Function at 0x140039090
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
xor eax, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov esi, eax
mov edi, 0xeb748313
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x140], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x140039163
mov r9, qword [rsp + 0x148]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x14003915a
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140039130
cmp r10d, esi
jne 0x1400392ca
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x1400392d7
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x1400392ca
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x1400392ca
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x1400391fa
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x1400391d0
cmp r10d, edi
je 0x14003920c
test r11d, r11d
jne 0x1400391b0
mov rax, qword [rax]
jmp 0x1400390f0
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r15
jbe 0x1400392d2
lea rax, [r15 + r13]
cmp rdx, rax
jae 0x1400392d2
mov esi, 0x811c9dc5
mov edi, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x140039279
nop dword [rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x140039250
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x1400392b9
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x140039290
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x1400390f0
xor r14d, r14d
jmp 0x1400392dd
xor r14d, r14d
mov edx, r14d
call rdx
mov qword [rsp + 0x140], rax
test rax, rax
je 0x140039567
mov dword [rsp + 0x528], r14d
mov esi, r14d
mov edi, 0x41343800
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x100], xmm0
movd eax, xmm0
sub ax, 8
test esi, esi
je 0x140039391
mov r9, qword [rsp + 0x108]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x140039388
nop word [rax + rax]
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140039360
cmp r10d, esi
jne 0x1400394d6
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x1400394e3
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x1400394d6
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x1400394d6
mov r12d, dword [r15 + 0x20]
dec r11d
lea rax, [rbx + r11*4]
mov r9d, dword [rax + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x14003941c
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400393f1
cmp r10d, edi
je 0x14003942e
test r11d, r11d
jne 0x1400393d1
mov rcx, qword [rcx]
jmp 0x140039320
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x1400394de
lea rax, [r15 + r13]
cmp r8, rax
jae 0x1400394de
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x140039495
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x140039470
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x1400394c5
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x1400394a0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x140039320
xor r14d, r14d
jmp 0x1400394e9
xor r14d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x528]
mov rcx, qword [rsp + 0x140]
call r8
test rax, rax
je 0x140039567
cmp dword [rsp + 0x528], 2
jne 0x140039567
lea r8, [rax + 8]
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x14003955a
mov rdx, qword [r8]
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140039540
mov rcx, rax
call fcn.14002b540
add qword [rbx + 8], 0x20
jmp 0x14003956f
mov rdx, rax
mov rcx, rbx
call fcn.140054620
jmp 0x14003956f
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003aba6
movabs rbx, 0x51dc3191e737b52d
mov qword [rsp + 0x3c0], rbx
movabs rdi, 0x3b1b0550f00f3046
mov qword [rsp + 0x3c8], rdi
movabs r12, 0x3dfb04bf43d645e7
mov qword [rsp + 0x3d0], r12
movabs r15, 0x503b9d8ee028f988
mov qword [rsp + 0x3d8], r15
movabs rax, 0x626e6b951e34e101
mov qword [rsp + 0x3e0], rax
movabs r13, 0xf620bac4b9f8ae3a
mov qword [rsp + 0x3e8], r13
movabs rax, 0x7d290e0310035ecb
mov qword [rsp + 0x3f0], rax
movabs rsi, 0xab7cc9f2dd21679c
mov qword [rsp + 0x3f8], rsi
movabs rax, 0x518c31cde70db56e
mov qword [rsp + 0x270], rax
movabs rax, 0x3b690537f0603034
mov qword [rsp + 0x278], rax
movabs rax, 0x3dbd049f43bb4586
mov qword [rsp + 0x280], rax
movabs rax, 0x50489debe044f9e1
mov qword [rsp + 0x288], rax
movabs rax, 0x62566bed1e1ce121
mov qword [rsp + 0x290], rax
movabs rax, 0xf673ba98b9d1ae0c
mov qword [rsp + 0x298], rax
movabs rax, 0x7d440e6210665ebf
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2a8], rsi
movdqa xmm0, xmmword [rsp + 0x270]
pxor xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [rsp + 0x280]
pxor xmm1, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [rsp + 0x290]
pxor xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [rsp + 0x2a0]
pxor xmm1, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x2a0], xmm1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x270]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039730
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x48]
call fcn.14002b540
nop
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rdi
mov qword [rsp + 0x410], r12
mov qword [rsp + 0x418], r15
movabs rax, 0x626e6b951e34e101
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r13
movabs rax, 0x7d290e0310035ecb
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rsi
movabs rax, 0x3a02a2e97078d7f5
mov qword [rsp + 0x440], rax
movabs r13, 0x57ec36484da95f0e
mov qword [rsp + 0x448], r13
movabs rcx, 0x518831d7e778b57e
mov qword [rsp + 0x2e0], rcx
movabs rcx, 0x3b5e0502f04e3011
mov qword [rsp + 0x2e8], rcx
movabs rcx, 0x3dac04f0438145bb
mov qword [rsp + 0x2f0], rcx
movabs rcx, 0x50099dbde01cf9be
mov qword [rsp + 0x2f8], rcx
movabs rcx, 0x620b6bf11e5be14f
mov qword [rsp + 0x300], rcx
movabs rcx, 0xf64cbaa5b9aeae66
mov qword [rsp + 0x308], rcx
movabs rcx, 0x7d7a0e5f10665ebd
mov qword [rsp + 0x310], rcx
movabs rcx, 0xab11c993dd4467e8
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], r13
movdqa xmm0, xmmword [rsp + 0x2e0]
pxor xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x2e0], xmm0
movdqa xmm1, xmmword [rsp + 0x2f0]
pxor xmm1, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmm0, xmmword [rsp + 0x300]
pxor xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [rsp + 0x310]
pxor xmm1, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [rsp + 0x320]
pxor xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
lea rax, [rsp + 0x2e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140039921
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1b0]
call fcn.14002b540
nop
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x538]
call fcn.140037490
nop
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x14003999c
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039996
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac1a
call fcn.14000d830
nop
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r15
movabs rax, 0x51a831e2e759b564
mov qword [rsp + 0x200], rax
movabs rax, 0x3b4b053cf0633027
mov qword [rsp + 0x208], rax
movabs rax, 0x3dfb04d743a24586
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r15
movdqa xmm0, xmmword [rsp + 0x200]
pxor xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [rsp + 0x210]
pxor xmm1, xmmword [rsp + 0x250]
movdqa xmmword [rsp + 0x210], xmm1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039a80
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14002b540
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x538]
call fcn.1400379f0
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x140039afa
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039af4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac20
call fcn.14000d830
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
mov r8, qword [rsp + 0x230]
test r8, r8
je 0x140039b43
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14002b540
nop
mov rax, qword [rsp + 0x238]
cmp rax, 8
jb 0x140039b87
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039b81
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac26
call fcn.14000d830
nop
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r14w
mov rcx, qword [rsp + 0x538]
mov esi, 0x80000000
test rcx, rcx
je 0x140039be1
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x140039be1
cmp rcx, 0xffffffff80000007
je 0x140039be1
cmp rcx, 0xffffffff80000060
je 0x140039be1
cmp rcx, 0xffffffff80000050
je 0x140039be1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r15
movabs rax, 0x626e6b951e34e101
mov qword [rsp + 0x470], rax
movabs rax, 0xf620bac4b9f8ae3a
mov qword [rsp + 0x478], rax
movabs rax, 0x7d290e0310035ecb
mov qword [rsp + 0x480], rax
movabs rax, 0xab7cc9f2dd21679c
mov qword [rsp + 0x488], rax
movabs rax, 0x3a02a2e97078d7f5
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r13
movabs rax, 0x51b231f8e755b571
mov qword [rsp + 0x330], rax
movabs rax, 0x3b7d0535f06c301a
mov qword [rsp + 0x338], rax
movabs rax, 0x3d9d04da43b545bb
mov qword [rsp + 0x340], rax
movabs rax, 0x50559de7e05ff9a6
mov qword [rsp + 0x348], rax
movabs rax, 0x625a6ba31e4ce136
mov qword [rsp + 0x350], rax
movabs rax, 0xf645bab0b98bae66
mov qword [rsp + 0x358], rax
movabs rax, 0x7d4c0e74106e5eaa
mov qword [rsp + 0x360], rax
movabs rax, 0xab10c997dd4967fe
mov qword [rsp + 0x368], rax
movabs rax, 0x3a2ca29b701dd785
mov qword [rsp + 0x370], rax
movabs rax, 0x57ec362d4dd15f6b
mov qword [rsp + 0x378], rax
movdqa xmm0, xmmword [rsp + 0x330]
pxor xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [rsp + 0x340]
pxor xmm1, xmmword [rsp + 0x460]
movdqa xmmword [rsp + 0x340], xmm1
movdqa xmm0, xmmword [rsp + 0x350]
pxor xmm0, xmmword [rsp + 0x470]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [rsp + 0x360]
pxor xmm1, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0x360], xmm1
movdqa xmm0, xmmword [rsp + 0x370]
pxor xmm0, xmmword [rsp + 0x490]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140039db0
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x14003ac2c
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x1d0]
call fcn.1400577e0
mov dword [rsp + 0x40], 3
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140039e50
movups xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x1d0], r14w
add qword [rcx + 8], 0x20
jmp 0x140039e65
lea r8, [rsp + 0x1d0]
call fcn.14002fe10
mov rax, qword [rsp + 0x1e8]
cmp rax, 8
jb 0x140039ea1
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039e9b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac31
call fcn.14000d830
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x140039edf
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039ed9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac37
call fcn.14000d830
nop
jmp 0x140039f1b
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r15
movabs rax, 0x626e6b951e34e101
mov qword [rsp + 0x180], rax
movabs rax, 0xf620bac4b9f8ae3a
mov qword [rsp + 0x188], rax
movabs rax, 0x7d290e0310035ecb
mov qword [rsp + 0x190], rax
movabs rax, 0xab7cc9f2dd21679c
mov qword [rsp + 0x198], rax
movabs rax, 0x3a02a2e97078d7f5
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r13
movabs rax, 0x518831d7e778b57e
mov qword [rsp + 0xb0], rax
movabs rax, 0x3b5e0502f04e3011
mov qword [rsp + 0xb8], rax
movabs rax, 0x3d9204d3439545bb
mov qword [rsp + 0xc0], rax
movabs rax, 0x50489dfae046f9ed
mov qword [rsp + 0xc8], rax
movabs rax, 0x620f6be11e67e15d
mov qword [rsp + 0xd0], rax
movabs rax, 0xf645ba89b98cae48
mov qword [rsp + 0xd8], rax
movabs rax, 0x7d470e4a10765ea5
mov qword [rsp + 0xe0], rax
movabs rax, 0xab12c980dd4467e8
mov qword [rsp + 0xe8], rax
movabs rax, 0x3a02a2e9700cd790
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r13
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rax, [rsp + 0xb0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a102
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.14002b540
nop
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140037490
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a17d
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a177
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac3d
call fcn.14000d830
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x150]
call fcn.140037fc0
nop
cmp byte [rsp + 0x2c8], 1
jne 0x14003ac43
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x128]
cmp rbx, rdi
je 0x14003a22a
cmp qword [rbx + 0x10], 0
je 0x14003a224
cmp r15, qword [rsp + 0x130]
je 0x14003a209
mov rdx, rbx
mov rcx, r15
call fcn.14004f3e0
add r15, 0x20
mov qword [rsp + 0x128], r15
add rbx, 0x20
jmp 0x14003a1d6
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x120]
call fcn.1400548f0
mov r15, qword [rsp + 0x128]
add rbx, 0x20
jmp 0x14003a1d6
lea rcx, [rsp + 0x2b0]
call fcn.14004e3d0
nop
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14003a271
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x14003a271
cmp rcx, 0xffffffff80000007
je 0x14003a271
cmp rcx, 0xffffffff80000060
je 0x14003a271
cmp rcx, 0xffffffff80000050
je 0x14003a271
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14003a27e
movabs r11, 0xf645ba89b98cae48
movabs r10, 0x620f6be11e67e15d
movabs r9, 0x50489dfae046f9ed
movabs r8, 0x3d9204d3439545bb
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x503b9d8ee028f988
movabs rdi, 0x3b1b0550f00f3046
movabs rsi, 0x51dc3191e737b52d
mov r13, qword [rsp + 0x120]
mov r12, r13
cmp r13, r15
je 0x14003abb8
cmp qword [r12 + 0x10], 0
je 0x14003ab5c
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
movabs rbx, 0x3dfb04bf43d645e7
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rcx
movabs rbx, 0x626e6b951e34e101
mov qword [rsp + 0x1f0], rbx
movabs rbx, 0xf620bac4b9f8ae3a
mov qword [rsp + 0x1f8], rbx
movabs rdx, 0x51b931f9e744b571
mov qword [rsp + 0x240], rdx
movabs rdx, 0x3b74050cf063302a
mov qword [rsp + 0x248], rdx
movabs rdx, 0x3da704d143b34597
mov qword [rsp + 0x250], rdx
movabs rdx, 0x50569de3e047f9eb
mov qword [rsp + 0x258], rdx
movabs rdx, 0x626e6bf11e5ae160
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rbx
movups xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4a0], xmm0
pxor xmm1, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4b0], xmm1
pxor xmm2, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x4c0], xmm2
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
movabs rdi, 0x3dfb04bf43d645e7
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], rcx
movabs rcx, 0x626e6b951e34e101
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rbx
movabs rcx, 0x7d290e0310035ecb
mov qword [rsp + 0x190], rcx
movabs rcx, 0xab7cc9f2dd21679c
mov qword [rsp + 0x198], rcx
movabs rcx, 0x3a02a2e97078d7f5
mov qword [rsp + 0x1a0], rcx
movabs rbx, 0x57ec36484da95f0e
mov qword [rsp + 0x1a8], rbx
movabs rcx, 0x518831d7e778b57e
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x3b5e0502f04e3011
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r11
movabs rcx, 0x7d470e4a10765ea5
mov qword [rsp + 0xe0], rcx
movabs rcx, 0xab12c980dd4467e8
mov qword [rsp + 0xe8], rcx
movabs rcx, 0x3a02a2b5700cd790
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rbx
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
movzx ebx, byte [rsp + 0x520]
mov rdx, qword [r12 + 0x10]
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14003a5a0
sub rax, rdx
cmp rax, rcx
jb 0x14003ac61
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x14003a5c6
mov rax, qword [r12]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xb0]
lea rcx, [rsp + 0x100]
call fcn.1400577e0
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x4a0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003a604
mov rcx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14003a67c
lea rsi, [rdx + rcx]
mov qword [rsp + 0x110], rsi
lea rdi, [rsp + 0x100]
cmp r8, 8
cmovae rdi, qword [rsp + 0x100]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x4a0]
call fcn.14007b0c0
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x100]
mov edi, dword [rsp + 0x40]
movabs rsi, 0x51dc3191e737b52d
jmp 0x14003a69a
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x4a0]
movzx r8d, bl
lea rcx, [rsp + 0x100]
call fcn.14005e470
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x530]
call fcn.140037490
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a73a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a734
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac49
call fcn.14000d830
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
mov rax, qword [rsp + 0x118]
cmp rax, 8
jb 0x14003a79b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a795
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac4f
call fcn.14000d830
nop
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x390], rsi
movabs rdi, 0x3b1b0550f00f3046
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rdi
movups xmm0, xmmword [rsp + 0x380]
pxor xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a830
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.14002b540
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x530]
call fcn.140037d90
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x14003a8aa
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a8a4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac55
call fcn.14000d830
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
cmp byte [rsp + 0x2d0], 1
jne 0x14003ab0a
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.14004f3e0
nop
lea rax, [rsp + 0x48]
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp r11, 8
jb 0x14003a909
mov r8, rcx
lea rdx, [rcx + r9*2]
lea r10, [rcx + r9*2]
jmp 0x14003a91b
lea r10, [rax + r9*2]
lea rdx, [rsp + 0x48]
lea rdx, [rdx + r9*2]
lea r8, [rsp + 0x48]
cmp r8, rdx
je 0x14003a969
cmp word [r8], 0x22
je 0x14003a930
add r8, 2
cmp r8, rdx
jne 0x14003a920
cmp r8, rdx
je 0x14003a969
lea rax, [r8 + 2]
cmp rax, rdx
je 0x14003a969
nop
movzx ecx, word [rax]
cmp cx, 0x22
je 0x14003a951
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rdx
jne 0x14003a940
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
sub r10, r8
sar r10, 1
cmp r11, 8
jb 0x14003a97f
sub r8, rcx
jmp 0x14003a987
sub r8, rax
lea rcx, [rsp + 0x48]
sar r8, 1
mov rax, r9
sub rax, r8
cmp rax, r10
cmovb r10, rax
lea rcx, [rcx + r8*2]
sub r9, r10
mov qword [rsp + 0x58], r9
lea rdx, [rcx + r10*2]
sub r9, r8
lea r8, [r9*2 + 2]
call fcn.14007b0c0
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
movabs rax, 0x51b031e1e74fb548
mov qword [rsp + 0x3a0], rax
movabs rax, 0x3b1b0535f07d3029
mov qword [rsp + 0x3a8], rax
movups xmm0, xmmword [rsp + 0x3a0]
pxor xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.14004f220
cmp rax, 0xffffffffffffffff
je 0x14003aa64
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003aaf6
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003aa59
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac5b
call fcn.14000d830
nop
jmp 0x14003aaf6
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14003aaae
mov qword [rdx], r14
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], r14
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
add qword [rcx + 8], 0x20
jmp 0x14003aabd
lea r8, [rsp + 0x48]
call fcn.14002fe10
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003aaf6
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003aaf0
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ac5b
call fcn.14000d830
nop
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x2b0]
call fcn.14004e450
nop
mov rcx, qword [rsp + 0x530]
test rcx, rcx
je 0x14003ab5c
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x14003ab54
cmp rcx, 0xffffffff80000007
je 0x14003ab54
cmp rcx, 0xffffffff80000060
je 0x14003ab54
cmp rcx, 0xffffffff80000050
je 0x14003ab54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x530], r14
add r12, 0x20
cmp r12, r15
je 0x14003abb8
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x503b9d8ee028f988
movabs r8, 0x3d9204d3439545bb
movabs r9, 0x50489dfae046f9ed
movabs r10, 0x620f6be11e67e15d
movabs r11, 0xf645ba89b98cae48
jmp 0x14003a2e2
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x120]
jmp 0x14003abc0
mov rbx, qword [rsp + 0x520]
test r13, r13
je 0x14003ac04
mov rdx, r15
mov rcx, r13
call fcn.1400300b0
mov rax, qword [rsp + 0x130]
sub rax, r13
and rax, 0xffffffffffffffe0
mov rcx, r13
cmp rax, 0x1000
jb 0x14003abfb
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ac67
mov rcx, r13
call fcn.14000d830
nop
mov rax, rbx
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14007f5d4
nop
call fcn.14007f5d4
nop
call fcn.14007f5d4
nop
call fcn.14002aaa0
call fcn.14007f5d4
nop
call fcn.14007f5d4
nop
call fcn.14007f5d4
nop
call fcn.140037400
nop
call fcn.14007f5d4
nop
call fcn.14007f5d4
nop
call fcn.14007f5d4
int3
call fcn.14007f5d4
nop
call fcn.14002aaa0
nop
call fcn.14007f5d4
int3