Function at 0x140070bc0
Capabilities:
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.1400dc350
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp + 0xf70], rax
mov rbx, r8
mov rsi, rcx
lea r8, str._ver
lea rcx, [rsp + 0x50]
call fcn.14001c2d0
nop
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov byte [rsp + 0x70], r14b
xor edx, edx
mov r8d, 0xfff
lea rcx, [rsp + 0x71]
call fcn.1400dc6e0
mov dword [rsp + 0x30], 0x1000
mov dword [rsp + 0x34], 0xffffffff
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or edi, 0xffffffff
test eax, eax
jne 0x140070e30
cmp dword [rsp + 0x34], 3
jne 0x140070e30
cmp dword [rsp + 0x30], 0x1000
je 0x140070e30
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9d, [r14 + 3]
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140070e29
mov r8d, dword [0x1401ddd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xe
jne 0x140070d9e
nop word [rax + rax]
mov ecx, r14d
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, r14d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc r14d
cmp r14d, 0x100
jl 0x140070d00
mov dword [0x1401ddd80], r8d
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.error_writing_ver
test rdx, 0xffffffffffff0000
jne 0x140070de9
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140070df4
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002a60
jmp 0x140070df4
lea rcx, [rsp + 0x48]
call fcn.140003a70
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [rsi + 0x40]
call fcn.140065b60
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x140070f8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140070f8a
mov bl, 1
jmp 0x140070f8c
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.error_reading_ver
test rdx, 0xffffffffffff0000
jne 0x140070e7b
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140070e86
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002a60
jmp 0x140070e86
lea rcx, [rsp + 0x40]
call fcn.140003a70
nop
mov rbx, qword [rsi + 0x40]
call fcn.14005b820
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001c2d0
nop
lea r8, [rbx + 0x190]
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400109e0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140070ed0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140016430
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140070ef8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140070f11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [0x1401ddd80]
lea ecx, [rsi + 1]
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 3
jne 0x140070f8a
lea r8d, [rcx + 0x3f]
mov r11d, r14d
mov eax, esi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
nop word [rax + rax]
test ebx, ebx
jle 0x140070f82
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r14d
mov r10, rbx
test eax, eax
jle 0x140070f7a
mov ecx, r9d
mov edx, eax
nop
add r8d, ecx
dec ecx
dec rdx
jne 0x140070f70
add r9d, r11d
dec r10
jne 0x140070f65
inc r11d
cmp r11d, r8d
jl 0x140070f50
xor bl, bl
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140070fa6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rbp + 0xf70]
xor rcx, rsp
call fcn.1400d72a0
add rsp, 0x1080
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret