Function at 0x7ff74b08ff8
Capabilities:
Encode data using xor
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x400
mov rax, qword [0x7ff74b58340]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0x460]
mov ebp, dword [rsp + 0x480]
mov r13, qword [0x7ff74b58568]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x468]
xor r12d, r12d
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x470]
mov r14, r8
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x488]
mov r15, rdx
lea r8d, [r12 + 0x4c]
lea rcx, [rsp + 0x192]
and ebp, 2
xor edx, edx
mov qword [rsp + 0xb0], rax
mov rdi, r9
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x90], ebp
mov word [rsp + 0x190], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1e0]
lea rbx, [0x7ff74ae2000]
mov rax, qword [rbx + 0x6f0e0]
xor edx, edx
mov r8d, 0x1fa
mov qword [rcx], rax
mov eax, dword [rbx + 0x6f0e8]
mov esi, r12d
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x6f0ec]
mov word [rcx + 0xc], ax
lea rcx, [rsp + 0x1ee]
call sub.msvcrt.dll_memset
mov rdx, qword [rbx + 0x677c8]
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x98], r12
mov r12, qword [r15 + 0x18]
cmp rdx, qword [r15 + 0xf8]
je 0x7ff74b0992b
sbb eax, eax
sbb eax, 0xffffffff
mov ebx, 1
test eax, eax
je 0x7ff74b09946
lea rdx, [rsp + 0x190]
lea rcx, [r15 + 0xf8]
call fcn.7ff74ae5ae0
xor r9d, r9d
lea rdx, [0x7ff74b58350]
cmp eax, r9d
je 0x7ff74b0914d
mov esi, ebx
jmp 0x7ff74b0914d
cmp ebp, r9d
jne 0x7ff74b095b3
mov ebx, r9d
cmp esi, r9d
je 0x7ff74b091f5
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xc0]
mov r8, r12
call fcn.7ff74ae6e54
mov r11d, dword [r15 + 0x64]
mov eax, 0x10000000
and r11b, 0x80
lea rcx, [rsp + 0xc0]
neg r11b
sbb r8d, r8d
xor edx, edx
and r8d, eax
add r8d, eax
call fcn.7ff74ae6aa8
xor esi, esi
cmp eax, esi
jne 0x7ff74b091e5
mov rcx, qword [rsp + 0x178]
lea rdx, [rsp + 0x74]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ecx, dword [rsp + 0x74]
cmp eax, esi
lea eax, [rsi + 2]
cmovl ecx, eax
mov dword [rsp + 0x74], ecx
cmp ecx, eax
je 0x7ff74b1da65
lea rcx, [rsp + 0xc0]
mov rdx, r15
call fcn.7ff74aee830
mov ebx, eax
lea rcx, [rsp + 0xc0]
call fcn.7ff74ae70e0
xor r9d, r9d
cmp ebp, r9d
jne 0x7ff74b095c1
mov ebx, 1
cmp dword [r13 + 0x28], ebx
jne 0x7ff74b09215
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r9d, r9d
add dword [r13 + 0x30], ebx
lea rcx, [rdi + 4]
mov ebp, r9d
cmp dword [rdi], r9d
jbe 0x7ff74b0924b
mov r8d, dword [rdi]
movzx eax, byte [rcx]
lea ebp, [rbp + rbp*2]
add rcx, rbx
xor ebp, eax
mov eax, 0x828cbfbf
mul ebp
shr edx, 7
imul edx, edx, 0xffffff05
add ebp, edx
sub r8, rbx
jne 0x7ff74b09228
cmp r14, r9
je 0x7ff74b095d2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
xor r9d, r9d
jmp 0x7ff74b09264
movsxd rcx, eax
mov rax, qword [rsp + 0xa0]
mov r8, r9
mov eax, dword [rax]
add rcx, rcx
mov r10d, 0x80070057
add rax, 4
lea rdx, [rax + 7]
and rdx, 0xfffffffffffffff8
cmp rdx, rax
jb 0x7ff74b1daca
mov r8, rdx
mov ebx, r9d
cmp ebx, r9d
jl 0x7ff74b094b1
lea rax, [r8 + rcx]
cmp rax, rcx
jb 0x7ff74b1dad2
mov rcx, rax
jmp 0x7ff74b092b3
cmp ebx, r9d
jl 0x7ff74b094b1
mov edx, dword [rdi]
add rdx, 7
cmp rdx, 7
jb 0x7ff74b1dada
lea rax, [rdx + 7]
and rax, 0xfffffffffffffff8
cmp rax, rdx
jb 0x7ff74b1dada
mov r8, rax
mov ebx, r9d
cmp ebx, r9d
jl 0x7ff74b094b1
lea rax, [r8 + rcx]
cmp rax, rcx
jb 0x7ff74b1dae2
mov rcx, rax
jmp 0x7ff74b092fe
cmp ebx, r9d
jl 0x7ff74b094b1
mov rsi, qword [rsp + 0xb8]
mov eax, dword [rsi]
add rax, 4
lea rdx, [rax + 7]
and rdx, 0xfffffffffffffff8
cmp rdx, rax
jb 0x7ff74b1daea
mov r8, rdx
mov ebx, r9d
cmp ebx, r9d
jl 0x7ff74b094b1
lea rax, [r8 + rcx]
cmp rax, rcx
jb 0x7ff74b1daf2
mov rcx, rax
jmp 0x7ff74b09347
cmp ebx, r9d
jl 0x7ff74b094b1
lea r8, [rcx + 0x70]
cmp r8, 0x70
jb 0x7ff74b1dafa
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [0x7ff74b58358]
xor r9d, r9d
cmp rax, r9
je 0x7ff74b1dafa
mov rcx, qword [rsp + 0xa0]
mov edx, dword [r13 + 0x30]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rcx
mov ecx, dword [rsp + 0x480]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], ecx
mov ecx, dword [rsp + 0x478]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xa8]
mov r9, rdi
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r8d, ebp
call fcn.7ff74b08d80
xor r9d, r9d
mov rdi, rax
jmp 0x7ff74b093d2
cmp rdi, r9
mov eax, 0x8007000e
cmove ebx, eax
cmp ebx, r9d
jl 0x7ff74b094b1
cmp qword [r13 + 0x38], r9
je 0x7ff74b0dc5e
mov ebx, r9d
cmp ebx, r9d
jl 0x7ff74b094b1
cmp dword [rsp + 0x90], r9d
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r9d
cmovne r12, r9
mov edx, 1
mov rcx, r13
mov r8, r12
mov r9, r14
mov qword [rsp + 0x20], rax
call fcn.7ff74b094f8
mov rcx, qword [r13 + 0x48]
mov edx, ebp
xor ebp, ebp
mov rbx, rax
cmp qword [rcx + rdx*8], rbp
jne 0x7ff74b1db1e
mov qword [rcx + rdx*8], rdi
mov ecx, 1
add dword [r13 + 0x54], ecx
mov rax, qword [r13 + 0x38]
mov byte [rdx + rax], cl
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rdi
mov eax, dword [rdi + 0x1c]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 0x14]
mov dword [rcx + 0xc], eax
mov rcx, qword [0x7ff74b58418]
call fcn.7ff74ae3010
mov rax, qword [r15 + 0xa0]
mov qword [rdi + 0x60], rax
mov qword [r15 + 0xa0], rdi
mov eax, 1
lock add dword [rdi + 0x18], eax
mov rcx, qword [0x7ff74b58418]
lock add dword [rcx + 0x3c], 0xffffffff
mov dword [rcx + 0x40], ebp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
neg rbx
sbb ebx, ebx
and ebx, 0x401e7
mov eax, 1
cmp dword [r13 + 0x28], eax
jne 0x7ff74b094c5
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.7ff74ae3090
mov rbx, qword [rsp + 0x440]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp esi, r9d
jne 0x7ff74b09156
jmp 0x7ff74b1d8ff
cmp ebx, r9d
je 0x7ff74b1d934
mov r14, r9
jmp 0x7ff74b091fe
mov eax, r9d
jmp 0x7ff74b09264
mov rdx, qword [rbx + 0x677d0]
cmp rdx, qword [r15 + 0x100]
jne 0x7ff74b09114
xor eax, eax
jmp 0x7ff74b09119
mov rbx, qword [r15 + 0xf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
dec eax
mov dword [rsp + 0x7c], edx
movsxd rcx, eax
cmp eax, edx
jbe 0x7ff74b09987
lea rcx, [rbx + rcx*2]
cmp word [rcx], 0x2f
je 0x7ff74b09985
cmp word [rcx], 0x5c
je 0x7ff74b09985
cmp word [rcx], 0x3a
je 0x7ff74b09985
dec eax
sub rcx, 2
cmp eax, edx
ja 0x7ff74b09969
cmp eax, edx
je 0x7ff74b0998b
inc eax
lea r8, [rbx + rax*2]
lea rcx, [rsp + 0x1e0]
mov edx, 0x104
call fcn.7ff74af91bc
xor r9d, r9d
cmp eax, r9d
jl 0x7ff74b1d8f5
mov eax, dword [r15 + 0x64]
mov edi, r9d
mov qword [rsp + 0x80], r9
and al, 0x80
mov qword [rsp + 0x68], r9
neg al
mov eax, 0x100
sbb ebx, ebx
and ebx, eax
add ebx, eax
cmp r12, r9
je 0x7ff74b099ef
mov rax, qword [r12]
lea rdx, [rsp + 0x80]
mov rcx, r12
call qword [rax + 0x18]
test eax, eax
jns 0x7ff74b1d8bd
lea rax, [rsp + 0x80]
lea rdx, str.SoftwareClasses
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
xor r9d, r9d
cmp eax, r9d
jne 0x7ff74b1d93e
mov rcx, qword [rsp + 0x68]
cmp rcx, r9
jne 0x7ff74b1d998
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
or ebx, 0x20019
lea rdx, [rsp + 0x1e0]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x7ff74b1d9d6
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x7ff74b1da2d
test edi, edi
jne 0x7ff74b1da4c
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rdi, qword [rsp + 0x60]
xor r9d, r9d
cmp ebx, r9d
lea ebx, [r9 + 1]
cmove esi, ebx
jmp 0x7ff74b09aa4
lea rdx, [0x7ff74b58350]
jmp 0x7ff74b0914d
lea r8, [r13 + 0x38]
lea rcx, str.GlobalRotHintTable
mov r9d, 2
mov edx, 0xfb
call fcn.7ff74b0dca0
xor r9d, r9d
mov qword [r13 + 0x40], rax
cmp rax, r9
jne 0x7ff74b093f0
jmp 0x7ff74b1db02
mov rax, qword [r12]
lea r8, [rsp + 0x68]
lea rdx, [0x7ff74b4f558]
mov rcx, r12
mov edi, 1
call qword [rax]
xor r9d, r9d
cmp eax, r9d
jge 0x7ff74b09a25
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x20]
mov rdi, qword [rsp + 0x60]
xor r9d, r9d
mov ebx, 1
jmp 0x7ff74b09aa4
cmp dword [0x7ff74b582c8], r9d
je 0x7ff74b1d934
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b1d934
test byte [rcx + 0x1c], bl
je 0x7ff74b1d934
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51790]
mov edx, 0xb
mov r9d, 0x80004015
call fcn.7ff74b25ec4
mov eax, 0x80004015
jmp 0x7ff74b094c7
cmp dword [0x7ff74b582c8], r9d
je 0x7ff74b1d98e
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
lea ebx, [r9 + 1]
cmp rcx, rdx
je 0x7ff74b1da5b
test byte [rcx + 0x1c], bl
je 0x7ff74b1da5b
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 9]
lea r8, [0x7ff74b51790]
mov r9d, eax
call fcn.7ff74b25ec4
mov rdi, qword [rsp + 0x60]
xor r9d, r9d
jmp 0x7ff74b09aa4
mov rdi, qword [rsp + 0x60]
jmp 0x7ff74b1d8f5
mov rax, qword [rcx]
lea r8, [rsp + 0x7c]
mov edx, 1
call qword [rax + 0x18]
test eax, eax
jns 0x7ff74b09a33
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x7ff74b1d8e3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x7ff74b1d8ed
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x98]
lea rdx, str.AppID
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x190]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x98], 0x4e
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x88]
mov ebx, eax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x7ff74b09a6c
mov rax, qword [rcx]
mov edx, dword [rsp + 0x7c]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
and qword [rsp + 0x68], rsi
jmp 0x7ff74b09a7a
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x20]
jmp 0x7ff74b09a90
mov rdi, qword [rsp + 0x60]
jmp 0x7ff74b0914d
mov rcx, qword [rsp + 0x178]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, dword [rsp + 0x78]
cmp eax, esi
lea eax, [rsi + 1]
cmovl ecx, esi
mov dword [rsp + 0x78], ecx
cmp ecx, eax
je 0x7ff74b091d3
mov rcx, qword [rsp + 0x178]
lea rdx, [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ecx, dword [rsp + 0x70]
cmp eax, esi
lea eax, [rsi + 2]
cmovl ecx, eax
mov dword [rsp + 0x70], ecx
cmp ecx, eax
jne 0x7ff74b091e5
mov ebx, dword [rsp + 0xf8]
and ebx, 1
jmp 0x7ff74b091e5
mov ebx, r10d
jmp 0x7ff74b09298
mov ebx, r10d
jmp 0x7ff74b092b3
mov ebx, r10d
jmp 0x7ff74b092e3
mov ebx, r10d
jmp 0x7ff74b092fe
mov ebx, r10d
jmp 0x7ff74b0932c
mov ebx, r10d
jmp 0x7ff74b09347
mov rdi, r9
jmp 0x7ff74b093d2
call sub.KERNEL32.dll_GetLastError
xor r9d, r9d
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r9d
cmovle ebx, eax
jmp 0x7ff74b093f3
mov rcx, qword [rcx + rdx*8]
mov r8, rcx
mov rcx, qword [rcx + 8]
cmp rcx, rbp
jne 0x7ff74b1db22
mov qword [r8 + 8], rdi
jmp 0x7ff74b09443