Function at 0x140039220
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
xor eax, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov esi, eax
mov edi, 0xeb748313
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x140], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x1400392f3
mov r9, qword [rsp + 0x148]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x1400392ea
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400392c0
cmp r10d, esi
jne 0x14003945a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140039467
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x14003945a
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x14003945a
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14003938a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140039360
cmp r10d, edi
je 0x14003939c
test r11d, r11d
jne 0x140039340
mov rax, qword [rax]
jmp 0x140039280
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r15
jbe 0x140039462
lea rax, [r15 + r13]
cmp rdx, rax
jae 0x140039462
mov esi, 0x811c9dc5
mov edi, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x140039409
nop dword [rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x1400393e0
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x140039449
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x140039420
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140039280
xor r14d, r14d
jmp 0x14003946d
xor r14d, r14d
mov edx, r14d
call rdx
mov qword [rsp + 0x140], rax
test rax, rax
je 0x1400396f7
mov dword [rsp + 0x528], r14d
mov esi, r14d
mov edi, 0x41343800
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x100], xmm0
movd eax, xmm0
sub ax, 8
test esi, esi
je 0x140039521
mov r9, qword [rsp + 0x108]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x140039518
nop word [rax + rax]
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400394f0
cmp r10d, esi
jne 0x140039666
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x140039673
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x140039666
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x140039666
mov r12d, dword [r15 + 0x20]
dec r11d
lea rax, [rbx + r11*4]
mov r9d, dword [rax + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400395ac
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140039581
cmp r10d, edi
je 0x1400395be
test r11d, r11d
jne 0x140039561
mov rcx, qword [rcx]
jmp 0x1400394b0
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x14003966e
lea rax, [r15 + r13]
cmp r8, rax
jae 0x14003966e
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x140039625
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x140039600
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x140039655
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x140039630
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x1400394b0
xor r14d, r14d
jmp 0x140039679
xor r14d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x528]
mov rcx, qword [rsp + 0x140]
call r8
test rax, rax
je 0x1400396f7
cmp dword [rsp + 0x528], 2
jne 0x1400396f7
lea r8, [rax + 8]
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x1400396ea
mov rdx, qword [r8]
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400396d0
mov rcx, rax
call fcn.14002b6d0
add qword [rbx + 8], 0x20
jmp 0x1400396ff
mov rdx, rax
mov rcx, rbx
call fcn.1400547b0
jmp 0x1400396ff
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003ad36
movabs rbx, 0xba38d454249fea6b
mov qword [rsp + 0x3c0], rbx
movabs rdi, 0xcfc1cc55b526d184
mov qword [rsp + 0x3c8], rdi
movabs r12, 0x654acb962268d245
mov qword [rsp + 0x3d0], r12
movabs r15, 0xde2a68bf263a2b4e
mov qword [rsp + 0x3d8], r15
movabs rax, 0x5c9074a8bcc6315f
mov qword [rsp + 0x3e0], rax
movabs r13, 0x31a40429c3cb57c8
mov qword [rsp + 0x3e8], r13
movabs rax, 0xeaf3089a8fc78d19
mov qword [rsp + 0x3f0], rax
movabs rsi, 0x563b4203409874b2
mov qword [rsp + 0x3f8], rsi
movabs rax, 0xba68d40824a5ea28
mov qword [rsp + 0x270], rax
movabs rax, 0xcfb3cc32b549d1f6
mov qword [rsp + 0x278], rax
movabs rax, 0x650ccbb62205d224
mov qword [rsp + 0x280], rax
movabs rax, 0xde5968da26562b27
mov qword [rsp + 0x288], rax
movabs rax, 0x5ca874d0bcee317f
mov qword [rsp + 0x290], rax
movabs rax, 0x31f70475c3e257fe
mov qword [rsp + 0x298], rax
movabs rax, 0xea9e08fb8fa28d6d
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2a8], rsi
movdqa xmm0, xmmword [rsp + 0x270]
pxor xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [rsp + 0x280]
pxor xmm1, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [rsp + 0x290]
pxor xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [rsp + 0x2a0]
pxor xmm1, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x2a0], xmm1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x270]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400398c0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x48]
call fcn.14002b6d0
nop
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rdi
mov qword [rsp + 0x410], r12
mov qword [rsp + 0x418], r15
movabs rax, 0x5c9074a8bcc6315f
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r13
movabs rax, 0xeaf3089a8fc78d19
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rsi
movabs rax, 0xce88e17c7e283a93
mov qword [rsp + 0x440], rax
movabs r13, 0x959655dd1078ef2c
mov qword [rsp + 0x448], r13
movabs rcx, 0xba6cd41224d0ea38
mov qword [rsp + 0x2e0], rcx
movabs rcx, 0xcf84cc07b567d1d3
mov qword [rsp + 0x2e8], rcx
movabs rcx, 0x651dcbd9223fd219
mov qword [rsp + 0x2f0], rcx
movabs rcx, 0xde18688c260e2b78
mov qword [rsp + 0x2f8], rcx
movabs rcx, 0x5cf574ccbca93111
mov qword [rsp + 0x300], rcx
movabs rcx, 0x31c80448c39d5794
mov qword [rsp + 0x308], rcx
movabs rcx, 0xeaa008c68fa28d6f
mov qword [rsp + 0x310], rcx
movabs rcx, 0x5656426240fd74c6
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], r13
movdqa xmm0, xmmword [rsp + 0x2e0]
pxor xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x2e0], xmm0
movdqa xmm1, xmmword [rsp + 0x2f0]
pxor xmm1, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmm0, xmmword [rsp + 0x300]
pxor xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [rsp + 0x310]
pxor xmm1, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [rsp + 0x320]
pxor xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
lea rax, [rsp + 0x2e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140039ab1
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1b0]
call fcn.14002b6d0
nop
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x538]
call fcn.140037620
nop
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x140039b2c
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039b26
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adaa
call fcn.14000d9c0
nop
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r15
movabs rax, 0xba4cd42724f1ea22
mov qword [rsp + 0x200], rax
movabs rax, 0xcf91cc39b54ad1e5
mov qword [rsp + 0x208], rax
movabs rax, 0x654acbfe221cd224
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r15
movdqa xmm0, xmmword [rsp + 0x200]
pxor xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [rsp + 0x210]
pxor xmm1, xmmword [rsp + 0x250]
movdqa xmmword [rsp + 0x210], xmm1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039c10
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14002b6d0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x538]
call fcn.140037b80
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x140039c8a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039c84
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adb0
call fcn.14000d9c0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
mov r8, qword [rsp + 0x230]
test r8, r8
je 0x140039cd3
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14002b6d0
nop
mov rax, qword [rsp + 0x238]
cmp rax, 8
jb 0x140039d17
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039d11
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adb6
call fcn.14000d9c0
nop
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r14w
mov rcx, qword [rsp + 0x538]
mov esi, 0x80000000
test rcx, rcx
je 0x140039d71
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x140039d71
cmp rcx, 0xffffffff80000007
je 0x140039d71
cmp rcx, 0xffffffff80000060
je 0x140039d71
cmp rcx, 0xffffffff80000050
je 0x140039d71
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r15
movabs rax, 0x5c9074a8bcc6315f
mov qword [rsp + 0x470], rax
movabs rax, 0x31a40429c3cb57c8
mov qword [rsp + 0x478], rax
movabs rax, 0xeaf3089a8fc78d19
mov qword [rsp + 0x480], rax
movabs rax, 0x563b4203409874b2
mov qword [rsp + 0x488], rax
movabs rax, 0xce88e17c7e283a93
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r13
movabs rax, 0xba56d43d24fdea37
mov qword [rsp + 0x330], rax
movabs rax, 0xcfa7cc30b545d1d8
mov qword [rsp + 0x338], rax
movabs rax, 0x652ccbf3220bd219
mov qword [rsp + 0x340], rax
movabs rax, 0xde4468d6264d2b60
mov qword [rsp + 0x348], rax
movabs rax, 0x5ca4749ebcbe3168
mov qword [rsp + 0x350], rax
movabs rax, 0x31c1045dc3b85794
mov qword [rsp + 0x358], rax
movabs rax, 0xea9608ed8faa8d78
mov qword [rsp + 0x360], rax
movabs rax, 0x5657426640f074d0
mov qword [rsp + 0x368], rax
movabs rax, 0xcea6e10e7e4d3ae3
mov qword [rsp + 0x370], rax
movabs rax, 0x959655b81000ef49
mov qword [rsp + 0x378], rax
movdqa xmm0, xmmword [rsp + 0x330]
pxor xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [rsp + 0x340]
pxor xmm1, xmmword [rsp + 0x460]
movdqa xmmword [rsp + 0x340], xmm1
movdqa xmm0, xmmword [rsp + 0x350]
pxor xmm0, xmmword [rsp + 0x470]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [rsp + 0x360]
pxor xmm1, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0x360], xmm1
movdqa xmm0, xmmword [rsp + 0x370]
pxor xmm0, xmmword [rsp + 0x490]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140039f40
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x14003adbc
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x1d0]
call fcn.140057970
mov dword [rsp + 0x40], 3
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140039fe0
movups xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x1d0], r14w
add qword [rcx + 8], 0x20
jmp 0x140039ff5
lea r8, [rsp + 0x1d0]
call fcn.14002ffa0
mov rax, qword [rsp + 0x1e8]
cmp rax, 8
jb 0x14003a031
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a02b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc1
call fcn.14000d9c0
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003a06f
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a069
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc7
call fcn.14000d9c0
nop
jmp 0x14003a0ab
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r15
movabs rax, 0x5c9074a8bcc6315f
mov qword [rsp + 0x180], rax
movabs rax, 0x31a40429c3cb57c8
mov qword [rsp + 0x188], rax
movabs rax, 0xeaf3089a8fc78d19
mov qword [rsp + 0x190], rax
movabs rax, 0x563b4203409874b2
mov qword [rsp + 0x198], rax
movabs rax, 0xce88e17c7e283a93
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r13
movabs rax, 0xba6cd41224d0ea38
mov qword [rsp + 0xb0], rax
movabs rax, 0xcf84cc07b567d1d3
mov qword [rsp + 0xb8], rax
movabs rax, 0x6523cbfa222bd219
mov qword [rsp + 0xc0], rax
movabs rax, 0xde5968cb26542b2b
mov qword [rsp + 0xc8], rax
movabs rax, 0x5cf174dcbc953103
mov qword [rsp + 0xd0], rax
movabs rax, 0x31c10464c3bf57ba
mov qword [rsp + 0xd8], rax
movabs rax, 0xea9d08d38fb28d77
mov qword [rsp + 0xe0], rax
movabs rax, 0x5655427140fd74c6
mov qword [rsp + 0xe8], rax
movabs rax, 0xce88e17c7e5c3af6
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r13
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rax, [rsp + 0xb0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a292
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.14002b6d0
nop
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140037620
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a30d
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a307
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adcd
call fcn.14000d9c0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x150]
call fcn.140038150
nop
cmp byte [rsp + 0x2c8], 1
jne 0x14003add3
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x128]
cmp rbx, rdi
je 0x14003a3ba
cmp qword [rbx + 0x10], 0
je 0x14003a3b4
cmp r15, qword [rsp + 0x130]
je 0x14003a399
mov rdx, rbx
mov rcx, r15
call fcn.14004f570
add r15, 0x20
mov qword [rsp + 0x128], r15
add rbx, 0x20
jmp 0x14003a366
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x120]
call fcn.140054a80
mov r15, qword [rsp + 0x128]
add rbx, 0x20
jmp 0x14003a366
lea rcx, [rsp + 0x2b0]
call fcn.14004e560
nop
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14003a401
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x14003a401
cmp rcx, 0xffffffff80000007
je 0x14003a401
cmp rcx, 0xffffffff80000060
je 0x14003a401
cmp rcx, 0xffffffff80000050
je 0x14003a401
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14003a40e
movabs r11, 0x31c10464c3bf57ba
movabs r10, 0x5cf174dcbc953103
movabs r9, 0xde5968cb26542b2b
movabs r8, 0x6523cbfa222bd219
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0xde2a68bf263a2b4e
movabs rdi, 0xcfc1cc55b526d184
movabs rsi, 0xba38d454249fea6b
mov r13, qword [rsp + 0x120]
mov r12, r13
cmp r13, r15
je 0x14003ad48
cmp qword [r12 + 0x10], 0
je 0x14003acec
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
movabs rbx, 0x654acb962268d245
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rcx
movabs rbx, 0x5c9074a8bcc6315f
mov qword [rsp + 0x1f0], rbx
movabs rbx, 0x31a40429c3cb57c8
mov qword [rsp + 0x1f8], rbx
movabs rdx, 0xba5dd43c24ecea37
mov qword [rsp + 0x240], rdx
movabs rdx, 0xcfaecc09b54ad1e8
mov qword [rsp + 0x248], rdx
movabs rdx, 0x6516cbf8220dd235
mov qword [rsp + 0x250], rdx
movabs rdx, 0xde4768d226552b2d
mov qword [rsp + 0x258], rdx
movabs rdx, 0x5c9074ccbca8313e
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rbx
movups xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4a0], xmm0
pxor xmm1, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4b0], xmm1
pxor xmm2, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x4c0], xmm2
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
movabs rdi, 0x654acb962268d245
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], rcx
movabs rcx, 0x5c9074a8bcc6315f
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rbx
movabs rcx, 0xeaf3089a8fc78d19
mov qword [rsp + 0x190], rcx
movabs rcx, 0x563b4203409874b2
mov qword [rsp + 0x198], rcx
movabs rcx, 0xce88e17c7e283a93
mov qword [rsp + 0x1a0], rcx
movabs rbx, 0x959655dd1078ef2c
mov qword [rsp + 0x1a8], rbx
movabs rcx, 0xba6cd41224d0ea38
mov qword [rsp + 0xb0], rcx
movabs rcx, 0xcf84cc07b567d1d3
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r11
movabs rcx, 0xea9d08d38fb28d77
mov qword [rsp + 0xe0], rcx
movabs rcx, 0x5655427140fd74c6
mov qword [rsp + 0xe8], rcx
movabs rcx, 0xce88e1207e5c3af6
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rbx
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
movzx ebx, byte [rsp + 0x520]
mov rdx, qword [r12 + 0x10]
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14003a730
sub rax, rdx
cmp rax, rcx
jb 0x14003adf1
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x14003a756
mov rax, qword [r12]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xb0]
lea rcx, [rsp + 0x100]
call fcn.140057970
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x4a0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003a794
mov rcx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14003a80c
lea rsi, [rdx + rcx]
mov qword [rsp + 0x110], rsi
lea rdi, [rsp + 0x100]
cmp r8, 8
cmovae rdi, qword [rsp + 0x100]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x4a0]
call fcn.14007b250
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x100]
mov edi, dword [rsp + 0x40]
movabs rsi, 0xba38d454249fea6b
jmp 0x14003a82a
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x4a0]
movzx r8d, bl
lea rcx, [rsp + 0x100]
call fcn.14005e600
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x530]
call fcn.140037620
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a8ca
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a8c4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003add9
call fcn.14000d9c0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
mov rax, qword [rsp + 0x118]
cmp rax, 8
jb 0x14003a92b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a925
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003addf
call fcn.14000d9c0
nop
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x390], rsi
movabs rdi, 0xcfc1cc55b526d184
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rdi
movups xmm0, xmmword [rsp + 0x380]
pxor xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a9c0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.14002b6d0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x530]
call fcn.140037f20
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x14003aa3a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003aa34
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ade5
call fcn.14000d9c0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
cmp byte [rsp + 0x2d0], 1
jne 0x14003ac9a
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.14004f570
nop
lea rax, [rsp + 0x48]
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp r11, 8
jb 0x14003aa99
mov r8, rcx
lea rdx, [rcx + r9*2]
lea r10, [rcx + r9*2]
jmp 0x14003aaab
lea r10, [rax + r9*2]
lea rdx, [rsp + 0x48]
lea rdx, [rdx + r9*2]
lea r8, [rsp + 0x48]
cmp r8, rdx
je 0x14003aaf9
cmp word [r8], 0x22
je 0x14003aac0
add r8, 2
cmp r8, rdx
jne 0x14003aab0
cmp r8, rdx
je 0x14003aaf9
lea rax, [r8 + 2]
cmp rax, rdx
je 0x14003aaf9
nop
movzx ecx, word [rax]
cmp cx, 0x22
je 0x14003aae1
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rdx
jne 0x14003aad0
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
sub r10, r8
sar r10, 1
cmp r11, 8
jb 0x14003ab0f
sub r8, rcx
jmp 0x14003ab17
sub r8, rax
lea rcx, [rsp + 0x48]
sar r8, 1
mov rax, r9
sub rax, r8
cmp rax, r10
cmovb r10, rax
lea rcx, [rcx + r8*2]
sub r9, r10
mov qword [rsp + 0x58], r9
lea rdx, [rcx + r10*2]
sub r9, r8
lea r8, [r9*2 + 2]
call fcn.14007b250
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
movabs rax, 0xba54d42424e7ea0e
mov qword [rsp + 0x3a0], rax
movabs rax, 0xcfc1cc30b554d1eb
mov qword [rsp + 0x3a8], rax
movups xmm0, xmmword [rsp + 0x3a0]
pxor xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.14004f3b0
cmp rax, 0xffffffffffffffff
je 0x14003abf4
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac86
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003abe9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adeb
call fcn.14000d9c0
nop
jmp 0x14003ac86
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14003ac3e
mov qword [rdx], r14
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], r14
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
add qword [rcx + 8], 0x20
jmp 0x14003ac4d
lea r8, [rsp + 0x48]
call fcn.14002ffa0
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac86
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003ac80
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adeb
call fcn.14000d9c0
nop
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x2b0]
call fcn.14004e5e0
nop
mov rcx, qword [rsp + 0x530]
test rcx, rcx
je 0x14003acec
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x14003ace4
cmp rcx, 0xffffffff80000007
je 0x14003ace4
cmp rcx, 0xffffffff80000060
je 0x14003ace4
cmp rcx, 0xffffffff80000050
je 0x14003ace4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x530], r14
add r12, 0x20
cmp r12, r15
je 0x14003ad48
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0xde2a68bf263a2b4e
movabs r8, 0x6523cbfa222bd219
movabs r9, 0xde5968cb26542b2b
movabs r10, 0x5cf174dcbc953103
movabs r11, 0x31c10464c3bf57ba
jmp 0x14003a472
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x120]
jmp 0x14003ad50
mov rbx, qword [rsp + 0x520]
test r13, r13
je 0x14003ad94
mov rdx, r15
mov rcx, r13
call fcn.140030240
mov rax, qword [rsp + 0x130]
sub rax, r13
and rax, 0xffffffffffffffe0
mov rcx, r13
cmp rax, 0x1000
jb 0x14003ad8b
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003adf7
mov rcx, r13
call fcn.14000d9c0
nop
mov rax, rbx
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14007f764
nop
call fcn.14007f764
nop
call fcn.14007f764
nop
call fcn.14002ac30
call fcn.14007f764
nop
call fcn.14007f764
nop
call fcn.14007f764
nop
call fcn.140037590
nop
call fcn.14007f764
nop
call fcn.14007f764
nop
call fcn.14007f764
int3
call fcn.14007f764
nop
call fcn.14002ac30
nop
call fcn.14007f764
int3