Function at 0x140202b70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x238]
sub rsp, 0x338
xor ebx, ebx
mov qword [rcx + 0x18], 7
lea rdx, [0x1404c05ac]
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov r12, rcx
call fcn.14013edcc
mov ecx, ebx
mov dword [rbp - 0x70], 0x580053
mov dword [rbp - 0x6c], 0x570051
mov dword [rbp - 0x68], 0x480041
mov dword [rbp - 0x64], 0x44005a
mov dword [rbp - 0x60], 0x7b007d
mov dword [rbp - 0x5c], 0x6e0078
mov dword [rbp - 0x58], 0x790062
mov dword [rbp - 0x54], 0x60004d
mov dword [rbp - 0x50], 0x65007e
mov dword [rbp - 0x4c], 0x7c0060
mov dword [rbp - 0x48], 0x460078
mov dword [rbp - 0x44], 0x630073
mov dword [rbp - 0x40], 0x4a0044
mov dword [rbp - 0x3c], 0x69007f
mov dword [rbp - 0x38], 0x74006a
mov dword [rbp - 0x34], 0x7a007d
mov dword [rbp - 0x30], 0x7d0053
mov dword [rbp - 0x2c], 0x400076
mov dword [rbp - 0x28], 0x4c0054
mov dword [rbp - 0x24], 0x110056
mov dword [rbp - 0x20], 0x790074
mov dword [rbp - 0x1c], 0x59004b
mov dword [rbp - 0x18], 0x40004d
mov dword [rbp - 0x14], 0x5b004b
mov dword [rbp - 0x10], 0x430055
mov dword [rbp - 0xc], 0x41
nop dword [rax + rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x70], cx
inc ecx
cmp ecx, 0x33
jb 0x140202c70
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x10]
mov word [rbp - 0xa], bx
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x10], rbx
call fcn.14013edcc
cmp qword [rbp + 0x28], 8
lea rax, [rbp - 8]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp - 8], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rdi, rbx
lea rcx, [rbp + 0x10]
test eax, eax
cmove rdi, qword [rbp - 8]
mov qword [rbp], rdi
call fcn.14013ed68
xor eax, eax
mov dword [rsp + 0x50], 0x690044
mov word [rsp + 0x64], ax
mov ecx, ebx
mov dword [rsp + 0x54], 0x730061
mov dword [rsp + 0x58], 0x330072
mov dword [rsp + 0x5c], 0x520042
mov dword [rsp + 0x60], 0x4d0041
nop dword [rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0xa
jb 0x140202d30
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov word [rsp + 0x64], bx
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x70], rbx
call fcn.14013edcc
cmp qword [rbp - 0x78], 8
lea rax, [rbp + 0x288]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
cmovae r8, qword [rsp + 0x70]
mov rcx, rdi
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rbp + 0x288], ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 8]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ecx, dword [rbp + 0x288]
mov r15, rbx
mov qword [rbp + 0x298], rbx
mov r14d, eax
mov esi, ecx
mov r13, rbx
test ecx, ecx
je 0x140202e14
cmp rcx, 0x1000
jb 0x140202dee
add rcx, 0x27
cmp rcx, rsi
jbe 0x140203167
call fcn.1403caaf4
test rax, rax
je 0x14020316d
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140202df6
call fcn.1403caaf4
mov r15, rax
mov r8, rsi
mov qword [rbp + 0x298], r15
xor edx, edx
lea r13, [r15 + rsi]
mov rcx, r15
call fcn.1403ccc50
mov ecx, dword [rbp + 0x288]
test r14d, r14d
jne 0x140202e52
test ecx, ecx
je 0x140202e52
cmp qword [rbp - 0x78], 8
lea rax, [rbp + 0x288]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
cmovae r8, qword [rsp + 0x70]
lea r9d, [r14 + 8]
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.advapi32.dll_RegGetValueW]
lea rcx, [rsp + 0x70]
call fcn.14013ed68
sub r13, r15
je 0x1402030a5
xor eax, eax
mov dword [rsp + 0x50], 0x690044
mov word [rsp + 0x64], ax
mov ecx, ebx
mov dword [rsp + 0x54], 0x730061
mov dword [rsp + 0x58], 0x330072
mov dword [rsp + 0x5c], 0x520042
mov dword [rsp + 0x60], 0x4d0041
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0xa
jb 0x140202ea0
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov word [rsp + 0x64], bx
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x70], rbx
call fcn.14013edcc
cmp qword [rbp - 0x78], 8
lea rax, [rbp + 0x288]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
cmovae r8, qword [rsp + 0x70]
mov rcx, rdi
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rbp + 0x288], ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 8]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ecx, dword [rbp + 0x288]
mov rsi, rbx
mov dword [rbp + 0x290], eax
mov r14d, ecx
mov r12, rbx
test ecx, ecx
je 0x140202f80
cmp rcx, 0x1000
jb 0x140202f5b
add rcx, 0x27
cmp rcx, r14
jbe 0x140203173
call fcn.1403caaf4
test rax, rax
je 0x14020315b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140202f63
call fcn.1403caaf4
mov rsi, rax
mov r8, r14
lea r12, [rsi + r14]
xor edx, edx
mov rcx, rsi
call fcn.1403ccc50
mov ecx, dword [rbp + 0x288]
mov eax, dword [rbp + 0x290]
test eax, eax
jne 0x140202fbd
test ecx, ecx
je 0x140202fbd
cmp qword [rbp - 0x78], 8
lea rax, [rbp + 0x288]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
cmovae r8, qword [rsp + 0x70]
mov rcx, rdi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
lea r9d, [rdx + 8]
call qword [sym.imp.advapi32.dll_RegGetValueW]
lea rcx, [rsp + 0x70]
call fcn.14013ed68
mov r14, rbx
sub r12, rsi
je 0x140203069
mov rdi, qword [rbp + 0x280]
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x1fe
call fcn.1403ccc50
movzx r8d, byte [rsi + r14]
xor eax, eax
mov word [rsp + 0x6e], ax
mov dword [rsp + 0x66], 0x310025
mov dword [rsp + 0x6a], 0x5b0030
nop dword [rax]
movsxd rcx, eax
xor word [rsp + rcx*2 + 0x66], ax
inc eax
cmp eax, 4
jb 0x140203010
lea rdx, [rsp + 0x66]
mov word [rsp + 0x6e], bx
lea rcx, [rbp + 0x30]
call fcn.14013f064
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x140203040
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.14013ec14
inc r14
cmp r14, r12
jb 0x140202fe0
mov rdi, qword [rbp]
mov r15, qword [rbp + 0x298]
test rsi, rsi
je 0x14020309e
cmp r12, 0x1000
jb 0x140203093
mov rcx, qword [rsi - 8]
add r12, 0x27
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x140203161
mov rsi, rcx
mov rdx, r12
mov rcx, rsi
call fcn.1403cad84
mov r12, qword [rbp + 0x280]
mov esi, 0x80000000
test rdi, rdi
je 0x1402030e0
lea rax, [rdi + rsi]
cmp rax, 5
jbe 0x1402030dd
cmp rdi, 0xffffffff80000007
je 0x1402030dd
cmp rdi, 0xffffffff80000060
je 0x1402030dd
cmp rdi, 0xffffffff80000050
je 0x1402030dd
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdi, rbx
test r15, r15
je 0x140203144
cmp r13, 0x1000
jb 0x140203106
mov rcx, qword [r15 - 8]
add r13, 0x27
sub r15, rcx
lea rax, [r15 - 8]
cmp rax, 0x1f
ja 0x140203161
mov r15, rcx
mov rdx, r13
mov rcx, r15
call fcn.1403cad84
test rdi, rdi
je 0x140203144
lea rax, [rdi + rsi]
cmp rax, 5
jbe 0x140203144
cmp rdi, 0xffffffff80000007
je 0x140203144
cmp rdi, 0xffffffff80000060
je 0x140203144
cmp rdi, 0xffffffff80000050
je 0x140203144
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, r12
add rsp, 0x338
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1403d7020
int3
call fcn.1403d7020
int3
call fcn.1401391d8
int3
call fcn.1403d7020
int3
call fcn.1401391d8
int3