Function at 0x140001170
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov rbx, rcx
call fcn.140003450
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [rbp + 0x8c], 0
mov rcx, qword [rbp + 0x68]
lea rsi, [rbp + 0x8c]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
lea rdx, str.ProductId
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edi, dword [rbp + 0x8c]
test rdi, rdi
mov qword [rbp + 0x70], rdi
je 0x14000122c
mov edx, 1
mov rcx, rdi
call fcn.140003420
test rax, rax
jne 0x140001231
mov ecx, 1
mov rdx, rdi
call fcn.140028600
mov eax, 1
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0x68]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
lea rdx, str.ProductId
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
lea rcx, [rbp + 0x20]
mov rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x70]
call fcn.140020660
mov rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
mov qword [rsp + 0x20], 1
lea r9, [0x1400294ff]
lea rcx, [rbp - 0x48]
mov qword [rbp + 0x80], rdx
call fcn.1400239a0
mov qword [rbp + 0x60], rbx
cmp qword [rbp - 0x48], 0
mov rcx, qword [rbp]
mov rdx, qword [rbp + 8]
mov r9, qword [rbp - 0x38]
je 0x140001438
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140001442
mov r8, qword [rbp - 0x10]
mov rbx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov r10, qword [rbp - 0x28]
mov qword [rbp + 0x38], r10
mov r12, qword [rbp - 8]
mov r10, qword [rbp - 0x30]
mov qword [rbp + 0x58], r10
lea r10, [rbx - 1]
mov qword [rbp + 0x50], r10
mov r11, rdi
jmp 0x140001304
cmp r8, 0xffffffffffffffff
cmovne r12, rax
mov rdi, r11
test r11, r11
je 0x140001442
sub r11, rax
cmp r11, rdx
jae 0x14000145c
mov r10, rdi
sub r10, qword [rbp + 0x58]
mov qword [rbp + 0x40], r10
mov r10, rdi
sub r10, r9
mov qword [rbp + 0x48], r10
mov r10, rdi
cmp rdi, r10
jne 0x140001456
movzx r10d, byte [rcx + r11]
mov rsi, qword [rbp + 0x38]
bt rsi, r10
jae 0x14000139c
cmp r9, r12
mov r13, r12
cmovb r13, r9
cmp r8, 0xffffffffffffffff
cmove r13, r9
lea r10, [r13 - 1]
cmp r10, rax
jae 0x1400013d0
mov r15, r13
neg r15
mov r10, qword [rbp + 0x50]
lea r14, [r10 + r13]
lea r10, [r11 + r13]
dec r10
test r15, r15
je 0x1400013d9
cmp r10, rdx
jae 0x1400016ab
movzx r13d, byte [r14]
inc r15
dec r14
lea rsi, [r10 - 1]
cmp r13b, byte [rcx + r10]
mov r10, rsi
je 0x140001370
mov r11, qword [rbp + 0x48]
sub r11, r15
mov r10, rax
cmp r8, 0xffffffffffffffff
je 0x1400013a8
mov r12, r10
mov r10, r11
mov rsi, r11
sub rsi, rax
mov r11, rsi
cmp rsi, rdx
jb 0x140001328
jmp 0x140001456
test r13, r13
jne 0x1400016bc
cmp r8, 0xffffffffffffffff
mov r10, r12
cmove r10, rax
lea r14, [rcx + r11]
mov r15, r9
nop dword [rax + rax]
cmp r15, r10
jae 0x1400012f0
cmp r15, rax
jae 0x140001690
lea rsi, [r11 + r15]
cmp rsi, rdx
jae 0x140001675
movzx esi, byte [rbx + r15]
lea r13, [r15 + 1]
cmp sil, byte [r14 + r15]
mov r15, r13
je 0x1400013f0
mov r10, qword [rbp + 0x58]
mov r11, qword [rbp + 0x40]
cmp r8, 0xffffffffffffffff
jne 0x1400013a5
jmp 0x1400013a8
cmp byte [rbp - 0x2e], 0
je 0x140001506
mov ebx, 1
xor edi, edi
mov rsi, qword [rbp + 0x60]
mov r15, qword [rbp + 0x80]
jmp 0x140001496
mov r9, rdi
mov rdi, r9
test rdi, rdi
js 0x1400016d0
movzx eax, byte [0x1400cd141]
mov r14d, 1
mov edx, 1
mov rcx, rdi
call fcn.1400033f0
test rax, rax
mov rsi, qword [rbp + 0x60]
mov r15, qword [rbp + 0x80]
je 0x1400016d3
mov rbx, rax
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov rdx, qword [rbp + 0x20]
lea rax, [rdx*2]
test rax, rax
jne 0x1400014ee
mov rdx, qword [rbp + 0x70]
test edx, edx
je 0x1400014d7
mov r8d, 1
mov rcx, qword [rbp + 0x78]
call fcn.140003400
mov rax, rsi
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r8d, 1
mov rcx, r15
call fcn.140003400
mov rdx, qword [rbp + 0x70]
test edx, edx
jne 0x1400014c8
jmp 0x1400014d7
movzx r8d, byte [rbp - 0x2f]
test r9, r9
je 0x14000153f
cmp r9, rdx
jae 0x14000155b
cmp byte [rcx + r9], 0xc0
jl 0x1400016e0
movzx eax, byte [rcx + r9 - 1]
test al, al
js 0x14000157f
mov eax, r8d
nop dword [rax]
xor al, 1
test r8b, r8b
mov r8d, eax
jne 0x140001530
jmp 0x140001459
test r8b, r8b
je 0x140001442
nop dword [rax + rax]
xor r8b, 1
jne 0x140001550
jmp 0x140001442
jne 0x1400016e0
movzx eax, byte [rcx + r9 - 1]
test al, al
js 0x1400015b2
mov eax, r8d
nop
xor al, 1
test r8b, r8b
mov r8d, eax
jne 0x140001570
jmp 0x140001459
movzx edx, byte [rcx + r9 - 2]
cmp dl, 0xc0
jge 0x1400015f0
and edx, 0x3f
movzx r10d, byte [rcx + r9 - 3]
cmp r10b, 0xc0
jge 0x14000162d
and r10d, 0x3f
mov r11d, r8d
xor r11b, 1
test r8b, r8b
mov r8d, r11d
jne 0x1400015a4
jmp 0x1400015df
movzx edx, byte [rcx + r9 - 2]
cmp dl, 0xc0
jge 0x14000160d
and edx, 0x3f
movzx r10d, byte [rcx + r9 - 3]
cmp r10b, 0xc0
jge 0x140001641
and r10d, 0x3f
mov r11d, r8d
xor r11b, 1
test r8b, r8b
mov r8d, r11d
jne 0x1400015d3
movzx ecx, byte [rcx + r9 - 4]
and ecx, 7
shl ecx, 6
or r10d, ecx
jmp 0x140001653
and edx, 0x1f
mov ecx, r8d
nop word cs:[rax + rax]
xor cl, 1
test r8b, r8b
mov r8d, ecx
jne 0x140001600
jmp 0x14000165a
and edx, 0x1f
mov ecx, r8d
nop word cs:[rax + rax]
xor cl, 1
test r8b, r8b
mov r8d, ecx
jne 0x140001620
jmp 0x14000165a
and r10d, 0xf
mov ecx, r8d
xor cl, 1
test r8b, r8b
mov r8d, ecx
jne 0x140001634
jmp 0x140001653
and r10d, 0xf
mov ecx, r8d
xor cl, 1
test r8b, r8b
mov r8d, ecx
jne 0x140001648
shl r10d, 6
or edx, r10d
and al, 0x3f
movzx eax, al
shl edx, 6
or edx, eax
cmp edx, 0x110000
je 0x140001442
jmp 0x140001459
add r11, r9
cmp rdx, r11
cmova r11, rdx
lea r8, [0x140029468]
mov rcx, r11
call fcn.1400288f0
jmp 0x1400016f4
cmp r9, rax
cmovbe r9, rax
lea r8, [0x140029450]
mov rcx, r9
mov rdx, rax
call fcn.1400288f0
jmp 0x1400016f4
lea r8, [0x140029498]
mov rcx, r10
call fcn.1400288f0
jmp 0x1400016f4
lea r8, [0x140029480]
mov rcx, r10
mov rdx, rax
call fcn.1400288f0
jmp 0x1400016f4
xor r14d, r14d
mov rcx, r14
mov rdx, rdi
call fcn.140028600
jmp 0x1400016f4
lea rax, [0x1400294b0]
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.140028d30
ud2