Function at 0x140016520
Capabilities:
Encode data using xor
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rax - 0x6e8]
sub rsp, 0x7c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rbp + 0x640], rax
lea r14, [rbp + 0x6e8]
xor edi, edi
mov rbx, qword [r14]
mov qword [rbp - 0x78], rbx
mov qword [r14], rdi
call fcn.140016440
movups xmm0, xmmword [0x140028e80]
mov ecx, edi
movups xmm1, xmmword [0x140028e90]
mov esi, dword [0x140030010]
mov eax, dword [0x140028ec8]
movdqa xmm7, xmmword [0x14002c560]
movdqa xmm9, xmmword [0x14002c5f0]
movdqa xmm8, xmmword [0x14002c590]
movdqa xmm6, xmmword [0x14002c620]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [0x140028ea0]
movups xmmword [rbp - 0x50], xmm0
movsd xmm0, qword [0x140028ec0]
movups xmmword [rbp - 0x60], xmm1
movups xmm1, xmmword [0x140028eb0]
movsd qword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
movups xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x28], eax
cmp esi, 2
jl 0x1400166e0
lea rdx, [rbp - 0x70]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm7
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
psubw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm7
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 2
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
psubw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x20
jl 0x1400165f0
cmp ecx, 0x26
jge 0x140016728
movsxd rax, ecx
lea r8, [rbp - 0x70]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x66666667
lea r8, [r8 + 2]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
shl ax, 2
add dx, ax
movzx eax, cx
add dx, dx
inc ecx
sub ax, dx
sub ax, 0x75
xor word [r8 - 2], ax
cmp ecx, 0x26
jl 0x1400166f0
lea rax, [rbp - 0x20]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016cad
mov qword [rsp + 0x7f0], r12
lea rcx, [rbp + 0x430]
mov qword [rsp + 0x7f8], r13
xor edx, edx
mov r13, qword [rbp - 0x20]
mov r8d, 0x208
mov qword [rbp - 0x80], r13
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rdi
lea r9, [rbp]
mov qword [rsp + 0x30], rdi
lea r8, [rbp + 0x430]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, r13
mov qword [rsp + 0x20], rdi
mov r12d, edi
mov dword [rsp + 0x50], edi
mov dword [rbp], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140016c94
mov qword [rsp + 0x800], r15
xor ebx, ebx
movaps xmmword [rsp + 0x770], xmm10
movdqa xmm10, xmmword [0x14002c5b0]
movaps xmmword [rsp + 0x760], xmm11
movdqa xmm11, xmmword [0x14002c5a0]
movaps xmmword [rsp + 0x750], xmm12
movdqa xmm12, xmmword [0x14002c570]
nop
lea rax, [rbp - 0x18]
mov qword [rbp - 0x18], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x430]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016c24
mov r15, qword [rbp - 0x18]
lea rcx, [rbp + 0x220]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 4]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x220]
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], rbx
mov r14d, ebx
mov dword [rbp - 4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140016c1b
mov r13d, 0x45
mov r12d, 0xff8c
nop
lea rax, [rbp - 0x10]
mov qword [rbp - 0x10], rbx
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x220]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016bd5
mov rdi, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
xor edx, edx
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp - 8], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x10]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140016bca
nop dword [rax + rax]
movups xmm4, xmmword [0x14002a280]
mov eax, dword [0x14002a2a0]
xor ecx, ecx
mov dword [rsp + 0x78], eax
movups xmm0, xmmword [0x14002a290]
movups xmmword [rsp + 0x58], xmm4
movups xmmword [rsp + 0x68], xmm0
cmp esi, 2
jl 0x140016ae3
movdqa xmm2, xmm7
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
punpckldq xmm2, xmm7
pmuldq xmm2, xmm6
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm7
psrad xmm2, 2
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
pshufd xmm3, xmm1, 0xd8
movq xmm1, xmm4
psubw xmm3, xmm2
movdqa xmm2, xmm12
xorps xmm3, xmm1
punpckldq xmm2, xmm12
pmuldq xmm2, xmm6
movq qword [rsp + 0x58], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm12
psrad xmm2, 2
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x60]
pshufd xmm3, xmm1, 0xd8
psubw xmm3, xmm2
movdqa xmm2, xmm11
xorps xmm3, xmm0
punpckldq xmm2, xmm11
pmuldq xmm2, xmm6
movdqa xmm0, xmm11
punpckhdq xmm0, xmm11
pmuldq xmm0, xmm6
movq qword [rsp + 0x60], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm11
psrad xmm2, 2
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
movq xmm2, xmm9
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x68]
pshufd xmm3, xmm1, 0xd8
psubw xmm3, xmm2
movdqa xmm2, xmm10
xorps xmm3, xmm0
punpckldq xmm2, xmm10
pmuldq xmm2, xmm6
movdqa xmm0, xmm10
punpckhdq xmm0, xmm10
pmuldq xmm0, xmm6
movq qword [rsp + 0x68], xmm3
shufps xmm2, xmm0, 0xdd
movdqa xmm0, xmm10
psrad xmm2, 2
movdqa xmm1, xmm2
psrld xmm1, 0x1f
paddd xmm1, xmm2
pmulld xmm1, xmm8
psubd xmm0, xmm1
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm2, xmm9
movq xmm0, qword [rsp + 0x70]
mov ecx, 0x10
pshufd xmm3, xmm1, 0xd8
psubw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rsp + 0x70], xmm3
mov eax, ecx
lea r8, [rsp + 0x58]
lea r8, [r8 + rax*2]
nop
mov eax, 0x66666667
lea r8, [r8 + 2]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
shl ax, 2
add dx, ax
movzx eax, cx
add dx, dx
inc ecx
sub ax, dx
sub ax, 0x75
xor word [r8 - 2], ax
cmp ecx, 0x12
jl 0x140016af0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140016b77
xor eax, eax
mov dword [rbp - 8], 0x208
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x10]
mov qword [rsp + 0x28], rax
inc ebx
mov edx, ebx
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140016910
jmp 0x140016bca
movsd xmm0, qword [0x140029d68]
lea r8, [rsp + 0x40]
movzx eax, word [0x140029d70]
lea rdx, [rbp + 0x10]
movsd qword [rsp + 0x40], xmm0
mov ecx, 0xff8d
xor word [rsp + 0x44], cx
mov ecx, 0xff8e
xor word [rsp + 0x46], cx
mov ecx, 0xff8f
xor word [rsp + 0x42], r12w
xor ax, cx
mov rcx, rdi
mov word [rsp + 0x48], ax
mov word [rsp + 0x40], r13w
call fcn.140016330
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r9, [rbp - 4]
mov qword [rsp + 0x30], rbx
lea r8, [rbp + 0x220]
inc r14d
mov qword [rsp + 0x28], rbx
mov edx, r14d
mov qword [rsp + 0x20], rbx
mov rcx, r15
mov dword [rbp - 4], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140016890
mov r12d, dword [rsp + 0x50]
mov r13, qword [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
lea r9, [rbp]
inc r12d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea r8, [rbp + 0x430]
mov edx, r12d
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov dword [rsp + 0x50], r12d
mov dword [rbp], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140016800
movaps xmm12, xmmword [rsp + 0x750]
lea r14, [rbp + 0x6e8]
movaps xmm11, xmmword [rsp + 0x760]
movaps xmm10, xmmword [rsp + 0x770]
mov r15, qword [rsp + 0x800]
mov rbx, qword [rbp - 0x78]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0x7f8]
mov r12, qword [rsp + 0x7f0]
mov eax, 1
mov qword [r14], rbx
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.140025fd0
lea r11, [rsp + 0x7c0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret