Function at 0x14020ac1e
Capabilities:
Authenticate hmac
Manually build aes constants
Set registry value

Disassembly:
push rax
pushf
mov eax, 0x8e93223f
pushf
not eax
add eax, 0x9fd17592
xor eax, 0xdee4388e
rol eax, 0x36
popf
pushf
not eax
add eax, 0xa47a6ddb
xor eax, 0x900dde83
rol eax, 0x35
popf
pushf
not eax
add eax, 0x9a19786f
xor eax, 0xa46d47a8
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xf5d636db
xor eax, 0xd08f1f68
rol eax, 0x92
popf
cmp eax, 4
jne 0x14020ac81
popf
pop rax
jmp 0x14020bd6b
cmp eax, 0
jne 0x14020ac90
popf
pop rax
jmp 0x14020ad35
cmp eax, 3
jne 0x14020ac9f
popf
pop rax
jmp 0x14020bce7
cmp eax, 1
jne 0x14020acae
popf
pop rax
jmp 0x14020ae39
cmp eax, 0xa
jne 0x14020acbd
popf
pop rax
jmp 0x14020c35f
cmp eax, 7
jne 0x14020accc
popf
pop rax
jmp 0x14020c1b7
cmp eax, 6
jne 0x14020acdb
popf
pop rax
jmp 0x14020be5c
cmp eax, 0xb
jne 0x14020acea
popf
pop rax
jmp 0x14020c3a4
cmp eax, 0xc
jne 0x14020acf9
popf
pop rax
jmp 0x14020c5a9
cmp eax, 8
jne 0x14020ad08
popf
pop rax
jmp 0x14020c261
cmp eax, 5
jne 0x14020ad17
popf
pop rax
jmp 0x14020bdc7
cmp eax, 2
jne 0x14020ad26
popf
pop rax
jmp 0x14020ae6f
cmp eax, 9
jne 0x14020ad35
popf
pop rax
jmp 0x14020c354
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rbx, r8
mov qword [rbp + 0x58], rdx
xor edx, edx
mov dword [rbp + 0x70], 1
mov r8d, 0x4fe2378f
pushf
not r8d
add r8d, 0xfbc24394
xor r8d, 0xb6b7ae5d
rol r8d, 0xd0
popf
pushf
not r8d
add r8d, 0x874def94
xor r8d, 0xe0e4d23c
rol r8d, 0x4f
popf
lea rcx, [rbp + 0x80]
call fcn.140044ca0
cmp qword [rbx + 0x18], 8
jb 0x14020ae06
push rax
pushf
mov eax, 0x9919bea6
pushf
not eax
add eax, 0x865fe5ee
xor eax, 0xf201c7ab
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xb3c6f547
xor eax, 0xe28b65eb
rol eax, 0xa4
popf
pushf
not eax
add eax, 0x843e875b
xor eax, 0xed63ba92
rol eax, 0xce
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0x6c06cc13
pushf
not eax
add eax, 0x826fe3dc
xor eax, 0x8545dc70
rol eax, 0x56
popf
pushf
not eax
add eax, 0xd7c4fc76
xor eax, 0xe9a07143
rol eax, 0x33
popf
jmp 0x14020ac72
mov rbx, qword [rbx]
push rax
pushf
mov eax, 0x2b51e5a1
pushf
not eax
add eax, 0x8443fe42
xor eax, 0x8324955c
rol eax, 0x18
popf
pushf
not eax
add eax, 0xfa3597ef
xor eax, 0xfd5dc161
rol eax, 0xef
popf
jmp 0x14020ac72
mov r9, rbx
lea r8, [0x18b1362ce]
pushf
sub r8, 0x4b043d96
popf
mov edx, 0x713d95b4
pushf
not edx
add edx, 0xa69729e8
xor edx, 0xcf9c6a34
rol edx, 0x28
popf
pushf
not edx
add edx, 0xf5cb3b9b
xor edx, 0xf719ab19
rol edx, 0x93
popf
pushf
not edx
add edx, 0xb9a80e0d
xor edx, 0xd109d956
rol edx, 0x64
popf
pushf
not edx
add edx, 0xdbfb6d1d
xor edx, 0xaef1c83a
rol edx, 0x3a
popf
lea rcx, [rbp + 0x80]
call fcn.1402b1ff2
mov ebx, 0x234a9fe9
pushf
not ebx
add ebx, 0x9338cfbe
xor ebx, 0xb4350295
rol ebx, 0xae
popf
pushf
not ebx
add ebx, 0xb7116813
xor ebx, 0xf6c0f11c
rol ebx, 0xe9
popf
mov eax, 0x1fc46fda
pushf
not eax
add eax, 0xc20c4e72
xor eax, 0xdc2283f8
rol eax, 0x83
popf
pushf
not eax
add eax, 0xc3a81801
xor eax, 0xd1292c85
rol eax, 0x4e
popf
mov word [rsp + 0x42], ax
mov edx, 0x6d4cb5eb
pushf
not edx
add edx, 0xe982bda0
xor edx, 0xcb766d46
rol edx, 0xf8
popf
pushf
not edx
add edx, 0xe0b6658f
xor edx, 0xedff252d
rol edx, 0x63
popf
mov eax, 0xc445579d
pushf
not eax
add eax, 0x8a15122e
xor eax, 0xe6b965d1
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xf94c62e8
xor eax, 0x8b59f4b0
rol eax, 0x16
popf
mov dword [rbp + 0x50], ebx
mov word [rsp + 0x4a], ax
mov r11d, 0x577ced8e
pushf
not r11d
add r11d, 0xec00f819
xor r11d, 0x98a60e8e
rol r11d, 0xc8
popf
pushf
not r11d
add r11d, 0xdfc38b87
xor r11d, 0xbdadc77a
rol r11d, 0xd2
popf
movzx eax, word [0x1400f2594]
lea r9d, [rbx + 0x25]
xor ax, bx
mov word [rbp - 0x40], bx
mov word [rsp + 0x54], ax
lea r10d, [rbx + 0x14]
movzx eax, word [0x1400f2596]
lea r8d, [rbx + 0x2c]
xor ax, bx
mov word [rsp + 0x7e], r11w
mov word [rsp + 0x56], ax
mov edi, 0x2d06e50e
pushf
not edi
add edi, 0xecdebe88
xor edi, 0xc0ffd85d
rol edi, 0x16
popf
pushf
not edi
add edi, 0xabefe339
xor edi, 0xc536eb17
rol edi, 0xeb
popf
pushf
not edi
add edi, 0xe7619705
xor edi, 0xafd0ebc5
rol edi, 0x37
popf
movzx eax, word [str.NtShutdownSystem]
mov ecx, 0xec1e4aaf
pushf
not ecx
add ecx, 0x8d865a8a
xor ecx, 0xa9968457
rol ecx, 0x79
popf
pushf
not ecx
add ecx, 0xf93b66cc
xor ecx, 0xdf293db4
rol ecx, 0x78
popf
xor ax, bx
mov dword [rsp + 0x34], edi
mov word [rsp + 0x58], ax
movzx eax, word [0x1400f259a]
xor ax, bx
mov word [rbp - 0x80], dx
mov word [rsp + 0x5a], ax
movzx eax, word [0x1400f259c]
xor ax, bx
mov word [rsp + 0x38], r9w
mov word [rsp + 0x5c], ax
movzx eax, word [0x1400f259e]
xor ax, bx
mov word [rsp + 0x3a], r10w
mov word [rsp + 0x5e], ax
movzx eax, word [0x1400f25a0]
xor ax, bx
mov word [rsp + 0x3c], cx
mov word [rsp + 0x60], ax
movzx eax, word [0x1400f25a2]
xor ax, bx
mov word [rsp + 0x3e], r10w
mov word [rsp + 0x62], ax
movzx eax, word [0x1400f25a4]
xor ax, bx
mov word [rsp + 0x40], dx
mov word [rsp + 0x64], ax
movzx eax, word [0x1400f25a6]
xor ax, bx
mov word [rsp + 0x44], r9w
mov word [rsp + 0x66], ax
movzx eax, word [0x1400f25a8]
xor ax, bx
mov word [rsp + 0x46], r10w
mov word [rsp + 0x68], ax
movzx eax, word [0x1400f25aa]
xor ax, bx
mov word [rsp + 0x48], r8w
mov word [rsp + 0x6a], ax
movzx eax, word [0x1400f25ac]
xor ax, bx
mov word [rsp + 0x4c], r9w
mov word [rsp + 0x6c], ax
movzx eax, word [0x1400f25ae]
xor ax, bx
mov word [rsp + 0x4e], dx
mov word [rsp + 0x6e], ax
movzx eax, word [str._ntoskrnl.exe]
xor ax, bx
mov word [rsp + 0x50], r9w
mov word [rsp + 0x70], ax
movzx eax, word [0x1400f25b2]
xor ax, bx
mov word [rsp + 0x52], r11w
movzx r13d, word [0x1400f25ba]
movzx r12d, word [0x1400f25bc]
xor r13w, bx
movzx r15d, word [0x1400f25be]
xor r12w, bx
movzx r14d, word [str.win32kbase.sys]
xor r15w, bx
movzx esi, word [0x1400f25c2]
xor r14w, bx
movzx edi, word [0x1400f25c4]
xor si, bx
movzx r11d, word [0x1400f25c8]
xor di, bx
movzx r10d, word [0x1400f25ca]
xor r11w, 0x3a
movzx r9d, word [0x1400f25cc]
xor r10w, 0x3a
movzx r8d, word [reloc.WS2_32.dll_WSAStartup]
xor r9w, 0x3a
movzx edx, word [str.win32kfull.sys]
xor r8w, 0x3a
movzx ecx, word [0x1400f25d2]
xor dx, 0x3a
mov word [rsp + 0x7a], r13w
xor cx, 0x3a
mov word [rsp + 0x72], ax
mov r13d, 0xb93da553
pushf
not r13d
add r13d, 0x924d6e7a
xor r13d, 0x999186fb
rol r13d, 0xe6
popf
pushf
not r13d
add r13d, 0xda7110e9
xor r13d, 0xb2dd18bc
rol r13d, 0x5e
popf
movzx eax, word [0x1400f25b4]
xor ax, bx
mov word [rsp + 0x7c], r12w
mov r12d, 0xc21f7336
pushf
not r12d
add r12d, 0x9d02529b
xor r12d, 0xe1e8ea16
rol r12d, 0xcc
popf
pushf
not r12d
add r12d, 0x9ac21986
xor r12d, 0xf05f1be1
rol r12d, 0x21
popf
pushf
not r12d
add r12d, 0x8a9c351f
xor r12d, 0xa5e5b841
rol r12d, 0x18
popf
pushf
not r12d
add r12d, 0xeff3528c
xor r12d, 0xf81adcab
rol r12d, 0x14
popf
mov word [rsp + 0x74], ax
movzx eax, word [0x1400f25b6]
xor r13w, r12w
mov word [rbp - 0x3e], r13w
xor ax, bx
mov word [rsp + 0x76], ax
mov r13d, 0xf77dffed
pushf
not r13d
add r13d, 0x9920e1f4
xor r13d, 0xfcf8ab78
rol r13d, 0xaf
popf
pushf
not r13d
add r13d, 0xbbaeae4a
xor r13d, 0xeef69415
rol r13d, 0xbe
popf
pushf
not r13d
add r13d, 0xe760d8a1
xor r13d, 0x855a5dbf
rol r13d, 0x86
popf
movzx eax, word [0x1400f25b8]
xor r13w, r12w
mov word [rbp - 0x3c], r13w
xor ax, bx
movzx r13d, word [rsp + 0x7e]
movzx ebx, word [0x1400f25c6]
xor r13w, r12w
mov word [rbp - 0x3a], r13w
xor bx, 0x3a
mov r13d, 0xe0a571af
pushf
not r13d
add r13d, 0xa37344de
xor r13d, 0xaec3d15a
rol r13d, 0x1b
popf
pushf
not r13d
add r13d, 0xaeb976b5
xor r13d, 0xfb000342
rol r13d, 0x53
popf
pushf
not r13d
add r13d, 0xe3c883d0
xor r13d, 0xe7dedc37
rol r13d, 3
popf
pushf
not r13d
add r13d, 0x957ac46e
xor r13d, 0xf9bbdaa5
rol r13d, 0x40
popf
mov word [rsp + 0x78], ax
movzx eax, word [0x1400f25d4]
xor r13w, r12w
mov word [rbp - 0x38], r13w
xor ax, 0x3a
mov r13d, 0xfe9f91cd
pushf
not r13d
add r13d, 0x9b5e470e
xor r13d, 0x845e683f
rol r13d, 0x2b
popf
pushf
not r13d
add r13d, 0xee22c1c6
xor r13d, 0x96253992
rol r13d, 0x5e
popf
pushf
not r13d
add r13d, 0xa7ae690c
xor r13d, 0xf2218afd
rol r13d, 9
popf
pushf
not r13d
add r13d, 0x8a542115
xor r13d, 0xf8d88622
rol r13d, 0xf0
popf
mov word [rsp + 0x30], r15w
xor r13w, r12w
mov r15d, 0x112a8c97
pushf
not r15d
add r15d, 0x8be2b248
xor r15d, 0xb3e13c9b
rol r15d, 0x14
popf
pushf
not r15d
add r15d, 0xf7cfd03d
xor r15d, 0xeb4c6b14
rol r15d, 0x40
popf
pushf
not r15d
add r15d, 0xd56cfc1a
xor r15d, 0xaf5599b3
rol r15d, 0x4f
popf
pushf
not r15d
add r15d, 0xfe745a5f
xor r15d, 0xe478f632
rol r15d, 0x34
popf
mov word [rbp - 0x36], r13w
mov r12d, 0x79d7733
pushf
not r12d
add r12d, 0xee94a798
xor r12d, 0x91af1a1c
rol r12d, 0xd7
popf
pushf
not r12d
add r12d, 0xc32c8373
xor r12d, 0x99931c24
rol r12d, 0x18
popf
pushf
not r12d
add r12d, 0x99ae4a91
xor r12d, 0x9974aceb
rol r12d, 0x7e
popf
pushf
not r12d
add r12d, 0x9366c8ee
xor r12d, 0xe4ed4662
rol r12d, 0x94
popf
xor r12w, word [rbp + 0x50]
mov r13d, 0xca0b1226
pushf
not r13d
add r13d, 0xe425d5e5
xor r13d, 0xc7e02298
rol r13d, 0x9c
popf
pushf
not r13d
add r13d, 0xf406e8a7
xor r13d, 0x8ae73a94
rol r13d, 0xab
popf
mov word [rbp - 0x34], r12w
mov r12d, 0x400ca9c3
pushf
not r12d
add r12d, 0xf01b41cd
xor r12d, 0x983e675e
rol r12d, 0xb5
popf
pushf
not r12d
add r12d, 0xa3153310
xor r12d, 0xe588f24a
rol r12d, 0xc4
popf
pushf
not r12d
add r12d, 0xbdc089df
xor r12d, 0xe1929e39
rol r12d, 0xcc
popf
xor r13w, r12w
mov word [rbp - 0x32], r13w
movzx r13d, r15w
xor r13w, r12w
mov word [rbp - 0x30], r13w
mov r13d, 0x3c429191
pushf
not r13d
add r13d, 0x89a998bc
xor r13d, 0xf4e12d23
rol r13d, 0xc2
popf
pushf
not r13d
add r13d, 0xf7004f84
xor r13d, 0xa74a4e34
rol r13d, 0xc9
popf
pushf
not r13d
add r13d, 0xcefc3039
xor r13d, 0xb3295cda
rol r13d, 0xa2
popf
xor r13w, r12w
mov word [rbp - 0x2e], r13w
mov r13d, 0x3021f159
pushf
not r13d
add r13d, 0xfe622fc7
xor r13d, 0xc69d7032
rol r13d, 0x26
popf
pushf
not r13d
add r13d, 0xd24ab21d
xor r13d, 0x9af71aca
rol r13d, 0xff
popf
xor r13w, r12w
mov word [rbp - 0x2c], r13w
movzx r13d, word [rbp - 0x80]
xor r13w, r12w
mov word [rbp - 0x2a], r13w
movzx r13d, word [rsp + 0x38]
xor r13w, r12w
mov word [rbp - 0x28], r13w
mov r13d, 0x4e974e1f
pushf
not r13d
add r13d, 0x96c79872
xor r13d, 0xb4428e56
rol r13d, 0x25
popf
pushf
not r13d
add r13d, 0x9d0e3462
xor r13d, 0xb30f0c3c
rol r13d, 0x75
popf
pushf
not r13d
add r13d, 0x83d1932d
xor r13d, 0x831030bb
rol r13d, 0x2f
popf
pushf
not r13d
add r13d, 0xaf01aec5
xor r13d, 0xb95fae50
rol r13d, 0xd2
popf
xor r13w, r12w
mov word [rbp - 0x26], r13w
movzx r13d, word [rsp + 0x3a]
xor r13w, r12w
mov word [rbp - 0x24], r13w
movzx r13d, r15w
xor r13w, r12w
mov word [rbp - 0x22], r13w
mov r13d, 0xadce7f54
pushf
not r13d
add r13d, 0x9ef9b725
xor r13d, 0x8820d5bb
rol r13d, 0xad
popf
pushf
not r13d
add r13d, 0x8adb90ba
xor r13d, 0xccc76207
rol r13d, 0x27
popf
pushf
not r13d
add r13d, 0xc12de56b
xor r13d, 0x9c86b589
rol r13d, 0x93
popf
xor r13w, r12w
mov word [rbp - 0x20], r13w
movzx r13d, word [rsp + 0x3c]
xor r13w, r12w
mov word [rbp - 0x1e], r13w
movzx r13d, word [rsp + 0x3e]
xor r13w, r12w
mov word [rbp - 0x1c], r13w
movzx r13d, word [rsp + 0x40]
xor r13w, r12w
mov word [rbp - 0x1a], r13w
movzx r13d, word [rsp + 0x42]
xor r13w, r12w
mov word [rbp - 0x18], r13w
mov r13d, 0x13d7ef7d
pushf
not r13d
add r13d, 0xd76d12a4
xor r13d, 0xc5c3713c
rol r13d, 0xb4
popf
pushf
not r13d
add r13d, 0x8f011021
xor r13d, 0x9c85c359
rol r13d, 0x9b
popf
pushf
not r13d
add r13d, 0xc492e0ba
xor r13d, 0xad28b56a
rol r13d, 0xf1
popf
xor r13w, r12w
mov word [rbp - 0x16], r13w
mov r13d, 0x324282eb
pushf
not r13d
add r13d, 0xfd178445
xor r13d, 0x8647c1c2
rol r13d, 0xd3
popf
pushf
not r13d
add r13d, 0xabde150b
xor r13d, 0x97e6710f
rol r13d, 0x94
popf
pushf
not r13d
add r13d, 0xcbd569f1
xor r13d, 0x80a25b94
rol r13d, 0x89
popf
xor r13w, r12w
mov word [rbp - 0x14], r13w
movzx r13d, word [rsp + 0x44]
xor r13w, r12w
mov word [rbp - 0x12], r13w
movzx r13d, word [rsp + 0x46]
xor r13w, r12w
mov word [rbp - 0x10], r13w
movzx r13d, word [rsp + 0x48]
xor r13w, r12w
mov word [rbp - 0xe], r13w
movzx r13d, word [rsp + 0x4a]
xor r13w, r12w
mov word [rbp - 0xc], r13w
movzx r13d, word [rsp + 0x4c]
xor r13w, r12w
mov word [rbp - 0xa], r13w
movzx r13d, word [rsp + 0x4e]
xor r13w, r12w
mov word [rbp - 8], r13w
mov r13d, 0x9757afb0
pushf
not r13d
add r13d, 0x89046792
xor r13d, 0xd25864f3
rol r13d, 0xda
popf
pushf
not r13d
add r13d, 0x8b5766dd
xor r13d, 0xb6d877b6
rol r13d, 0x74
popf
pushf
not r13d
add r13d, 0xd0b28005
xor r13d, 0x8e433e9e
rol r13d, 0x3f
popf
xor r13w, r12w
mov word [rbp - 6], r13w
mov r13d, 0x5b7737db
pushf
not r13d
add r13d, 0x877c19ac
xor r13d, 0x8a813483
rol r13d, 0xd3
popf
pushf
not r13d
add r13d, 0xbf7247a3
xor r13d, 0x8ae105d4
rol r13d, 0x73
popf
pushf
not r13d
add r13d, 0xaa2ab9fa
xor r13d, 0x9fd61742
rol r13d, 3
popf
pushf
not r13d
add r13d, 0xeb114417
xor r13d, 0x937249a3
rol r13d, 0x1d
popf
xor r13w, r12w
mov word [rbp - 4], r13w
mov r13d, 0x553acf03
pushf
not r13d
add r13d, 0x9bb55af1
xor r13d, 0xfd017510
rol r13d, 0xbf
popf
pushf
not r13d
add r13d, 0xb09667d4
xor r13d, 0xd2ce2855
rol r13d, 0x32
popf
xor r13w, r12w
mov word [rbp - 2], r13w
movzx r13d, word [rsp + 0x50]
xor r13w, r12w
mov word [rbp], r13w
movzx r13d, word [rsp + 0x52]
xor r13w, r12w
mov word [rbp + 2], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rbp + 4], r13w
movzx r13d, word [rsp + 0x54]
xor r13w, r12w
mov word [rbp + 6], r13w
movzx r13d, word [rsp + 0x56]
xor r13w, r12w
mov word [rbp + 8], r13w
movzx r13d, word [rsp + 0x58]
xor r13w, r12w
mov word [rbp + 0xa], r13w
movzx r13d, word [rsp + 0x5a]
xor r13w, r12w
mov word [rbp + 0xc], r13w
movzx r13d, word [rsp + 0x5c]
xor r13w, r12w
mov word [rbp + 0xe], r13w
movzx r13d, word [rsp + 0x5e]
xor r13w, r12w
movzx r15d, word [rsp + 0x30]
mov word [rbp + 0x10], r13w
movzx r13d, word [rsp + 0x60]
xor r13w, r12w
mov word [rbp + 0x12], r13w
movzx r13d, word [rsp + 0x62]
xor r13w, r12w
mov word [rbp + 0x14], r13w
movzx r13d, word [rsp + 0x64]
xor r13w, r12w
mov word [rbp + 0x16], r13w
movzx r13d, word [rsp + 0x66]
xor r13w, r12w
mov word [rbp + 0x18], r13w
movzx r13d, word [rsp + 0x68]
xor r13w, r12w
mov word [rbp + 0x1a], r13w
movzx r13d, word [rsp + 0x6a]
xor r13w, r12w
mov word [rbp + 0x1c], r13w
movzx r13d, word [rsp + 0x6c]
xor r13w, r12w
mov word [rbp + 0x1e], r13w
movzx r13d, word [rsp + 0x6e]
xor r13w, r12w
mov word [rbp + 0x20], r13w
movzx r13d, word [rsp + 0x70]
xor r13w, r12w
mov word [rbp + 0x22], r13w
movzx r13d, word [rsp + 0x72]
xor r13w, r12w
mov word [rbp + 0x24], r13w
movzx r13d, word [rsp + 0x74]
xor r13w, r12w
mov word [rbp + 0x26], r13w
movzx r13d, word [rsp + 0x76]
xor r13w, r12w
mov word [rbp + 0x28], r13w
movzx r13d, word [rsp + 0x78]
xor r13w, r12w
mov word [rbp + 0x2a], r13w
movzx r13d, word [rsp + 0x7a]
xor r13w, r12w
movzx r12d, word [rsp + 0x7c]
mov word [rbp + 0x2c], r13w
mov r13d, 0xb443db2b
pushf
not r13d
add r13d, 0xbf8dd07d
xor r13d, 0xa86b91fb
rol r13d, 0x25
popf
pushf
not r13d
add r13d, 0xe907c385
xor r13d, 0xa6ac841b
rol r13d, 0x2d
popf
pushf
not r13d
add r13d, 0x8cc7b934
xor r13d, 0xb83ec029
rol r13d, 0x6a
popf
pushf
not r13d
add r13d, 0xe5bbaaf6
xor r13d, 0xb3684a30
rol r13d, 0xc3
popf
xor ax, r13w
xor r8w, r13w
xor dx, r13w
mov word [rbp + 0x46], ax
xor cx, r13w
mov word [rbp + 0x40], r8w
xor eax, eax
mov word [rbp + 0x42], dx
xor r11w, r13w
mov word [rbp + 0x44], cx
xor r10w, r13w
mov word [rbp + 0x48], ax
xor r9w, r13w
mov word [rbp + 0x3a], r11w
xor r12w, r13w
mov word [rbp + 0x3c], r10w
xor r15w, r13w
mov word [rbp + 0x2e], r12w
xor r14w, r13w
mov word [rbp + 0x30], r15w
xor si, r13w
mov word [rbp + 0x32], r14w
xor di, r13w
mov word [rbp + 0x34], si
xor bx, r13w
mov word [rbp + 0x36], di
lea r8, [rbp + 0x68]
mov word [rbp + 0x38], bx
lea rdx, [rbp - 0x3e]
mov word [rbp + 0x3e], r9w
mov rcx, 0xffffffff80000002
jmp 0x14020bc4d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14020bca1
push rax
pushf
mov eax, 0xb6bf43b8
pushf
not eax
add eax, 0xc0143178
xor eax, 0x96499c39
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x89ce7df9
xor eax, 0xff333f42
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xfc0ef472
xor eax, 0xaee6aff3
rol eax, 0x5a
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0xd907358e
pushf
not eax
add eax, 0xa58c4d57
xor eax, 0x9eaf00e1
rol eax, 0xff
popf
pushf
not eax
add eax, 0xbdde2eb0
xor eax, 0xa8d074a0
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xa1dc3cab
xor eax, 0xb2ebe74c
rol eax, 0xb6
popf
jmp 0x14020ac72
mov rax, qword [rbp + 0x58]
cmp qword [rax + 0x18], 8
jb 0x14020bd25
push rax
pushf
mov eax, 0xc6b4d0e9
pushf
not eax
add eax, 0xe0cc2bb9
xor eax, 0xab15ba31
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xd2bbf9ae
xor eax, 0xbbb40465
rol eax, 0x5c
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0x5cc529ca
pushf
not eax
add eax, 0x835cbbeb
xor eax, 0xdd00a8e2
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xe44f1e43
xor eax, 0xf19baa7c
rol eax, 0x48
popf
pushf
not eax
add eax, 0xc3cf4fdf
xor eax, 0x978053c5
rol eax, 0xb0
popf
jmp 0x14020ac72
mov rax, qword [rax]
push rax
pushf
mov eax, 0x9acdf5e3
pushf
not eax
add eax, 0xd0a632ec
xor eax, 0xe4733a12
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xbee77556
xor eax, 0xd3871c5e
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xf416a99a
xor eax, 0xdebb5be5
rol eax, 0x50
popf
pushf
not eax
add eax, 0xf7c275c1
xor eax, 0xb6902d9d
rol eax, 0x11
popf
jmp 0x14020ac72
mov rcx, qword [rbp + 0x68]
lea r8, [rbp + 0x60]
mov rdx, rax
jmp 0x14020bdd3
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14020be16
push rax
pushf
mov eax, 0x880f7128
pushf
not eax
add eax, 0x81615aa4
xor eax, 0x85fdeec3
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xaf256793
xor eax, 0xffc685a0
rol eax, 0xab
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0xdc07af82
pushf
not eax
add eax, 0xab2b5f86
xor eax, 0xa3db7b6c
rol eax, 0x28
popf
pushf
not eax
add eax, 0xe097e892
xor eax, 0xb7fa5d75
rol eax, 0xad
popf
pushf
not eax
add eax, 0xb649a0f0
xor eax, 0xf1bed6e9
rol eax, 0xd3
popf
jmp 0x14020ac72
movzx esi, word [0x1400f1c5e]
lea ebx, [rax + 0x18]
movzx r11d, word [str.Type]
lea r15d, [rax + 0x1c]
movzx r10d, word [0x1400f1c62]
lea r12d, [rax + 0x29]
movzx r9d, word [0x1400f1c64]
lea r13d, [rax + 0xd]
movzx eax, word [0x1400f1c5c]
mov ecx, 0x811c40be
pushf
not ecx
add ecx, 0x8bceb471
xor ecx, 0xb754689b
rol ecx, 0x80
popf
pushf
not ecx
add ecx, 0x97f8372f
xor ecx, 0xeeefa8b2
rol ecx, 0x39
popf
pushf
not ecx
add ecx, 0xec518cdf
xor ecx, 0xa6ea5ee8
rol ecx, 0x75
popf
pushf
not ecx
add ecx, 0xa096e4a2
xor ecx, 0xac2982e8
rol ecx, 0x4f
popf
movzx r8d, word [0x1400f1c66]
xor ax, cx
movzx edx, word [0x1400f1c68]
movzx edi, cx
xor si, cx
mov word [rsp + 0x30], ax
movzx eax, word [0x1400f1c6c]
xor r11w, cx
xor r10w, cx
mov word [rbp - 0x78], cx
xor r9w, cx
xor r8w, cx
xor dx, cx
xor ax, di
movzx ecx, word [0x1400f1c6a]
mov r14d, 0xf7f83b1b
pushf
not r14d
add r14d, 0xb6e392f3
xor r14d, 0xed7811a4
rol r14d, 0xba
popf
pushf
not r14d
add r14d, 0xc5e1157d
xor r14d, 0x92d76502
rol r14d, 0xa4
popf
pushf
not r14d
add r14d, 0xb6ded05b
xor r14d, 0xaaa4a4bf
rol r14d, 0x73
popf
pushf
not r14d
add r14d, 0xd9b7349e
xor r14d, 0xf9d97363
rol r14d, 0xe9
popf
xor r14w, word [rsp + 0x34]
xor cx, di
mov word [rbp - 0x76], r14w
mov r14d, 0xa7284b08
pushf
not r14d
add r14d, 0xf86f2bbb
xor r14d, 0xdde2c082
rol r14d, 0x90
popf
pushf
not r14d
add r14d, 0xb461041b
xor r14d, 0x9430d776
rol r14d, 0x75
popf
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x74], r14w
mov r14d, ebx
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x72], r14w
mov r14d, 0x7a87576
pushf
not r14d
add r14d, 0xb8383467
xor r14d, 0xb74443e8
rol r14d, 0xe
popf
pushf
not r14d
add r14d, 0xeb6324d2
xor r14d, 0xa349a44c
rol r14d, 0x20
popf
pushf
not r14d
add r14d, 0xd0921719
xor r14d, 0x813d9345
rol r14d, 0xbb
popf
xor r14w, word [rsp + 0x34]
mov word [rbp - 0x70], r14w
mov r14d, 0x733f4d13
pushf
not r14d
add r14d, 0xf92a92ec
xor r14d, 0xb04149f5
rol r14d, 0xd8
popf
pushf
not r14d
add r14d, 0xf9afc199
xor r14d, 0xcc88178c
rol r14d, 0x8f
popf
xor bx, r14w
xor cx, r14w
mov word [rbp - 0x6a], bx
xor ax, r14w
xor r15w, r14w
mov word [rbp - 0x54], cx
xor r12w, r14w
mov word [rbp - 0x52], ax
xor r13w, r14w
mov word [rbp - 0x6e], r15w
xor di, r14w
mov word [rbp - 0x6c], r12w
xor si, r14w
mov word [rbp - 0x68], r13w
xor r11w, r14w
mov word [rbp - 0x64], di
xor r10w, r14w
mov word [rbp - 0x60], si
xor r9w, r14w
mov word [rbp - 0x5e], r11w
xor r8w, r14w
mov word [rbp - 0x5c], r10w
xor dx, r14w
mov word [rbp - 0x5a], r9w
mov ebx, 0x156bd0d2
pushf
not ebx
add ebx, 0xf8dd6222
xor ebx, 0xcc860dfa
rol ebx, 0x38
popf
pushf
not ebx
add ebx, 0xbd971e39
xor ebx, 0x918b81e3
rol ebx, 0x23
popf
pushf
not ebx
add ebx, 0x8cf7618f
xor ebx, 0xbfb22592
rol ebx, 0xcb
popf
mov word [rbp - 0x58], r8w
xor bx, r14w
mov word [rbp - 0x56], dx
mov word [rbp - 0x66], bx
lea rcx, [rbp + 0x80]
movzx ebx, word [rsp + 0x30]
mov rax, 0xffffffffffffffff
xor bx, r14w
xor r14d, r14d
mov word [rbp - 0x62], bx
mov word [rbp - 0x50], r14w
nop dword [rax]
push rax
pushf
mov eax, 0x5eb2bfc2
pushf
not eax
add eax, 0xadf21aca
xor eax, 0x860a0649
rol eax, 0x63
popf
pushf
not eax
add eax, 0xe54efaf8
xor eax, 0xe945e7d5
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xa9aac110
xor eax, 0x9039c565
rol eax, 0xe3
popf
jmp 0x14020ac72
cmp word [rcx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x14020c21b
push rax
pushf
mov eax, 0x4201b356
pushf
not eax
add eax, 0xa7720fec
xor eax, 0xe5ec1610
rol eax, 0x20
popf
pushf
not eax
add eax, 0xf6723332
xor eax, 0xbc3a9bf2
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xbff866a4
xor eax, 0xb578a02a
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xa76ee4af
xor eax, 0xf7c621c8
rol eax, 1
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0x12977a40
pushf
not eax
add eax, 0xc2959801
xor eax, 0xa8c52952
rol eax, 0x84
popf
pushf
not eax
add eax, 0xa13a6547
xor eax, 0xb2910251
rol eax, 0x75
popf
pushf
not eax
add eax, 0xa5742af1
xor eax, 0xd68e482d
rol eax, 0x6f
popf
jmp 0x14020ac72
lea ecx, [rax*2 + 2]
mov r9d, 0xa4e74fc3
pushf
not r9d
add r9d, 0xe65bfc93
xor r9d, 0xfeb2a0e6
rol r9d, 0x23
popf
pushf
not r9d
add r9d, 0xb93da186
xor r9d, 0xb30d4038
rol r9d, 0x45
popf
mov dword [rsp + 0x28], ecx
lea rax, [rbp + 0x80]
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x76]
xor r8d, r8d
mov qword [rsp + 0x20], rax
jmp 0x14020c2bc
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x14020c2fb
push rax
pushf
mov eax, 0x9830731b
pushf
not eax
add eax, 0xf7223f0b
xor eax, 0xadcb77b0
rol eax, 0x20
popf
pushf
not eax
add eax, 0xeaee66d9
xor eax, 0xf5f3aa79
rol eax, 0xca
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0x3baf83c9
pushf
not eax
add eax, 0xcc257e91
xor eax, 0xe548e2bd
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xd8ad47bc
xor eax, 0xa0d8a077
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xb803e713
xor eax, 0xe4a1cca4
rol eax, 4
popf
pushf
not eax
add eax, 0xa6acbe57
xor eax, 0xb57ed73e
rol eax, 7
popf
jmp 0x14020ac72
mov rcx, qword [rbp + 0x60]
jmp 0x14020c359
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x68]
jmp 0x14020c364
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14020c5a9
movzx eax, word [0x1400f1c70]
mov esi, 0x7bcb5a94
pushf
not esi
add esi, 0xde05868f
xor esi, 0xef755b99
rol esi, 0x64
popf
pushf
not esi
add esi, 0xdd0e4d3a
xor esi, 0xbdb7b8d3
rol esi, 0x94
popf
pushf
not esi
add esi, 0xf684f793
xor esi, 0xc6892239
rol esi, 0xb
popf
pushf
not esi
add esi, 0x82d46fab
xor esi, 0xfcd69f4c
rol esi, 0xdc
popf
movzx r8d, word [0x1400f1c6c]
xor ax, si
movzx ecx, word [0x1400f1c6e]
xor r8w, si
movzx ebx, word [0x1400f1c6a]
xor cx, si
lea r9d, [rsi + 0x4c]
mov dword [rsp + 0x28], 4
xor r9w, si
mov word [rbp - 0x78], si
mov word [rbp - 0x76], r9w
lea r10d, [rsi + 0x30]
mov r9d, 0x72fd54ea
pushf
not r9d
add r9d, 0xb91b0045
xor r9d, 0xcdc0a5fa
rol r9d, 0xde
popf
pushf
not r9d
add r9d, 0x824c9dd0
xor r9d, 0xe4ec66dd
rol r9d, 0x5b
popf
pushf
not r9d
add r9d, 0x900ff726
xor r9d, 0x91b22d3e
rol r9d, 0x89
popf
mov word [rbp - 0x64], r14w
xor ax, si
lea r11d, [rsi + 0x1d]
xor r9w, si
mov word [rbp - 0x66], ax
xor r8w, si
mov word [rbp - 0x74], r9w
xor cx, si
mov word [rbp - 0x6a], r8w
movzx edx, si
mov word [rbp - 0x68], cx
mov rcx, qword [rbp + 0x60]
lea rax, [rbp + 0x70]
xor dx, si
mov qword [rsp + 0x20], rax
xor r10w, si
mov word [rbp - 0x6e], dx
xor r11w, si
mov word [rbp - 0x72], r10w
xor bx, si
mov word [rbp - 0x70], r11w
xor bx, si
lea r9d, [rsi - 0x2a]
xor r8d, r8d
mov word [rbp - 0x6c], bx
lea rdx, [rbp - 0x76]
jmp 0x14020c4fa
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14020c550
push rax
pushf
mov eax, 0xd6263317
pushf
not eax
add eax, 0xe276064f
xor eax, 0x8c6b6170
rol eax, 0x29
popf
pushf
not eax
add eax, 0xcd42978e
xor eax, 0xb3125af3
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xf62d5d91
xor eax, 0xa3996c0a
rol eax, 0x66
popf
jmp 0x14020ac72
push rax
pushf
mov eax, 0xefa92f2
pushf
not eax
add eax, 0xf8844dc9
xor eax, 0xfea2e52b
rol eax, 0x76
popf
pushf
not eax
add eax, 0xace79dda
xor eax, 0xd140a113
rol eax, 0x63
popf
pushf
not eax
add eax, 0xe85800cc
xor eax, 0xcb4e6f6e
rol eax, 0xac
popf
pushf
not eax
add eax, 0xb037407a
xor eax, 0x8ed453d9
rol eax, 0xac
popf
jmp 0x14020ac72
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.14027ae25
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret