Function at 0x14003e974
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8d0
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140197e90]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
mov r14, rcx
mov qword [rbp - 0x50], rcx
xor r12d, r12d
mov dword [rsp + 0x78], r12d
mov eax, dword [0x14019fd80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x12
jne 0x14003ea12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x70], r12
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [0x1401979a8]
mov rax, qword [0x1401979a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov r9d, dword [0x14019fd80]
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
mov r15d, 8
lea r13d, [r15 - 7]
cmp ecx, 5
jne 0x14003eac7
mov r8d, r12d
mov edx, r8d
mov r10, r15
mov ecx, edx
and ecx, r13d
sub ecx, r13d
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
mov edx, ecx
xor edx, eax
sub r10, r13
jne 0x14003ea97
add r9d, edx
add r8d, r13d
cmp r8d, 0x100
jl 0x14003ea91
mov dword [0x14019fd80], r9d
mov r9d, r13d
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdi, 0xffffffff80000002
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140018038
or rsi, 0xffffffffffffffff
test eax, eax
je 0x14003eb0c
mov r9d, r13d
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140018038
test eax, eax
jne 0x14003ecc5
mov word [rbp - 0x40], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x3e]
call fcn.1400be450
mov edi, 0x400
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x40]
lea rdx, str.CurrentVersion
lea rcx, [rsp + 0x60]
call fcn.140018118
test eax, eax
jne 0x14003ec63
lea rcx, [rbp - 0x40]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003eb54
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e74
mov dword [rsp + 0x40], edi
lea rdx, [0x140133640]
lea rcx, [rbp - 0x80]
call fcn.140001cb0
nop
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x40]
lea rdx, str.CurrentBuild
lea rcx, [rsp + 0x60]
call fcn.140018118
test eax, eax
jne 0x14003ec40
lea rcx, [rbp - 0x40]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14003ebad
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.140001e74
lea r8, [rbp - 0x80]
lea rdx, [0x14013376c]
lea rcx, [rbp - 0x60]
call fcn.140017550
nop
lea r8, [0x14012df38]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140017478
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.14000df38
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003ec21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003ec40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003ec5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003ec78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov eax, dword [0x14019fd80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x10
jne 0x14003ecc5
mov r8d, r13d
mov eax, r13d
mov edx, 0x98
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
sub edx, r13d
jns 0x14003ecb1
mov dword [0x14019fd80], ecx
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x44], r12d
mov qword [rbp - 0x78], r12
mov rax, qword [0x1401a16b8]
test rax, rax
jne 0x14003ed1b
lea rcx, str.Version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14003ed0a
lea rdx, str.GetFileVersionInfoSizeW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a16b8], rax
jmp 0x14003ed11
mov rax, qword [0x1401a16b8]
test rax, rax
jne 0x14003ed1b
mov edi, r12d
jmp 0x14003ed2b
lea rdx, [rsp + 0x48]
lea rcx, str.kernel32.dll
call rax
mov edi, eax
test edi, edi
je 0x14003ee9d
mov ecx, edi
call fcn.1400b8688
mov rsi, rax
call fcn.140021eac
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9d, edi
mov r8d, dword [rsp + 0x48]
lea rdx, str.kernel32.dll
call fcn.1400334cc
test eax, eax
je 0x14003ee91
lea r9, [rsp + 0x44]
lea r8, [rbp - 0x78]
lea rdx, [0x140130a20]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14003ee3d
cmp dword [rsp + 0x44], r12d
je 0x14003ee3d
mov rdi, qword [rbp - 0x78]
mov r9d, dword [0x14019fd80]
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
and ecx, 0x8000000f
jge 0x14003edbd
sub ecx, r13d
or ecx, 0xfffffff0
add ecx, r13d
cmp ecx, r13d
jne 0x14003ee0d
mov rax, qword [str.RIZzKw7F]
mov qword [rbp - 0x70], rax
mov al, byte [0x140133768]
mov byte [rbp - 0x68], al
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp byte [rax + rcx], r12b
jne 0x14003ede1
mov eax, 4
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400b8688
mov rcx, rax
call fcn.1400ba0bc
mov r9d, dword [0x14019fd80]
cmp dword [rdi], 0xfeef04bd
jne 0x14003ee44
movzx r8d, word [rdi + 0x12]
movzx r9d, word [rdi + 0x10]
movzx eax, word [rdi + 0x16]
mov dword [rsp + 0x20], eax
lea rdx, str._d._d___d_
lea rcx, [rsp + 0x58]
call fcn.14000f8ac
mov rbx, qword [rsp + 0x58]
mov r9d, dword [0x14019fd80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
cmp r8d, 6
jne 0x14003ee91
mov r8d, r12d
test r9d, r9d
je 0x14003ee8a
mov ecx, r9d
and ecx, r13d
add r8d, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x14003ee74
mov dword [0x14019fd80], r8d
mov rcx, rsi
call fcn.1400ba0bc
or rsi, 0xffffffffffffffff
mov r8d, dword [0x14019fd80]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 4
jne 0x14003ef14
mov ecx, r12d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov edi, eax
test edi, edi
jle 0x14003ef0c
mov eax, r8d
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r12d
mov r11, rdi
test eax, eax
jle 0x14003ef04
mov edx, r9d
mov r10d, eax
add r15d, edx
sub edx, r13d
sub r10, r13
jne 0x14003eef9
add r9d, ecx
sub r11, r13
jne 0x14003eeef
add ecx, r13d
cmp ecx, r15d
jl 0x14003eed9
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14000291c
mov dword [rsp + 0x78], r13d
mov eax, r12d
test rbx, rbx
setne al
test eax, eax
jne 0x14003ef3e
mov ecx, 0x80004005
call fcn.140001874
int3
mov rax, qword [rsp + 0x50]
mov rdx, rbx
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x14003ef60
add rax, 2
test cx, cx
jne 0x14003ef49
mov eax, r12d
jmp 0x14003ef65
sbb eax, eax
or eax, r13d
test eax, eax
je 0x14003ef9b
cmp dword [rbx - 0x10], r12d
jl 0x14003ef9b
lea rdx, [0x140133650]
mov rcx, rbx
call fcn.1400b9dcc
test rax, rax
je 0x14003ef9b
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14003ef9b
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.140001d7c
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003efb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003efd7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14003efec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov rax, r14
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.1400b9010
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret