Function at 0x14005de60
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14016d4c0]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r13, rcx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
mov r8d, 1
lea rdx, [0x140150550]
lea rcx, [rbp + 0x50]
call fcn.140008c70
nop
mov r8, qword [0x14017a328]
lea rcx, [r8 + 0x20]
mov rdx, qword [r8 + 0x10]
mov r10, qword [rcx + 0x10]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rdx
cmp rax, r10
jb 0x14005e6b1
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14005deff
mov r9, qword [r8]
cmp qword [rcx + 0x18], 0xf
jbe 0x14005df09
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140009380
nop
lea r9, [rbp - 0x20]
mov r15, qword [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r9, r15
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x14005df71
nop word [rax + rax]
movsx rax, byte [r9 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x14005df50
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
movabs r12, 0x5851f42d4c957f2d
test rax, rax
jne 0x14005df9e
imul r8, r12
inc r8
jmp 0x14005dfa1
mov r8, rax
mov rax, qword [0x14017a328]
sub r8, qword [rax + 0x40]
cmp byte [rax + 0x48], 0
sete al
lea rcx, [0x14014f28c]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 5
mov byte [rbp + 0x10], al
movabs rax, 0x5000000000000000
mov qword [rbp], rax
mov qword [rbp + 0x11], r8
movabs rax, 0x4000000000000001
mov qword [rbp + 8], rax
mov qword [rsp + 0x50], 2
lea rax, [rbp]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140008620
nop
mov r8, qword [0x14017a328]
lea rax, [r8 + 0x20]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
sub rdi, rcx
cmp rdi, rdx
jb 0x14005e6b7
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14005e053
mov r9, qword [r8]
cmp qword [rax + 0x18], 0xf
jbe 0x14005e05d
mov rax, qword [rax]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140009380
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov rcx, rbx
mov rdx, rbx
mov r9, qword [rbp - 0x70]
test r9, r9
je 0x14005e0c1
nop dword [rax + rax]
movsx rax, byte [r8 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r9
jb 0x14005e0a0
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14005e0e4
imul r9, r12
inc r9
jmp 0x14005e0e7
mov r9, rax
lea r10, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 0xf
cmova r10, rsi
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbp - 0x50]
test r8, r8
je 0x14005e131
nop word [rax + rax]
movsx rax, byte [rdx + r10]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x14005e110
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14005e154
imul r8, r12
inc r8
jmp 0x14005e157
mov r8, rax
imul r8, r9
mov rax, qword [0x14017a328]
mov rcx, qword [rax + 0x40]
inc rcx
xor edx, edx
mov rax, r8
div rcx
lea rcx, [0x14014c488]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x68], rax
movabs rax, 0x4000000000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.140008620
lea r8, [rbp - 0x40]
mov r9, qword [rbp - 0x40]
mov r10, qword [rbp - 0x28]
cmp r10, 0xf
cmova r8, r9
mov rcx, rbx
mov rdx, rbx
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x14005e221
nop dword [rax]
movsx rax, byte [rdx + r8]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, rdi
jb 0x14005e200
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14005e244
imul rdi, r12
inc rdi
jmp 0x14005e247
mov rdi, rax
mov rax, qword [0x14017a248]
mov r12, qword [rax + 0x10]
cmp r10, 0xf
jbe 0x14005e289
lea rdx, [r10 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x14005e281
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6bd
mov rcx, r9
call fcn.1400c4e5c
movdqa xmm0, xmmword [0x140150640]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
cmp r14, 0xf
jbe 0x14005e2d9
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005e2c9
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6c3
mov rcx, rsi
call fcn.1400c4e5c
movdqa xmm0, xmmword [0x140150640]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14005e31c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e30f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6c9
call fcn.1400c4e5c
movdqa xmm0, xmmword [0x140150640]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rax, qword [rbp - 8]
cmp rax, 0xf
jbe 0x14005e360
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14005e358
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6cf
mov rcx, r15
call fcn.1400c4e5c
cmp r12, rdi
jne 0x14005e37b
mov r8d, 2
lea rdx, [0x140150554]
lea rcx, [rbp + 0x50]
call fcn.140040e70
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0x20]
test eax, eax
jne 0x14005e665
mov dword [rbp + 0x28], 0x3ff
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.ProductId
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp qword [rbp + 0x60], 2
jb 0x14005e452
lea rax, [rbp + 0x50]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
cmova rax, rcx
cmp byte [rax + 1], 0x2a
jne 0x14005e452
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm6, xmmword [0x140150640]
mov byte [rbp - 0x60], 0
cmp rdx, 0xf
jbe 0x14005e444
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e43f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6a5
call fcn.1400c4e5c
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm6
jmp 0x14005e468
mov r8d, 1
lea rdx, [0x140145eac]
lea rcx, [rbp + 0x50]
call fcn.140040e70
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14005e490
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x30]
call fcn.140008c70
lea r15, [rbp + 0x30]
mov rsi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x48]
cmp r14, 0xf
cmova r15, rsi
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x14005e4e4
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov rcx, r15
call fcn.1400ffbc0
mov rcx, rax
test rax, rax
je 0x14005e4e4
sub rcx, r15
jmp 0x14005e4eb
mov rcx, 0xffffffffffffffff
movabs rax, 0x22582572a3abbb9d
imul rcx, rax
mov rax, qword [0x14017a248]
cmp rcx, qword [rax + 0x18]
je 0x14005e544
lea rax, [rbp + 0x30]
cmp r14, 0xf
cmova rax, rsi
cmp byte [rax + rdi - 1], 0x30
lea rax, [rbp + 0x30]
jle 0x14005e52b
cmp r14, 0xf
cmova rax, rsi
dec byte [rdi + rax - 1]
jmp 0x14005e538
cmp r14, 0xf
cmova rax, rsi
add byte [rax + rdi - 1], 4
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rdx, [rbp + 0x30]
cmp r14, 0xf
cmova rdx, rsi
mov rcx, rbx
test rdi, rdi
je 0x14005e581
nop dword [rax + rax]
movsx rax, byte [rdx + rcx]
add rax, rbx
imul rbx, rax, 0x401
mov rax, rbx
shr rax, 6
xor rbx, rax
inc rcx
cmp rcx, rdi
jb 0x14005e560
lea rax, [rbx + rbx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14005e5ae
movabs rax, 0x5851f42d4c957f2d
imul rdi, rax
inc rdi
jmp 0x14005e5b1
mov rdi, rax
mov qword [r13], rdi
mov byte [r13 + 8], 1
cmp r14, 0xf
jbe 0x14005e5f2
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005e5e9
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6a5
mov rcx, rsi
call fcn.1400c4e5c
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14005e62d
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6ab
call fcn.1400c4e5c
mov rax, r13
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1400c4df0
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov byte [r13 + 8], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x14005e62d
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005e628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e6ab
jmp 0x14005e628
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.140001a20
nop
call fcn.140001a20
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
nop
call fcn.1400d3b88
int3