Function at 0x140065bf0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4c8]
sub rsp, 0x5a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14017b4c0]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r13, rcx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
mov r8d, 1
lea rdx, [0x14015caa0]
lea rcx, [rbp + 0x50]
call fcn.140005120
nop
mov r8, qword [0x140188988]
lea rcx, [r8 + 0x20]
mov rdx, qword [r8 + 0x10]
mov r10, qword [rcx + 0x10]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, rdx
cmp rax, r10
jb 0x140066441
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140065c8f
mov r9, qword [r8]
cmp qword [rcx + 0x18], 0xf
jbe 0x140065c99
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140012da0
nop
lea r9, [rbp - 0x20]
mov r15, qword [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova r9, r15
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x140065d01
nop word [rax + rax]
movsx rax, byte [r9 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x140065ce0
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
movabs r12, 0x5851f42d4c957f2d
test rax, rax
jne 0x140065d2e
imul r8, r12
inc r8
jmp 0x140065d31
mov r8, rax
mov rax, qword [0x140188988]
sub r8, qword [rax + 0x40]
cmp byte [rax + 0x48], 0
sete al
lea rcx, [0x14015bac4]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 5
mov byte [rbp + 0x10], al
movabs rax, 0x5000000000000000
mov qword [rbp], rax
mov qword [rbp + 0x11], r8
movabs rax, 0x4000000000000001
mov qword [rbp + 8], rax
mov qword [rsp + 0x50], 2
lea rax, [rbp]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000fd40
nop
mov r8, qword [0x140188988]
lea rax, [r8 + 0x20]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
sub rdi, rcx
cmp rdi, rdx
jb 0x140066447
mov r9, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x140065de3
mov r9, qword [r8]
cmp qword [rax + 0x18], 0xf
jbe 0x140065ded
mov rax, qword [rax]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140012da0
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r8, qword [rbp - 0x80]
mov rcx, rbx
mov rdx, rbx
mov r9, qword [rbp - 0x70]
test r9, r9
je 0x140065e51
nop dword [rax + rax]
movsx rax, byte [r8 + rdx]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r9
jb 0x140065e30
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x140065e74
imul r9, r12
inc r9
jmp 0x140065e77
mov r9, rax
lea r10, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 0xf
cmova r10, rsi
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbp - 0x50]
test r8, r8
je 0x140065ec1
nop word [rax + rax]
movsx rax, byte [rdx + r10]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, r8
jb 0x140065ea0
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x140065ee4
imul r8, r12
inc r8
jmp 0x140065ee7
mov r8, rax
imul r8, r9
mov rax, qword [0x140188988]
mov rcx, qword [rax + 0x40]
inc rcx
xor edx, edx
mov rax, r8
div rcx
lea rcx, [0x1401513cc]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x68], rax
movabs rax, 0x4000000000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.14000fd40
lea r8, [rbp - 0x40]
mov r9, qword [rbp - 0x40]
mov r10, qword [rbp - 0x28]
cmp r10, 0xf
cmova r8, r9
mov rcx, rbx
mov rdx, rbx
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x140065fb1
nop dword [rax]
movsx rax, byte [rdx + r8]
add rax, rcx
imul rcx, rax, 0x401
mov rax, rcx
shr rax, 6
xor rcx, rax
inc rdx
cmp rdx, rdi
jb 0x140065f90
lea rax, [rcx + rcx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x140065fd4
imul rdi, r12
inc rdi
jmp 0x140065fd7
mov rdi, rax
mov rax, qword [0x1401888c8]
mov r12, qword [rax + 0x10]
cmp r10, 0xf
jbe 0x140066019
lea rdx, [r10 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x140066011
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006644d
mov rcx, r9
call fcn.1400ce56c
movdqa xmm0, xmmword [0x14015cbe0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
cmp r14, 0xf
jbe 0x140066069
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140066059
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066453
mov rcx, rsi
call fcn.1400ce56c
movdqa xmm0, xmmword [0x14015cbe0]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400660ac
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006609f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066459
call fcn.1400ce56c
movdqa xmm0, xmmword [0x14015cbe0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rax, qword [rbp - 8]
cmp rax, 0xf
jbe 0x1400660f0
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400660e8
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006645f
mov rcx, r15
call fcn.1400ce56c
cmp r12, rdi
jne 0x14006610b
mov r8d, 2
lea rdx, [0x14015ca9c]
lea rcx, [rbp + 0x50]
call fcn.14000b320
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rbp + 0x20]
test eax, eax
jne 0x1400663f5
mov dword [rbp + 0x28], 0x3ff
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.ProductId
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp qword [rbp + 0x60], 2
jb 0x1400661e2
lea rax, [rbp + 0x50]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
cmova rax, rcx
cmp byte [rax + 1], 0x2a
jne 0x1400661e2
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqa xmm6, xmmword [0x14015cbe0]
mov byte [rbp - 0x60], 0
cmp rdx, 0xf
jbe 0x1400661d4
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400661cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066435
call fcn.1400ce56c
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm6
jmp 0x1400661f8
mov r8d, 1
lea rdx, [0x140150d84]
lea rcx, [rbp + 0x50]
call fcn.14000b320
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rbx
lea rax, [rbp + 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140066220
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x30]
call fcn.140005120
lea r15, [rbp + 0x30]
mov rsi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x48]
cmp r14, 0xf
cmova r15, rsi
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x140066274
mov r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov rcx, r15
call fcn.140108460
mov rcx, rax
test rax, rax
je 0x140066274
sub rcx, r15
jmp 0x14006627b
mov rcx, 0xffffffffffffffff
movabs rax, 0x22582572a3abbb9d
imul rcx, rax
mov rax, qword [0x1401888c8]
cmp rcx, qword [rax + 0x18]
je 0x1400662d4
lea rax, [rbp + 0x30]
cmp r14, 0xf
cmova rax, rsi
cmp byte [rax + rdi - 1], 0x30
lea rax, [rbp + 0x30]
jle 0x1400662bb
cmp r14, 0xf
cmova rax, rsi
dec byte [rdi + rax - 1]
jmp 0x1400662c8
cmp r14, 0xf
cmova rax, rsi
add byte [rax + rdi - 1], 4
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
lea rdx, [rbp + 0x30]
cmp r14, 0xf
cmova rdx, rsi
mov rcx, rbx
test rdi, rdi
je 0x140066311
nop dword [rax + rax]
movsx rax, byte [rdx + rcx]
add rax, rbx
imul rbx, rax, 0x401
mov rax, rbx
shr rax, 6
xor rbx, rax
inc rcx
cmp rcx, rdi
jb 0x1400662f0
lea rax, [rbx + rbx*8]
mov rcx, rax
shr rcx, 0xb
xor rcx, rax
imul rax, rcx, 0x8001
test rax, rax
jne 0x14006633e
movabs rax, 0x5851f42d4c957f2d
imul rdi, rax
inc rdi
jmp 0x140066341
mov rdi, rax
mov qword [r13], rdi
mov byte [r13 + 8], 1
cmp r14, 0xf
jbe 0x140066382
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140066379
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066435
mov rcx, rsi
call fcn.1400ce56c
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x1400663bd
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400663b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006643b
call fcn.1400ce56c
mov rax, r13
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1400ce1f0
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov byte [r13 + 8], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x1400663bd
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400663b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006643b
jmp 0x1400663b8
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.140002530
nop
call fcn.140002530
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
nop
call fcn.1400e1a34
int3