Function at 0x140001ab0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
movdqa xmm3, xmmword [0x140005550]
xor ebx, ebx
movdqa xmm4, xmmword [0x140005570]
mov eax, ebx
mov word [rbp - 0x74], bx
mov edx, 0xf3fa
mov dword [rsp + 0x30], 0xf3b5f3bb
mov dword [rsp + 0x34], 0xf3b2f3a7
mov dword [rsp + 0x38], 0xf3b9f3a0
mov dword [rsp + 0x3c], 0xf3bff3ab
mov dword [rsp + 0x40], 0xf3b8f3a7
mov dword [rsp + 0x44], 0xf3adf3b8
mov dword [rsp + 0x48], 0xf452f3bc
mov dword [rsp + 0x4c], 0xf452f448
mov dword [rsp + 0x50], 0xf44df457
mov dword [rsp + 0x54], 0xf448f44a
mov dword [rsp + 0x58], 0xf45bf45b
mov dword [rsp + 0x5c], 0xf479f470
mov dword [rsp + 0x60], 0xf469f47f
mov dword [rsp + 0x64], 0xf452f460
mov dword [rsp + 0x68], 0xf475f44c
mov dword [rsp + 0x6c], 0xf466f47f
mov dword [rsp + 0x70], 0xf475f461
mov dword [rsp + 0x74], 0xf446f479
mov dword [rsp + 0x78], 0xf477f465
mov dword [rsp + 0x7c], 0xf47ff47a
mov dword [rbp - 0x80], 0xf46ff468
mov dword [rbp - 0x7c], 0xf46cf472
mov dword [rbp - 0x78], 0xf410f443
mov byte [rbp - 0x72], 1
nop dword [rax + rax]
movd xmm1, dword [rsp + rax*2 + 0x30]
lea rcx, [rdx - 5]
xorps xmm0, xmm0
movq xmm2, rax
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [rdx - 3]
movd dword [rsp + rax*2 + 0x30], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax*2 + 0x34]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [rdx - 1]
movd dword [rsp + rax*2 + 0x34], xmm1
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax*2 + 0x38]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rdx
movd dword [rsp + rax*2 + 0x38], xmm1
add rdx, 8
movd xmm1, dword [rsp + rax*2 + 0x3c]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x3c], xmm1
add rax, 8
cmp rdx, 0xf422
jb 0x140001bc0
cmp rax, 0x2e
jae 0x140001cc5
mov edx, 0xc0d
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x30], cx
inc rax
cmp rax, 0x2e
jb 0x140001cb1
lea rax, [rbp - 0x58]
mov byte [rbp - 0x72], bl
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001e52
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x20], 0x200
mov dword [rbp - 0x50], 0xf386f3a3
mov dword [rbp - 0x4c], 0xf395f39a
mov dword [rbp - 0x48], 0xf38bf392
mov dword [rbp - 0x44], 0xf395f38a
mov dword [rbp - 0x40], 0xf3b2f389
mov dword [rbp - 0x3c], 0xf393f39c
mov dword [rbp - 0x38], 0xf453f39a
mov dword [rbp - 0x34], 0xf470f475
mov dword [rbp - 0x30], 0xf46af46a
mov dword [rbp - 0x2c], 0xf462
mov byte [rbp - 0x28], 1
call fcn.140002630
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x10]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001e48
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140002960
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x64], 0x6c
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x70], 0x690056
mov dword [rbp - 0x6c], 0x740072
mov dword [rbp - 0x68], 0x610075
mov byte [rbp - 0x60], bl
call fcn.1400027f0
cmp rax, 0xffffffffffffffff
je 0x140001e05
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140001e01
mov rcx, qword [rbp - 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dfc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e3c
call fcn.14000328c
mov al, 1
jmp 0x140001e54
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140001e48
mov rcx, qword [rbp - 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000328c
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.140003160
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret