Function at 0x1800073c0
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x18019d080]
xor rax, rsp
mov qword [rbp + 0x250], rax
movdqa xmm3, xmmword [0x1801818b0]
xor edi, edi
mov r8d, 0x1362
mov dword [rsp + 0x40], 0x1339130b
mov edx, edi
mov dword [rsp + 0x44], 0x133d132f
mov r9d, r8d
mov dword [rsp + 0x48], 0x1310133a
mov dword [rsp + 0x4c], 0x130b1315
mov dword [rsp + 0x50], 0x130a130c
mov dword [rsp + 0x54], 0x130f1336
mov dword [rsp + 0x58], 0x131d130a
mov dword [rsp + 0x5c], 0x130b1305
mov dword [rsp + 0x60], 0x1305131f
mov dword [rsp + 0x64], 0x13001302
mov dword [rsp + 0x68], 0x131f132c
mov dword [rsp + 0x6c], 0x1306131f
mov dword [rsp + 0x70], 0x131b1301
mov dword [rsp + 0x74], 0x13131319
mov dword [rsp + 0x78], 0x1305
mov byte [rsp + 0x7c], 1
nop word [rax + rax]
movd xmm1, dword [rsp + rdx*2 + 0x40]
lea rax, [r9 - 4]
xorps xmm0, xmm0
lea rcx, [r9 - 5]
punpcklwd xmm1, xmm0
movq xmm2, rdx
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [rsp + rdx*2 + 0x40], xmm1
movq xmm0, rax
movd xmm1, dword [rsp + rdx*2 + 0x44]
lea rax, [r9 - 2]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rsp + rdx*2 + 0x44], xmm1
lea rax, [r9 - 1]
movd xmm1, dword [rsp + rdx*2 + 0x48]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rax
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [rsp + rdx*2 + 0x48], xmm1
add r9, 8
movd xmm1, dword [rsp + rdx*2 + 0x4c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x4c], xmm1
add rdx, 8
cmp r9, 0x137a
jb 0x180007490
mov ebx, 0x135b
cmp rdx, 0x1d
jae 0x1800075a1
nop dword [rax + rax]
lea eax, [rbx + rdx]
xor word [rsp + rdx*2 + 0x40], ax
inc rdx
cmp rdx, 0x1d
jb 0x180007590
mov byte [rsp + 0x7c], dil
mov rax, rdi
mov dword [rbp - 0x80], 0x13131308
mov dword [rbp - 0x7c], 0x130a131b
mov dword [rbp - 0x78], 0x13211308
mov dword [rbp - 0x74], 0x13271333
mov dword [rbp - 0x70], 0x1329133f
mov dword [rbp - 0x6c], 0x1305130c
mov dword [rbp - 0x68], 0x13071315
mov dword [rbp - 0x64], 0x1305131a
mov dword [rbp - 0x60], 0x1318130d
mov dword [rbp - 0x5c], 0x13391331
mov dword [rbp - 0x58], 0x131e1306
mov dword [rbp - 0x54], 0x131d1315
mov dword [rbp - 0x50], 0x13071304
mov dword [rbp - 0x4c], 0x13351329
mov dword [rbp - 0x48], 0x130a1302
mov dword [rbp - 0x44], 0x131f130b
mov dword [rbp - 0x40], 0x13081315
mov dword [rbp - 0x3c], 0x131b132b
mov dword [rbp - 0x38], 0x13f3130d
mov dword [rbp - 0x34], 0x13ed13e8
mov dword [rbp - 0x30], 0x13d813ed
mov dword [rbp - 0x2c], 0x13fe13c0
mov dword [rbp - 0x28], 0x13e413f7
mov dword [rbp - 0x24], 0x13f813e6
mov dword [rbp - 0x20], 0x13fe13ee
mov dword [rbp - 0x1c], 0x13c813d1
mov dword [rbp - 0x18], 0x13f113ea
mov dword [rbp - 0x14], 0x13e713e5
mov dword [rbp - 0x10], 0x13f113e1
mov dword [rbp - 0xc], 0x13e513c0
mov dword [rbp - 8], 0x13ff13f6
mov dword [rbp - 4], 0x13c613fc
mov dword [rbp], 0x13ec13da
mov dword [rbp + 4], 0x13cd13ed
mov dword [rbp + 8], 0x13c913e8
mov dword [rbp + 0xc], 0x13c113d5
mov dword [rbp + 0x10], 0x13c113cb
mov dword [rbp + 0x14], 0x13c1
mov byte [rbp + 0x18], 1
nop word [rax + rax]
movd xmm1, dword [rbp + rax*2 - 0x80]
lea rcx, [r8 - 4]
xorps xmm0, xmm0
lea rdx, [r8 - 5]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rdx
pshuflw xmm1, xmm0, 0xd8
lea rdx, [r8 - 3]
movd dword [rbp + rax*2 - 0x80], xmm1
movq xmm0, rcx
movd xmm1, dword [rbp + rax*2 - 0x7c]
lea rcx, [r8 - 2]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rdx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rcx
movd dword [rbp + rax*2 - 0x7c], xmm1
lea rcx, [r8 - 1]
movd xmm1, dword [rbp + rax*2 - 0x78]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r8
movd dword [rbp + rax*2 - 0x78], xmm1
add r8, 8
movd xmm1, dword [rbp + rax*2 - 0x74]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rax*2 - 0x74], xmm1
add rax, 8
cmp r8, 0x13aa
jb 0x1800076c0
cmp rax, 0x4b
jae 0x1800077d1
nop word [rax + rax]
lea ecx, [rbx + rax]
xor word [rbp + rax*2 - 0x80], cx
inc rax
cmp rax, 0x4b
jb 0x1800077c0
lea rax, [rbp + 0x20]
mov byte [rbp + 0x18], dil
mov r9d, 9
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800078d6
mov rcx, qword [rbp + 0x20]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1800078cc
nop dword [rax]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x180007893
lea rax, [rbp + 0x28]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180007893
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x20]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], rdi
inc ebx
mov qword [rsp + 0x28], rdi
mov edx, ebx
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x180007840
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180127b60
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret