Function at 0x140082920
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r13, rdx
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x34], r15d
mov qword [rbp - 0x60], r15
mov rdx, r8
lea rcx, [rbp - 0x60]
call fcn.14003f460
nop
mov rcx, qword [rbp - 0x60]
movsxd rbx, dword [rcx - 0x10]
test ebx, ebx
js 0x1400831a4
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebx
or eax, edx
jge 0x14008299f
mov edx, ebx
lea rcx, [rbp - 0x60]
call fcn.140005a20
mov rcx, qword [rbp - 0x60]
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.140115da0
mov rax, qword [rbp - 0x60]
cmp ebx, dword [rax - 0xc]
jg 0x1400831a4
mov dword [rax - 0x10], ebx
mov rax, qword [rbp - 0x60]
mov word [rax + rbx*2], r15w
mov byte [rsp + 0x30], 0
mov rax, qword [rbp - 0x60]
mov ebx, dword [rax - 0x10]
test ebx, ebx
je 0x140082a4e
js 0x1400831a4
cmp word [rax], 0x40
jne 0x140082a4e
mov byte [rsp + 0x30], 1
cmp ebx, 1
jl 0x140082a4e
dec ebx
lea edi, [rbx + 1]
cmp dword [rax - 8], 1
jle 0x140082a04
mov edx, dword [rax - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140005760
mov rax, qword [rbp - 0x60]
movsxd r8, edi
add r8, r8
lea rdx, [rax + 2]
je 0x140082a2e
test rax, rax
je 0x140083193
test rdx, rdx
je 0x140083193
mov rcx, rax
call fcn.14012c6c0
mov rax, qword [rbp - 0x60]
test ebx, ebx
js 0x1400831a4
cmp ebx, dword [rax - 0xc]
jg 0x1400831a4
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rbp - 0x60]
mov word [rax + rcx*2], r15w
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x20]
call fcn.14012ce40
mov ecx, 1
call fcn.1400ff088
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x58], r15
lea rcx, [rbp - 0x58]
call fcn.1400055e0
nop
mov r9d, 0x80
lea r8, [rbp - 0x20]
mov rcx, r14
call fcn.140084ac0
mov rdi, 0xffffffffffffffff
cmp al, 1
jne 0x140082cd2
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
call fcn.1401103e4
test eax, eax
jne 0x140082cd2
mov dword [rbp - 0x40], r15d
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.14003f460
mov rbx, rax
mov qword [rsp + 0x58], rax
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14003f4f0
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x38]
call fcn.1400d5330
mov dword [rsp + 0x34], 2
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082b12
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x38]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140082b76
cmp dword [rbx + 0x10], 0
jl 0x140082b61
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x140082b61
call fcn.140041570
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140082b57
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140082b71
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140005a90
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x34], r15d
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082b94
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xe2]
call fcn.14012ce40
mov word [rbp + 0xe0], r15w
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140082c64
mov dword [rbp - 0x30], 0x100
mov dword [rbp - 0x2c], 1
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, str.LastUsedCodeHash
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x70]
test eax, eax
je 0x140082c26
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140082c64
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp - 0x58]
lea rdx, [rbp + 0xe0]
sub rdx, rax
nop word [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140082c57
add rax, 2
test cx, cx
jne 0x140082c40
mov eax, r15d
jmp 0x140082c5c
sbb eax, eax
or eax, 1
test eax, eax
je 0x140082d88
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [r14 + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140082cd2
mov dword [rbp - 0x28], 4
mov dword [rbp - 0x24], 4
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x24]
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x68]
test eax, eax
je 0x140082d78
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.14003f4f0
mov rbx, rax
mov qword [rsp + 0x58], rax
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14003f4f0
mov r8, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x38]
call fcn.1400d5330
mov dword [rsp + 0x34], 1
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082d29
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x40]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140082db7
cmp dword [rbx + 0x10], 0
jl 0x140082da2
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x140082da2
call fcn.140041570
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140082d6e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140082db2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x40], 1
jne 0x140082cd2
mov r8, qword [rbp - 0x60]
mov rdx, r13
mov rcx, r14
call fcn.140083570
mov ebx, eax
mov dword [r14 + 0x18], eax
jmp 0x14008311e
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140005a90
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x34], r15d
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082dd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9, qword [rbp - 0x58]
mov r8, qword [r14 + 0x20]
mov rdx, 0xffffffff80000002
call fcn.140088840
lea r9, [rbp - 0x20]
mov r8, qword [r14 + 0x20]
mov rdx, 0xffffffff80000002
call fcn.140088840
mov r9, qword [rbp - 0x60]
mov r8, qword [r14 + 0x20]
mov rdx, 0xffffffff80000002
call fcn.140088840
mov qword [rbp - 0x48], r15
lea rcx, [rbp - 0x48]
call fcn.1400055e0
nop
lea r9, [rbp - 0x48]
xor r8d, r8d
mov rdx, qword [rbp - 0x60]
mov rcx, r14
call fcn.1400831c0
cmp al, 1
jne 0x1400830fd
mov rsi, qword [rbp - 0x60]
test rsi, rsi
je 0x140082ee2
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140082e50
lea r12, [rbx*2 + 4]
mov rcx, r12
call fcn.1400ff0c4
mov r15, rax
mov ecx, ebx
xor ecx, 0x92781293
mov dword [rax], ecx
mov r8d, 7
xor r9d, r9d
test rbx, rbx
je 0x140082eac
xor edx, edx
nop word [rax + rax]
add r8d, 7
movzx ecx, r8w
xor cx, word [rsi + rdx*2]
mov word [rax + rdx*2 + 4], cx
inc r9d
mov edx, r9d
cmp rdx, rbx
jb 0x140082e90
test r12d, r12d
je 0x140082edf
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
lea r9, str.HardwareConfig
mov r8, qword [r14 + 0x20]
mov rdx, 0xffffffff80000002
call fcn.140088db0
mov edx, 4
mov rcx, r15
call fcn.1400ff054
xor r15d, r15d
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x78]
call fcn.14003f4f0
mov rbx, rax
mov qword [rsp + 0x68], rax
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14003f4f0
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x38]
call fcn.1400d5330
mov dword [rsp + 0x34], 4
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082f39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x48]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140082f9d
cmp dword [rbx + 0x10], 0
jl 0x140082f88
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x140082f88
call fcn.140041570
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140082f7e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rsi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140082f98
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140005a90
mov rax, qword [rsp + 0x48]
lea rdx, [rax - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140082fb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, r13
lea rdx, str.EDDName
mov rcx, qword [r14 + 0x28]
call fcn.140074040
mov r8, qword [rbp - 0x58]
cmp dword [r8 - 8], 1
jle 0x140082fe5
mov edx, dword [r8 - 0x10]
lea rcx, [rbp - 0x58]
call fcn.140005760
mov r8, qword [rbp - 0x58]
lea rdx, str.LastUsedCodeHash
mov rcx, qword [r14 + 0x28]
call fcn.140074040
mov qword [rbp - 0x50], r15
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.14003f4f0
nop
mov rcx, qword [rbp - 0x50]
movsxd rbx, dword [rcx - 0x10]
test ebx, ebx
js 0x1400831af
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, ebx
or eax, edx
jge 0x140083037
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140005a20
mov rcx, qword [rbp - 0x50]
lea eax, [rbx + 1]
movsxd rdx, eax
call fcn.140115da0
mov rax, qword [rbp - 0x50]
cmp ebx, dword [rax - 0xc]
jg 0x1400831af
mov dword [rax - 0x10], ebx
mov rax, qword [rbp - 0x50]
mov word [rax + rbx*2], r15w
mov rcx, qword [rbp - 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140083098
lea rdx, str.trial
call fcn.140100b40
test rax, rax
je 0x140083098
sub rax, qword [rbp - 0x50]
sar rax, 1
cmp eax, 0xffffffff
je 0x140083098
mov r8d, 1
lea rdx, [0x1401457bc]
mov rcx, qword [r14 + 0x28]
call fcn.140073ea0
mov r8, qword [rbp - 0x48]
cmp dword [r8 - 8], 1
jle 0x1400830b4
mov edx, dword [r8 - 0x10]
lea rcx, [rbp - 0x48]
call fcn.140005760
mov r8, qword [rbp - 0x48]
lea rdx, str.ItemName
mov rcx, qword [r14 + 0x28]
call fcn.140074040
cmp byte [rsp + 0x30], 0
je 0x1400830df
mov r8b, 1
lea rdx, [0x140149108]
mov rcx, qword [r14 + 0x28]
call fcn.140073e30
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400830fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008311a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ebx, dword [r14 + 0x18]
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008313c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov edx, 1
mov rcx, qword [rbp - 0x38]
call fcn.1400ff054
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140083167
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1400ff350
mov rbx, qword [rsp + 0x448]
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14010b5c8
nop
mov dword [rax], 0x16
call fcn.14010b428
mov ecx, 0x80070057
call fcn.140002b00
nop
mov ecx, 0x80070057
call fcn.140002b00
int3