Function at 0x7ff70b509a00
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
xor eax, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov esi, eax
mov edi, 0xeb748313
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x140], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x7ff70b509ad3
mov r9, qword [rsp + 0x148]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b509aca
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b509aa0
cmp r10d, esi
jne 0x7ff70b509c3a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x7ff70b509c47
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x7ff70b509c3a
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x7ff70b509c3a
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x7ff70b509b6a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x7ff70b509b40
cmp r10d, edi
je 0x7ff70b509b7c
test r11d, r11d
jne 0x7ff70b509b20
mov rax, qword [rax]
jmp 0x7ff70b509a60
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r15
jbe 0x7ff70b509c42
lea rax, [r15 + r13]
cmp rdx, rax
jae 0x7ff70b509c42
mov esi, 0x811c9dc5
mov edi, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x7ff70b509be9
nop dword [rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x7ff70b509bc0
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x7ff70b509c29
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x7ff70b509c00
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x7ff70b509a60
xor r14d, r14d
jmp 0x7ff70b509c4d
xor r14d, r14d
mov edx, r14d
call rdx
mov qword [rsp + 0x140], rax
test rax, rax
je 0x7ff70b509ed7
mov dword [rsp + 0x528], r14d
mov esi, r14d
mov edi, 0x41343800
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x100], xmm0
movd eax, xmm0
sub ax, 8
test esi, esi
je 0x7ff70b509d01
mov r9, qword [rsp + 0x108]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x7ff70b509cf8
nop word [rax + rax]
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x7ff70b509cd0
cmp r10d, esi
jne 0x7ff70b509e46
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x7ff70b509e53
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x7ff70b509e46
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x7ff70b509e46
mov r12d, dword [r15 + 0x20]
dec r11d
lea rax, [rbx + r11*4]
mov r9d, dword [rax + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x7ff70b509d8c
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x7ff70b509d61
cmp r10d, edi
je 0x7ff70b509d9e
test r11d, r11d
jne 0x7ff70b509d41
mov rcx, qword [rcx]
jmp 0x7ff70b509c90
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x7ff70b509e4e
lea rax, [r15 + r13]
cmp r8, rax
jae 0x7ff70b509e4e
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x7ff70b509e05
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x7ff70b509de0
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x7ff70b509e35
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x7ff70b509e10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x7ff70b509c90
xor r14d, r14d
jmp 0x7ff70b509e59
xor r14d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x528]
mov rcx, qword [rsp + 0x140]
call r8
test rax, rax
je 0x7ff70b509ed7
cmp dword [rsp + 0x528], 2
jne 0x7ff70b509ed7
lea r8, [rax + 8]
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x7ff70b509eca
mov rdx, qword [r8]
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x7ff70b509eb0
mov rcx, rax
call fcn.7ff70b4fb720
add qword [rbx + 8], 0x20
jmp 0x7ff70b509edf
mov rdx, rax
mov rcx, rbx
call fcn.7ff70b525db0
jmp 0x7ff70b509edf
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x7ff70b50b516
movabs rbx, 0x38cc65d113fc5965
mov qword [rsp + 0x3c0], rbx
movabs rdi, 0x4d822a44244df00e
mov qword [rsp + 0x3c8], rdi
movabs r12, 0xbd00fc97f61dca07
mov qword [rsp + 0x3d0], r12
movabs r15, 0xf998c7dac9993560
mov qword [rsp + 0x3d8], r15
movabs rax, 0x3890b42decb03949
mov qword [rsp + 0x3e0], rax
movabs r13, 0x4b569c30c0a5e072
mov qword [rsp + 0x3e8], r13
movabs rax, 0x10517853c7eb340b
mov qword [rsp + 0x3f0], rax
movabs rsi, 0x734046660965e5a4
mov qword [rsp + 0x3f8], rsi
movabs rax, 0x389c658d13c65926
mov qword [rsp + 0x270], rax
movabs rax, 0x4df02a232422f07c
mov qword [rsp + 0x278], rax
movabs rax, 0xbd46fcb7f670ca66
mov qword [rsp + 0x280], rax
movabs rax, 0xf9ebc7bfc9f53509
mov qword [rsp + 0x288], rax
movabs rax, 0x38a8b455ec983969
mov qword [rsp + 0x290], rax
movabs rax, 0x4b059c6cc08ce044
mov qword [rsp + 0x298], rax
movabs rax, 0x103c7832c78e347f
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2a8], rsi
movdqa xmm0, xmmword [rsp + 0x270]
pxor xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [rsp + 0x280]
pxor xmm1, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [rsp + 0x290]
pxor xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [rsp + 0x2a0]
pxor xmm1, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x2a0], xmm1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x270]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff70b50a0a0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x48]
call fcn.7ff70b4fb720
nop
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rdi
mov qword [rsp + 0x410], r12
mov qword [rsp + 0x418], r15
movabs rax, 0x3890b42decb03949
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r13
movabs rax, 0x10517853c7eb340b
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rsi
movabs rax, 0x60e6b729e8af7bcd
mov qword [rsp + 0x440], rax
movabs r13, 0xb5b3b5fc66a44df6
mov qword [rsp + 0x448], r13
movabs rcx, 0x3898659713b35936
mov qword [rsp + 0x2e0], rcx
movabs rcx, 0x4dc72a16240cf059
mov qword [rsp + 0x2e8], rcx
movabs rcx, 0xbd57fcd8f64aca5b
mov qword [rsp + 0x2f0], rcx
movabs rcx, 0xf9aac7e9c9ad3556
mov qword [rsp + 0x2f8], rcx
movabs rcx, 0x38f5b449ecdf3907
mov qword [rsp + 0x300], rcx
movabs rcx, 0x4b3a9c51c0f3e02e
mov qword [rsp + 0x308], rcx
movabs rcx, 0x1002780fc78e347d
mov qword [rsp + 0x310], rcx
movabs rcx, 0x732d46070900e5d0
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], r13
movdqa xmm0, xmmword [rsp + 0x2e0]
pxor xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x2e0], xmm0
movdqa xmm1, xmmword [rsp + 0x2f0]
pxor xmm1, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmm0, xmmword [rsp + 0x300]
pxor xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [rsp + 0x310]
pxor xmm1, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [rsp + 0x320]
pxor xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
lea rax, [rsp + 0x2e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff70b50a291
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1b0]
call fcn.7ff70b4fb720
nop
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x538]
call fcn.7ff70b507df0
nop
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x7ff70b50a30c
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50a306
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b58a
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r15
movabs rax, 0x38b865a21392592c
mov qword [rsp + 0x200], rax
movabs rax, 0x4dd22a282421f06f
mov qword [rsp + 0x208], rax
movabs rax, 0xbd00fcfff669ca66
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r15
movdqa xmm0, xmmword [rsp + 0x200]
pxor xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [rsp + 0x210]
pxor xmm1, xmmword [rsp + 0x250]
movdqa xmmword [rsp + 0x210], xmm1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff70b50a3f0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.7ff70b4fb720
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x538]
call fcn.7ff70b508360
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x7ff70b50a46a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50a464
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b590
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
mov r8, qword [rsp + 0x230]
test r8, r8
je 0x7ff70b50a4b3
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.7ff70b4fb720
nop
mov rax, qword [rsp + 0x238]
cmp rax, 8
jb 0x7ff70b50a4f7
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50a4f1
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b596
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r14w
mov rcx, qword [rsp + 0x538]
mov esi, 0x80000000
test rcx, rcx
je 0x7ff70b50a551
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x7ff70b50a551
cmp rcx, 0xffffffff80000007
je 0x7ff70b50a551
cmp rcx, 0xffffffff80000060
je 0x7ff70b50a551
cmp rcx, 0xffffffff80000050
je 0x7ff70b50a551
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r15
movabs rax, 0x3890b42decb03949
mov qword [rsp + 0x470], rax
movabs rax, 0x4b569c30c0a5e072
mov qword [rsp + 0x478], rax
movabs rax, 0x10517853c7eb340b
mov qword [rsp + 0x480], rax
movabs rax, 0x734046660965e5a4
mov qword [rsp + 0x488], rax
movabs rax, 0x60e6b729e8af7bcd
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r13
movabs rax, 0x38a265b8139e5939
mov qword [rsp + 0x330], rax
movabs rax, 0x4de42a21242ef052
mov qword [rsp + 0x338], rax
movabs rax, 0xbd66fcf2f67eca5b
mov qword [rsp + 0x340], rax
movabs rax, 0xf9f6c7b3c9ee354e
mov qword [rsp + 0x348], rax
movabs rax, 0x38a4b41becc8397e
mov qword [rsp + 0x350], rax
movabs rax, 0x4b339c44c0d6e02e
mov qword [rsp + 0x358], rax
movabs rax, 0x10347824c786346a
mov qword [rsp + 0x360], rax
movabs rax, 0x732c4603090de5c6
mov qword [rsp + 0x368], rax
movabs rax, 0x60c8b75be8ca7bbd
mov qword [rsp + 0x370], rax
movabs rax, 0xb5b3b59966dc4d93
mov qword [rsp + 0x378], rax
movdqa xmm0, xmmword [rsp + 0x330]
pxor xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [rsp + 0x340]
pxor xmm1, xmmword [rsp + 0x460]
movdqa xmmword [rsp + 0x340], xmm1
movdqa xmm0, xmmword [rsp + 0x350]
pxor xmm0, xmmword [rsp + 0x470]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [rsp + 0x360]
pxor xmm1, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0x360], xmm1
movdqa xmm0, xmmword [rsp + 0x370]
pxor xmm0, xmmword [rsp + 0x490]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x7ff70b50a720
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x7ff70b50b59c
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x1d0]
call fcn.7ff70b529190
mov dword [rsp + 0x40], 3
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x7ff70b50a7c0
movups xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x1d0], r14w
add qword [rcx + 8], 0x20
jmp 0x7ff70b50a7d5
lea r8, [rsp + 0x1d0]
call fcn.7ff70b500640
mov rax, qword [rsp + 0x1e8]
cmp rax, 8
jb 0x7ff70b50a811
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50a80b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5a1
call fcn.7ff70b4dd700
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x7ff70b50a84f
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50a849
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5a7
call fcn.7ff70b4dd700
nop
jmp 0x7ff70b50a88b
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r15
movabs rax, 0x3890b42decb03949
mov qword [rsp + 0x180], rax
movabs rax, 0x4b569c30c0a5e072
mov qword [rsp + 0x188], rax
movabs rax, 0x10517853c7eb340b
mov qword [rsp + 0x190], rax
movabs rax, 0x734046660965e5a4
mov qword [rsp + 0x198], rax
movabs rax, 0x60e6b729e8af7bcd
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r13
movabs rax, 0x3898659713b35936
mov qword [rsp + 0xb0], rax
movabs rax, 0x4dc72a16240cf059
mov qword [rsp + 0xb8], rax
movabs rax, 0xbd69fcfbf65eca5b
mov qword [rsp + 0xc0], rax
movabs rax, 0xf9ebc7aec9f73505
mov qword [rsp + 0xc8], rax
movabs rax, 0x38f1b459ece33915
mov qword [rsp + 0xd0], rax
movabs rax, 0x4b339c7dc0d1e000
mov qword [rsp + 0xd8], rax
movabs rax, 0x103f781ac79e3465
mov qword [rsp + 0xe0], rax
movabs rax, 0x732e46140900e5d0
mov qword [rsp + 0xe8], rax
movabs rax, 0x60e6b729e8db7ba8
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r13
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rax, [rsp + 0xb0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff70b50aa72
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.7ff70b4fb720
nop
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.7ff70b507df0
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x7ff70b50aaed
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50aae7
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5ad
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x150]
call fcn.7ff70b508930
nop
cmp byte [rsp + 0x2c8], 1
jne 0x7ff70b50b5b3
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x128]
cmp rbx, rdi
je 0x7ff70b50ab9a
cmp qword [rbx + 0x10], 0
je 0x7ff70b50ab94
cmp r15, qword [rsp + 0x130]
je 0x7ff70b50ab79
mov rdx, rbx
mov rcx, r15
call fcn.7ff70b520c00
add r15, 0x20
mov qword [rsp + 0x128], r15
add rbx, 0x20
jmp 0x7ff70b50ab46
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x120]
call fcn.7ff70b526080
mov r15, qword [rsp + 0x128]
add rbx, 0x20
jmp 0x7ff70b50ab46
lea rcx, [rsp + 0x2b0]
call fcn.7ff70b51fc90
nop
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x7ff70b50abe1
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x7ff70b50abe1
cmp rcx, 0xffffffff80000007
je 0x7ff70b50abe1
cmp rcx, 0xffffffff80000060
je 0x7ff70b50abe1
cmp rcx, 0xffffffff80000050
je 0x7ff70b50abe1
call qword [sym.imp.advapi32.dll_RegCloseKey]
nop
jmp 0x7ff70b50abee
movabs r11, 0x4b339c7dc0d1e000
movabs r10, 0x38f1b459ece33915
movabs r9, 0xf9ebc7aec9f73505
movabs r8, 0xbd69fcfbf65eca5b
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0xf998c7dac9993560
movabs rdi, 0x4d822a44244df00e
movabs rsi, 0x38cc65d113fc5965
mov r13, qword [rsp + 0x120]
mov r12, r13
cmp r13, r15
je 0x7ff70b50b528
cmp qword [r12 + 0x10], 0
je 0x7ff70b50b4cc
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
movabs rbx, 0xbd00fc97f61dca07
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rcx
movabs rbx, 0x3890b42decb03949
mov qword [rsp + 0x1f0], rbx
movabs rbx, 0x4b569c30c0a5e072
mov qword [rsp + 0x1f8], rbx
movabs rdx, 0x38a965b9138f5939
mov qword [rsp + 0x240], rdx
movabs rdx, 0x4ded2a182421f062
mov qword [rsp + 0x248], rdx
movabs rdx, 0xbd5cfcf9f678ca77
mov qword [rsp + 0x250], rdx
movabs rdx, 0xf9f5c7b7c9f63503
mov qword [rsp + 0x258], rdx
movabs rdx, 0x3890b449ecde3928
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rbx
movups xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4a0], xmm0
pxor xmm1, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4b0], xmm1
pxor xmm2, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x4c0], xmm2
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
movabs rdi, 0xbd00fc97f61dca07
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], rcx
movabs rcx, 0x3890b42decb03949
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rbx
movabs rcx, 0x10517853c7eb340b
mov qword [rsp + 0x190], rcx
movabs rcx, 0x734046660965e5a4
mov qword [rsp + 0x198], rcx
movabs rcx, 0x60e6b729e8af7bcd
mov qword [rsp + 0x1a0], rcx
movabs rbx, 0xb5b3b5fc66a44df6
mov qword [rsp + 0x1a8], rbx
movabs rcx, 0x3898659713b35936
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x4dc72a16240cf059
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r11
movabs rcx, 0x103f781ac79e3465
mov qword [rsp + 0xe0], rcx
movabs rcx, 0x732e46140900e5d0
mov qword [rsp + 0xe8], rcx
movabs rcx, 0x60e6b775e8db7ba8
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rbx
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
movzx ebx, byte [rsp + 0x520]
mov rdx, qword [r12 + 0x10]
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x7ff70b50af10
sub rax, rdx
cmp rax, rcx
jb 0x7ff70b50b5d1
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x7ff70b50af36
mov rax, qword [r12]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xb0]
lea rcx, [rsp + 0x100]
call fcn.7ff70b529190
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x4a0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x7ff70b50af74
mov rcx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x7ff70b50afec
lea rsi, [rdx + rcx]
mov qword [rsp + 0x110], rsi
lea rdi, [rsp + 0x100]
cmp r8, 8
cmovae rdi, qword [rsp + 0x100]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x4a0]
call fcn.7ff70b54e1a0
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x100]
mov edi, dword [rsp + 0x40]
movabs rsi, 0x38cc65d113fc5965
jmp 0x7ff70b50b00a
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x4a0]
movzx r8d, bl
lea rcx, [rsp + 0x100]
call fcn.7ff70b52fd50
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x530]
call fcn.7ff70b507df0
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x7ff70b50b0aa
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50b0a4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5b9
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
mov rax, qword [rsp + 0x118]
cmp rax, 8
jb 0x7ff70b50b10b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50b105
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5bf
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x390], rsi
movabs rdi, 0x4d822a44244df00e
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rdi
movups xmm0, xmmword [rsp + 0x380]
pxor xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff70b50b1a0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.7ff70b4fb720
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x530]
call fcn.7ff70b508700
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x7ff70b50b21a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50b214
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5c5
call fcn.7ff70b4dd700
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
cmp byte [rsp + 0x2d0], 1
jne 0x7ff70b50b47a
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.7ff70b520c00
nop
lea rax, [rsp + 0x48]
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp r11, 8
jb 0x7ff70b50b279
mov r8, rcx
lea rdx, [rcx + r9*2]
lea r10, [rcx + r9*2]
jmp 0x7ff70b50b28b
lea r10, [rax + r9*2]
lea rdx, [rsp + 0x48]
lea rdx, [rdx + r9*2]
lea r8, [rsp + 0x48]
cmp r8, rdx
je 0x7ff70b50b2d9
cmp word [r8], 0x22
je 0x7ff70b50b2a0
add r8, 2
cmp r8, rdx
jne 0x7ff70b50b290
cmp r8, rdx
je 0x7ff70b50b2d9
lea rax, [r8 + 2]
cmp rax, rdx
je 0x7ff70b50b2d9
nop
movzx ecx, word [rax]
cmp cx, 0x22
je 0x7ff70b50b2c1
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rdx
jne 0x7ff70b50b2b0
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
sub r10, r8
sar r10, 1
cmp r11, 8
jb 0x7ff70b50b2ef
sub r8, rcx
jmp 0x7ff70b50b2f7
sub r8, rax
lea rcx, [rsp + 0x48]
sar r8, 1
mov rax, r9
sub rax, r8
cmp rax, r10
cmovb r10, rax
lea rcx, [rcx + r8*2]
sub r9, r10
mov qword [rsp + 0x58], r9
lea rdx, [rcx + r10*2]
sub r9, r8
lea r8, [r9*2 + 2]
call fcn.7ff70b54e1a0
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
movabs rax, 0x38a065a113845900
mov qword [rsp + 0x3a0], rax
movabs rax, 0x4d822a21243ff061
mov qword [rsp + 0x3a8], rax
movups xmm0, xmmword [rsp + 0x3a0]
pxor xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.7ff70b520a70
cmp rax, 0xffffffffffffffff
je 0x7ff70b50b3d4
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x7ff70b50b466
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50b3c9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5cb
call fcn.7ff70b4dd700
nop
jmp 0x7ff70b50b466
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x7ff70b50b41e
mov qword [rdx], r14
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], r14
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
add qword [rcx + 8], 0x20
jmp 0x7ff70b50b42d
lea r8, [rsp + 0x48]
call fcn.7ff70b500640
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x7ff70b50b466
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x7ff70b50b460
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5cb
call fcn.7ff70b4dd700
nop
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x2b0]
call fcn.7ff70b51fd10
nop
mov rcx, qword [rsp + 0x530]
test rcx, rcx
je 0x7ff70b50b4cc
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x7ff70b50b4c4
cmp rcx, 0xffffffff80000007
je 0x7ff70b50b4c4
cmp rcx, 0xffffffff80000060
je 0x7ff70b50b4c4
cmp rcx, 0xffffffff80000050
je 0x7ff70b50b4c4
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov qword [rsp + 0x530], r14
add r12, 0x20
cmp r12, r15
je 0x7ff70b50b528
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0xf998c7dac9993560
movabs r8, 0xbd69fcfbf65eca5b
movabs r9, 0xf9ebc7aec9f73505
movabs r10, 0x38f1b459ece33915
movabs r11, 0x4b339c7dc0d1e000
jmp 0x7ff70b50ac52
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x120]
jmp 0x7ff70b50b530
mov rbx, qword [rsp + 0x520]
test r13, r13
je 0x7ff70b50b574
mov rdx, r15
mov rcx, r13
call fcn.7ff70b5008e0
mov rax, qword [rsp + 0x130]
sub rax, r13
and rax, 0xffffffffffffffe0
mov rcx, r13
cmp rax, 0x1000
jb 0x7ff70b50b56b
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff70b50b5d7
mov rcx, r13
call fcn.7ff70b4dd700
nop
mov rax, rbx
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.7ff70b5526b4
nop
call fcn.7ff70b5526b4
nop
invalid