Function at 0x14005c4b0
Capabilities:
Encode data using xor
Query or enumerate registry value
Terminate process

Disassembly:
sub rsp, 0x2b8
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x2b0], rbx
call fcn.140059da0
xor ecx, ecx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x80], rcx
call fcn.14005c8e0
mov r10, rax
cmp word [rax + 0x30], cx
je 0x14005c7b1
cmp dword [0x140072090], 2
jl 0x14005c775
movdqa xmm4, xmmword [0x14006da60]
movdqa xmm2, xmmword [0x14006d990]
movdqa xmm3, xmmword [0x14006d9a0]
movdqa xmm1, xmm2
movdqa xmm5, xmmword [str.5555::::]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x2a0], xmm6
movdqa xmm6, xmmword [0x14006da20]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
paddw xmm2, xmm6
xorps xmm2, xmm0
pmuldq xmm1, xmm4
movq qword [rax], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
movdqa xmm3, xmmword [0x14006d9b0]
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax + 8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
paddw xmm2, xmm6
xorps xmm2, xmm0
pmuldq xmm1, xmm4
movq qword [rax + 8], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
movdqa xmm3, xmmword [0x14006d9c0]
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax + 0x10]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
paddw xmm2, xmm6
xorps xmm2, xmm0
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
movq qword [rax + 0x10], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
mov ecx, 0x18
movdqa xmm3, xmmword [0x14006d9d0]
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax + 0x18]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
paddw xmm2, xmm6
xorps xmm2, xmm0
pmuldq xmm1, xmm4
movq qword [rax + 0x18], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
movdqa xmm3, xmmword [0x14006d9e0]
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax + 0x20]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
paddw xmm2, xmm6
punpckldq xmm1, xmm3
xorps xmm2, xmm0
pmuldq xmm1, xmm4
movq qword [rax + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rax + 0x28]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmm6
movaps xmm6, xmmword [rsp + 0x2a0]
xorps xmm2, xmm0
movq qword [rax + 0x28], xmm2
mov eax, ecx
lea r8, [r10 + rax*2]
nop dword [rax + rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x35
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x32
xor word [r8 - 2], ax
cmp ecx, 0x19
jl 0x14005c780
lea rdx, [rsp + 0x38]
call fcn.14005c910
mov rbx, rax
movzx eax, word [rax + 8]
test ax, ax
je 0x14005c7e2
xor word [rbx], 0x32
xor word [rbx + 2], 0x33
xor word [rbx + 4], 0x34
xor word [rbx + 6], 0x35
xor ax, 0x36
mov word [rbx + 8], ax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x8c], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x88], 0x200
mov rdx, r10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x8c]
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [rsp + 0x30]
call fcn.14005c930
mov rbx, qword [rsp + 0x2b0]
mov r8, rax
movzx eax, word [rax + 2]
test ax, ax
je 0x14005c880
xor word [r8], 0x32
xor ax, 0x33
mov word [r8 + 2], ax
lea rax, [rsp + 0x90]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14005c8a4
add rax, 2
test ecx, ecx
jne 0x14005c890
test edx, edx
jne 0x14005c8c1
call fcn.1400581d0
call fcn.14005a3f0
call fcn.14005ac20
call fcn.14005b450
call fcn.14005bc80
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3