Function at 0x14000116c
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7c8]
sub rsp, 0x8a0
mov rax, qword [0x140018008]
xor rax, rsp
mov qword [rbp + 0x790], rax
mov r12, rcx
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x390]
xor edx, edx
mov r8d, 0x400
call fcn.1400029f0
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x400
call fcn.1400029f0
lea rax, [rsp + 0x58]
mov dword [rsp + 0x5c], 0x400
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x5c]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x58], 0x400
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x390]
lea rax, [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea r14d, [r15 + 1]
mov dword [rsp + 0x40], r14d
cmp eax, 0x103
je 0x1400014a3
or rdx, 0xffffffffffffffff
mov r8d, 0x16
movabs rcx, 0x7fffffffffffffff
test eax, eax
jne 0x1400014a3
cmp dword [rsp + 0x60], 1
jne 0x140001417
mov r13, r15
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x80], 0xf
lea rax, [rbp - 0x70]
mov rsi, rdx
inc rsi
cmp byte [rax + rsi], r15b
jne 0x14000126e
mov qword [rsp + 0x48], rsi
cmp rsi, 0xf
ja 0x1400012b5
mov r8, rsi
mov qword [rsp + 0x78], rsi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x68]
call fcn.140003200
mov byte [rsp + rsi + 0x68], r15b
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x48], rsi
jmp 0x140001349
cmp rsi, rcx
ja 0x1400014d5
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400012cf
mov rdi, rcx
jmp 0x1400012d6
cmp rdi, r8
cmovb rdi, r8
mov rcx, rdi
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140001316
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400014db
mov rcx, rax
call fcn.1400017f0
test rax, rax
je 0x1400014e1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001328
test rcx, rcx
je 0x140001325
call fcn.1400017f0
mov rbx, rax
jmp 0x140001328
mov rbx, r15
mov r8, rsi
mov qword [rsp + 0x78], rsi
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x80], rdi
mov rcx, rbx
call fcn.140003200
mov byte [rbx + rsi], r15b
mov qword [rsp + 0x68], rbx
mov r15d, 0xb
cmp rsi, r15
jb 0x1400013dd
cmp rdi, 0x10
lea rsi, [rsp + 0x68]
cmovae rsi, rbx
xor ecx, ecx
movzx r14d, cx
mov r12d, ecx
add rsi, r13
movsx eax, byte [rsi + r12]
movzx ecx, ax
call fcn.140003a50
mov cl, al
inc r12
xor cl, r14b
shr cl, 4
movzx edx, cl
xor dx, ax
xor dx, r14w
movzx eax, dl
movzx r14d, ax
add r14w, r14w
xor r14w, ax
shl r14w, 4
xor r14w, dx
cmp r12, 0xb
jl 0x140001371
mov rsi, qword [rsp + 0x48]
mov eax, 0x13db
cmp r14w, ax
je 0x140001469
inc r15d
inc r13
movsxd rax, r15d
cmp rax, rsi
jbe 0x140001358
mov r14d, dword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
cmp rdi, 0x10
jb 0x140001414
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000140c
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400014e1
mov rcx, rbx
call fcn.14000182c
xor r15d, r15d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x5c], 0x400
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x5c]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x58], 0x400
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x390]
lea rax, [rsp + 0x60]
mov edx, r14d
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
inc r14d
jmp 0x140001220
cmp rdi, 0x10
jb 0x14000149c
lea rdx, [rdi + 1]
mov r8, rbx
cmp rdx, 0x1000
jb 0x140001494
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub r8, rbx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400014e1
mov rcx, rbx
call fcn.14000182c
mov eax, 1
jmp 0x1400014a5
xor eax, eax
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.1400017d0
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001158
int3
call fcn.1400010c0
int3
call fcn.140003cb0
int3