Function at 0x1400083e0
Capabilities:
Authenticate hmac
Encode data using xor
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1168
call fcn.140009d60
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10e0], 0xfffffffffffffffe
mov rsi, r9
mov r15, r8
mov r14, rdx
mov rdi, rcx
sub rsp, 0x20
lea rdx, [rbp - 0x80]
call fcn.140006f9e
add rsp, 0x20
test eax, eax
js 0x140008b33
sub rsp, 0x20
lea rdx, [0x14002620f]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
test eax, eax
mov qword [rbp + 0x1098], rsi
je 0x1400084bc
sub rsp, 0x20
lea rdx, [0x140026236]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
test eax, eax
je 0x1400084c3
sub rsp, 0x20
lea rdx, [0x140026273]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
test eax, eax
je 0x1400084ca
sub rsp, 0x20
lea rdx, [0x14002627a]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
add rsp, 0x20
mov ebx, 0x80020009
test eax, eax
jne 0x140008b35
mov r12w, 0x11
jmp 0x1400084cf
mov r12w, 8
jmp 0x1400084cf
mov r12w, 0x4008
jmp 0x1400084cf
mov r12w, 0x13
mov rax, qword [rdi]
movabs rsi, 0x100002600
mov rbx, qword [sym.imp.USER32.dll_CharNextA]
movsx ecx, byte [rax]
cmp ecx, 0x20
ja 0x140008503
bt rsi, rcx
jae 0x140008503
sub rsp, 0x20
mov rcx, rax
call rbx
add rsp, 0x20
mov qword [rdi], rax
jmp 0x1400084e3
sub rsp, 0x20
lea rsi, [rbp - 0x80]
mov rcx, rdi
mov rdx, rsi
call fcn.140006f9e
add rsp, 0x20
test eax, eax
js 0x140008b33
cmp r12w, 0x12
jg 0x14000860c
cmp r12w, 8
je 0x1400086c2
cmp r12w, 0x11
jne 0x140008b4b
sub rsp, 0x20
lea rcx, [rbp - 0x80]
call fcn.14000fb10
add rsp, 0x20
mov rsi, rax
mov eax, 0xffffffff
mov ecx, esi
xor ecx, eax
or ecx, 0xfffffffe
mov ebx, 0x80004005
cmp ecx, eax
jne 0x140008b35
mov qword [rbp + 0x10d0], r14
mov qword [rbp + 0x10c0], r15
mov qword [rbp + 0x10c8], rdi
mov eax, esi
shr eax, 0x1f
add eax, esi
sar eax, 1
mov qword [rbp + 0xf88], 0
mov dword [rbp + 0x10d8], eax
movsxd r8, eax
cmp r8d, 0x101
jb 0x140008985
mov qword [rbp + 0x10a0], rsi
sub rsp, 0x20
lea rcx, [rbp + 0xf88]
mov qword [rbp + 0x10a8], r8
mov rdx, r8
call fcn.140006b8a
add rsp, 0x20
mov rax, qword [rbp + 0xf88]
mov qword [rbp + 0x10b0], rax
mov rcx, qword [rbp + 0x10b0]
test rcx, rcx
mov rsi, qword [rbp + 0x10a0]
mov r8, qword [rbp + 0x10a8]
jne 0x140008990
xor esi, esi
mov ebx, 1
jmp 0x140008aa7
cmp r12w, 0x13
je 0x140008701
movzx eax, r12w
cmp eax, 0x4008
jne 0x140008b4b
sub rsp, 0x20
lea rsi, [rbp - 0x80]
mov rcx, rsi
call fcn.14000fb10
add rsp, 0x20
mov qword [rbp + 0xf88], 0
add eax, 2
movsxd rdx, eax
cmp rdx, 0x101
mov qword [rbp + 0x10c0], r15
jb 0x140008794
mov qword [rbp + 0x10d0], r14
mov qword [rbp + 0x10c8], rdi
sub rsp, 0x20
lea rcx, [rbp + 0xf88]
call fcn.140006b8a
add rsp, 0x20
mov rax, qword [rbp + 0xf88]
mov qword [rbp + 0x10d8], rax
mov r13, qword [rbp + 0x10d8]
test r13, r13
mov rdi, qword [rbp + 0x10c8]
mov r14, qword [rbp + 0x10d0]
mov rbx, qword [sym.imp.USER32.dll_CharNextA]
lea rsi, [rbp - 0x80]
jne 0x14000879f
mov esi, 0xe
jmp 0x14000895b
sub rsp, 0x20
mov rcx, rsi
call fcn.14000fb10
add rsp, 0x20
inc eax
mov rcx, qword [r14]
sub rsp, 0x30
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, r15
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
mov esi, eax
jmp 0x140008b20
mov r12, r14
mov qword [rbp + 0xf88], 0
sub rsp, 0x20
lea rcx, [rbp - 0x80]
call fcn.14000fb10
add rsp, 0x20
shl rax, 0x20
movabs rcx, 0x100000000
add rcx, rax
mov rbx, rcx
sar rbx, 0x1f
mov rax, rbx
sub rax, 0xffffffff80000000
xor r14d, r14d
shr rax, 0x20
jne 0x140008ade
shr rcx, 0x1f
movsxd rsi, ecx
cmp ebx, 0x400
jg 0x14000888e
sub rsp, 0x20
mov rcx, rsi
call fcn.140005d9b
add rsp, 0x20
test al, al
je 0x14000888e
add rsi, 0xf
and rsi, 0xfffffffffffffff0
mov rax, rsi
call fcn.140009d60
sub rsp, rax
mov r14, rsp
jmp 0x1400088b1
lea r13, [rbp + 0xf90]
mov qword [r13 - 8], r13
cmp byte [rbp - 0x80], 0
je 0x14000880d
mov r12, qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
sub rsp, 0x20
mov rcx, rsi
call rbx
add rsp, 0x20
mov cl, byte [rsi]
cmp cl, 0x5c
jne 0x1400087dc
cmp byte [rax], 0x30
jne 0x1400087dc
mov byte [r13], 0
sub rsp, 0x20
mov rcx, rax
call rbx
add rsp, 0x20
mov rsi, rax
jmp 0x140008805
mov byte [r13], cl
mov cl, byte [rsi]
sub rsp, 0x20
call r12
add rsp, 0x20
test eax, eax
je 0x140008802
inc r13
mov al, byte [rsi + 1]
test al, al
je 0x14000880d
inc rsi
mov byte [r13], al
inc rsi
inc r13
cmp byte [rsi], 0
jne 0x1400087ac
mov r12, r14
mov word [r13], 0
mov r14, qword [rbp + 0xf88]
test r14, r14
je 0x140008956
xor ebx, ebx
movabs r15, 0xffffffff00000000
mov rsi, r14
sub rsp, 0x20
mov rcx, rsi
call fcn.14000fb10
add rsp, 0x20
lea ecx, [rax + 1]
add rsi, rcx
mov rdx, rbx
xor rdx, r15
and rbx, rdx
add rbx, rcx
test eax, eax
jne 0x140008836
mov rcx, qword [r12]
sub rsp, 0x30
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rdx, qword [rbp + 0x10c0]
xor r8d, r8d
mov r9d, 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
mov esi, eax
jmp 0x14000895b
sub rsp, 0x20
lea rcx, [rbp + 0xf88]
mov rdx, rsi
call fcn.140005dd2
add rsp, 0x20
mov r14, rax
test rax, rax
je 0x140008adb
sar ebx, 1
mov word [r14], 0
sub rsp, 0x30
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
xor esi, esi
lea r8, [rbp - 0x80]
mov ecx, 3
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add rsp, 0x30
test eax, eax
je 0x140008ae7
sub rsp, 0x20
xor esi, esi
lea r9, [rbp + 0x10bc]
mov rcx, r14
xor edx, edx
xor r8d, r8d
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
add rsp, 0x20
test eax, eax
js 0x140008af1
mov eax, dword [rbp + 0x10bc]
lea rdx, [rbp + 0x1094]
mov dword [rdx], eax
mov rcx, qword [r12]
sub rsp, 0x30
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], 4
mov rdx, r15
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
mov esi, eax
mov r14b, 1
jmp 0x140008b0f
mov esi, 0xd
lea rax, [rbp + 0xf90]
cmp qword [rax - 8], rax
je 0x140008b20
sub rsp, 0x20
lea rcx, [rbp + 0xf88]
call fcn.140008e0e
add rsp, 0x20
jmp 0x140008b20
lea rcx, [rbp + 0xf90]
mov qword [rcx - 8], rcx
sub rsp, 0x20
xor r15d, r15d
xor edx, edx
call fcn.14000c450
add rsp, 0x20
test esi, esi
jle 0x140008a62
movabs r14, 0xffffffff00000000
xor r14, rsi
and r14, rsi
movabs r11, 0x7fffffff80000000
mov r10d, 0x3ff
mov r8d, 0x7e0000
movabs r9, 0x7e000000000000
xor esi, esi
movsx ecx, byte [rbp + rsi - 0x80]
xor ebx, ebx
lea edx, [rcx - 0x30]
cmp edx, 0x36
ja 0x140008a0c
bt r10, rdx
jb 0x140008a02
bt r8, rdx
jb 0x140008a07
bt r9, rdx
jae 0x140008a0c
add cl, 0xa9
jmp 0x140008a0a
add cl, 0xd0
jmp 0x140008a0a
add cl, 0xc9
mov ebx, ecx
movzx edx, bl
mov ecx, r15d
xor ecx, 0xfffffffb
and ecx, r15d
mov ebx, ecx
not ebx
and ebx, 0x1e
and ecx, 0xe1
or ecx, ebx
xor cl, 0x1a
shl edx, cl
mov r12, qword [rbp + 0xf88]
mov rdi, rsi
shr rdi, 1
mov rbx, rdi
xor rbx, r11
and rbx, rdi
mov cl, byte [r12 + rbx]
mov eax, ecx
and al, dl
xor cl, dl
or cl, al
mov byte [r12 + rbx], cl
inc rsi
add r15d, 4
cmp r14, rsi
jne 0x1400089dc
mov rax, qword [rbp + 0xf88]
mov rcx, qword [rbp + 0x10d0]
mov rcx, qword [rcx]
sub rsp, 0x30
mov edx, dword [rbp + 0x10d8]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x10c0]
xor r8d, r8d
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add rsp, 0x30
mov esi, eax
mov ebx, 2
lea rax, [rbp + 0xf90]
cmp qword [rax - 8], rax
mov rdi, qword [rbp + 0x10c8]
je 0x140008acf
sub rsp, 0x20
lea rcx, [rbp + 0xf88]
call fcn.140008e0e
add rsp, 0x20
cmp ebx, 2
mov ebx, 0x80004005
je 0x140008b20
jmp 0x140008b35
xor r14d, r14d
xor esi, esi
mov ebx, 0x8007000e
jmp 0x140008b0f
xor r14d, r14d
mov ebx, 0x8007000e
jmp 0x140008b0f
mov ebx, eax
xor r14d, r14d
jmp 0x140008b0f
mov rax, qword [rcx]
mov qword [rbp + 0xf88], rax
sub rsp, 0x20
call fcn.14000fad8
add rsp, 0x20
mov rcx, qword [rbp + 0xf88]
test rcx, rcx
jne 0x140008af8
test r14b, r14b
je 0x140008b35
test esi, esi
je 0x140008b4b
sub rsp, 0x20
mov ecx, esi
call fcn.140008cde
add rsp, 0x20
mov ebx, eax
mov eax, ebx
lea rsp, [rbp + 0x10e8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
mov rcx, rdi
mov rdx, qword [rbp + 0x1098]
call fcn.140006f9e
add rsp, 0x20
mov ebx, eax
sar ebx, 0x1f
and ebx, eax
jmp 0x140008b35