebp + 0x10], eax
mov ecx, eax
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, 0x60b920f7
add eax, 0x3d7e58c2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x20
mov eax, esi
shr eax, 5
mov ebx, esi
shl ebx, 4
xor eax, ebx
add eax, esi
mov ebx, edi
and ebx, 3
mov ebx, dword [ebx*4 + 0x10160a8]
add ebx, edi
add edi, dword [ebp - 0x14]
xor eax, ebx
add edx, eax
mov eax, edx
shr eax, 5
mov ebx, edx
shl ebx, 4
xor eax, ebx
mov ebx, edi
shr ebx, 0xb
and ebx, 3
mov ebx, dword [ebx*4 + 0x10160a8]
add eax, edx
add ebx, edi
xor eax, ebx
add esi, eax
dec dword [ebp - 0x18]
jne 0x1052749
mov eax, dword [ebp + 0x10]
mov dword [ecx], edx
mov dword [ecx + 4], esi
inc ecx
add eax, ecx
cmp eax, dword [ebp + 0x14]
jbe 0x105272b
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push eax
mov eax, dword [ebp - 0x20]
push 0
push 1
push 0
push dword [eax + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
jne 0x1052817
call esi
test eax, eax
jg 0x10527e7
call esi
jmp 0x10527f0
call esi
and eax, 0xffff
or eax, edi
test eax, eax
jge 0x105280e
call esi
test eax, eax
jg 0x1052800
call esi
mov ebx, eax
jmp 0x1052813
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
jmp 0x1052813
mov ebx, 0x80004005
test ebx, ebx
jl 0x105286e
push dword [ebp + 0x14]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call dword [eax + 8]
push eax
push 3
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x105286e
call esi
test eax, eax
jg 0x1052842
call esi
jmp 0x105284b
call esi
and eax, 0xffff
or eax, edi
test eax, eax
jge 0x1052869
call esi
test eax, eax
jg 0x105285b
call esi
mov ebx, eax
jmp 0x105286e
call esi
mov ebx, eax
and ebx, 0xffff
or ebx, edi
jmp 0x105286e
mov ebx, 0x80004005
pop edi
pop esi
lea ecx, [ebp - 0x2c]
call fcn.01045eac
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10