Function at 0x14019de88
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2d0
movdqa xmm0, xmmword [0x1404cec10]
xor r14d, r14d
mov qword [rbp + 0x28], r14
movdqa xmm1, xmm0
movdqu xmmword [rbp + 0x38], xmm0
mov qword [rbp - 0x18], r14
mov ecx, r14d
lea r15d, [r14 + 1]
mov qword [rbp + 8], r14
movdqu xmmword [rbp - 8], xmm0
mov dword [rsp + 0x40], 0x446e7552
movdqu xmmword [rbp + 0x18], xmm0
mov dword [rsp + 0x44], 0x62507161
mov dword [rsp + 0x48], 0x64637a7a
mov word [rsp + 0x4c], 0x62
movsxd rax, ecx
xor byte [rsp + rax + 0x40], cl
add ecx, r15d
cmp ecx, 0xd
jb 0x14019df00
mov byte [rsp + 0x4d], r14b
mov ecx, r14d
mov dword [rsp + 0x60], 0x6f66756e
mov edx, 9
mov dword [rsp + 0x64], 0x6b622b68
mov word [rsp + 0x68], 0x64
movsxd rax, ecx
xor byte [rsp + rax + 0x60], cl
add ecx, r15d
cmp ecx, edx
jb 0x14019df33
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x69], r14b
lea rcx, [rsp + 0x60]
call fcn.1401a7810
lea rcx, [rbp + 0xb0]
call qword [case.0x140173169.0]
mov esi, dword [rbp + 0xbc]
lea eax, [rsi - 0x55f0]
cmp eax, 0x277
ja 0x14019df7c
mov esi, 0xb
jmp 0x14019df8d
lea eax, [rsi - 0x4a61]
mov ecx, 0xa
cmp eax, 4
cmovbe esi, ecx
xor eax, eax
mov dword [rsp + 0x6a], 0x4e0053
mov word [rbp - 0x3e], ax
mov ecx, r14d
mov dword [rsp + 0x6e], 0x570044
mov dword [rsp + 0x72], 0x440053
mov dword [rsp + 0x76], 0x420054
mov dword [rsp + 0x7a], 0x440054
mov dword [rsp + 0x7e], 0x680063
mov dword [rbp - 0x7e], 0x62007e
mov dword [rbp - 0x7a], 0x60007d
mov dword [rbp - 0x76], 0x650076
mov dword [rbp - 0x72], 0x44004e
mov dword [rbp - 0x6e], 0x7b007d
mov dword [rbp - 0x6a], 0x780072
mov dword [rbp - 0x66], 0x6a006f
mov dword [rbp - 0x62], 0x55003a
mov dword [rbp - 0x5e], 0x410048
mov dword [rbp - 0x5a], 0x6a005d
mov dword [rbp - 0x56], 0x530052
mov dword [rbp - 0x52], 0x4d0047
mov dword [rbp - 0x4e], 0x730050
mov dword [rbp - 0x4a], 0x550043
mov dword [rbp - 0x46], 0x40005b
mov dword [rbp - 0x42], 0x450045
movsxd rax, ecx
xor word [rsp + rax*2 + 0x6a], cx
add ecx, r15d
cmp ecx, 0x2c
jb 0x14019e036
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x6a]
lea rcx, [rbp + 0x68]
mov word [rbp - 0x3e], r14w
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x68], r14
call fcn.14013edcc
lea r8, [rbp + 0x68]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x220]
call fcn.140183ef0
lea rcx, [rbp + 0x68]
call fcn.14013ed68
mov rbx, qword [rbp + 0x220]
test rbx, rbx
je 0x14019e48a
xor eax, eax
mov dword [rsp + 0x40], 0x680044
mov word [rsp + 0x5c], ax
mov ecx, r14d
mov dword [rsp + 0x44], 0x730071
mov dword [rsp + 0x48], 0x640068
mov dword [rsp + 0x4c], 0x51007f
mov dword [rsp + 0x50], 0x7b006d
mov dword [rsp + 0x54], 0x620079
mov dword [rsp + 0x58], 0x630063
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
add ecx, r15d
cmp ecx, 0xe
jb 0x14019e0dc
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
mov word [rsp + 0x5c], r14w
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x38], r14
call fcn.14013edcc
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x220]
call fcn.140184080
mov rdi, rax
mov r13d, 7
lea rax, [rbp + 0x28]
cmp rax, rdi
je 0x14019e15b
lea rcx, [rbp + 0x28]
call fcn.14013ed68
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov qword [rdi + 0x18], r13
lea rcx, [rbp + 0x48]
call fcn.14013ed68
lea rcx, [rbp - 0x38]
call fcn.14013ed68
mov ecx, r14d
mov dword [rsp + 0x40], 0x650045
mov dword [rsp + 0x44], 0x77006b
mov dword [rsp + 0x48], 0x6a006d
mov dword [rsp + 0x4c], 0x4e0068
mov dword [rsp + 0x50], 0x4c
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
add ecx, r15d
cmp ecx, 9
jb 0x14019e198
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
mov word [rsp + 0x52], r14w
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x38], r14
call fcn.14013edcc
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x220]
call fcn.140184080
mov rdi, rax
lea rax, [rbp - 0x18]
cmp rax, rdi
je 0x14019e211
lea rcx, [rbp - 0x18]
call fcn.14013ed68
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov qword [rdi + 0x18], r13
lea rcx, [rbp + 0x48]
call fcn.14013ed68
lea rcx, [rbp - 0x38]
call fcn.14013ed68
xor eax, eax
mov dword [rsp + 0x40], 0x730050
mov word [rsp + 0x58], ax
mov ecx, r14d
mov dword [rsp + 0x44], 0x65006d
mov dword [rsp + 0x48], 0x760061
mov dword [rsp + 0x4c], 0x6e0075
mov dword [rsp + 0x50], 0x670067
mov dword [rsp + 0x54], 0x67006b
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
add ecx, r15d
cmp ecx, 0xc
jb 0x14019e25d
cmp qword [rbp], 8
lea rcx, [rbp - 0x18]
lea rdx, [rsp + 0x40]
mov word [rsp + 0x58], r14w
cmovae rcx, qword [rbp - 0x18]
call fcn.1403cbeb0
test rax, rax
je 0x14019e2d2
mov dword [rbp + 0x210], 0x730050
mov ecx, r14d
mov dword [rbp + 0x214], 0x6d
movsxd rax, ecx
xor word [rbp + rax*2 + 0x210], cx
add ecx, r15d
cmp ecx, 3
jb 0x14019e2a7
lea rdx, [rbp + 0x210]
mov word [rbp + 0x216], r14w
lea rcx, [rbp - 0x18]
call fcn.14013edcc
xor eax, eax
mov dword [rsp + 0x40], 0x740043
mov word [rsp + 0x58], ax
mov ecx, r14d
mov dword [rsp + 0x44], 0x710070
mov dword [rsp + 0x48], 0x6b0061
mov dword [rsp + 0x4c], 0x450072
mov dword [rsp + 0x50], 0x60007d
mov dword [rsp + 0x54], 0x6f0066
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
add ecx, r15d
cmp ecx, 0xc
jb 0x14019e30c
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
mov word [rsp + 0x58], r14w
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x38], r14
call fcn.14013edcc
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x220]
call fcn.140184080
mov rdi, rax
lea rax, [rbp + 8]
cmp rax, rdi
je 0x14019e385
lea rcx, [rbp + 8]
call fcn.14013ed68
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov qword [rdi + 0x18], r13
lea rcx, [rbp + 0x48]
call fcn.14013ed68
lea rcx, [rbp - 0x38]
call fcn.14013ed68
mov ecx, r14d
mov dword [rbp + 0x210], 0x430055
mov dword [rbp + 0x214], 0x50
movsxd rax, ecx
xor word [rbp + rax*2 + 0x210], cx
add ecx, r15d
cmp ecx, 3
jb 0x14019e3ae
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rbp + 0x210]
lea rcx, [rsp + 0x40]
mov word [rbp + 0x216], r14w
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], r14
call fcn.14013edcc
cmp qword [rsp + 0x58], 8
lea rax, [rbp + 0x220]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
cmovae r8, qword [rsp + 0x40]
lea rax, [rbp + 0x210]
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rbp + 0x210], r14d
mov dword [rbp + 0x220], 4
mov qword [rsp + 0x20], r14
lea r9d, [rdx + 0x10]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov edi, dword [rbp + 0x210]
or ecx, 0xffffffff
test eax, eax
cmovne edi, ecx
lea rcx, [rsp + 0x40]
call fcn.14013ed68
mov eax, 0x80000000
add rax, rbx
cmp rax, 5
jbe 0x14019e485
cmp rbx, 0xffffffff80000007
je 0x14019e485
cmp rbx, 0xffffffff80000060
je 0x14019e485
cmp rbx, 0xffffffff80000050
je 0x14019e485
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rbx, r14
jmp 0x14019e490
mov edi, dword [rbp + 0x218]
call fcn.140141104
cmp qword [rbp + 0x20], 8
lea r14, [rbp + 8]
lea r15, [rbp + 0x28]
mov dword [rsp + 0x6a], 0x680057
cmovae r14, qword [rbp + 8]
lea r12, [rbp - 0x18]
cmp qword [rbp + 0x40], 8
mov r13, rax
mov dword [rsp + 0x6e], 0x67006c
cmovae r15, qword [rbp + 0x28]
cmp qword [rbp], 8
mov dword [rsp + 0x72], 0x72006b
cmovae r12, qword [rbp - 0x18]
xor edx, edx
mov ecx, edx
mov dword [rsp + 0x76], 0x270075
mov dword [rsp + 0x7a], 0x60002d
mov dword [rsp + 0x7e], 0x2e002a
mov dword [rbp - 0x7e], 0x2d007f
mov dword [rbp - 0x7a], 0x7c002b
mov dword [rbp - 0x76], 0x390030
mov dword [rbp - 0x72], 0x660050
mov dword [rbp - 0x6e], 0x79007d
mov dword [rbp - 0x6a], 0x370072
mov dword [rbp - 0x66], 0x4a0057
mov dword [rbp - 0x62], 0x3e003a
mov dword [rbp - 0x5e], 0x33006f
mov dword [rbp - 0x5a], 0x7b003b
mov dword [rbp - 0x56], 9
movsxd rax, ecx
xor word [rsp + rax*2 + 0x6a], cx
inc ecx
cmp ecx, 0x21
jb 0x14019e543
movdqa xmm0, xmmword [0x1404cec10]
lea rcx, [rbp - 0x38]
mov word [rbp - 0x54], dx
mov qword [rbp - 0x38], rdx
lea rdx, [rsp + 0x6a]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.14013edcc
mov dword [rsp + 0x38], edi
lea r8, [rbp - 0x38]
mov qword [rsp + 0x30], r14
lea rdx, [rbp + 0x88]
mov qword [rsp + 0x28], r15
mov r9d, esi
mov rcx, r13
mov qword [rsp + 0x20], r12
call fcn.1401a5300
lea rcx, [rbp + 0x28]
call fcn.14013ed68
lea rcx, [rbp - 0x18]
call fcn.14013ed68
lea rcx, [rbp + 8]
call fcn.14013ed68
call fcn.140141104
mov rdi, qword [rbp + 0x218]
lea r8, [rbp + 0x88]
mov rdx, rdi
call fcn.1401a5760
lea rcx, [rbp + 0x88]
call fcn.14013ed68
test rbx, rbx
je 0x14019e617
mov eax, 0x80000000
add rax, rbx
cmp rax, 5
jbe 0x14019e617
cmp rbx, 0xffffffff80000007
je 0x14019e617
cmp rbx, 0xffffffff80000060
je 0x14019e617
cmp rbx, 0xffffffff80000050
je 0x14019e617
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rcx, [rbp + 8]
call fcn.14013ed68
lea rcx, [rbp - 0x18]
call fcn.14013ed68
lea rcx, [rbp + 0x28]
call fcn.14013ed68
mov rbx, qword [rsp + 0x328]
mov rax, rdi
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret