Function at 0x140039230
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
xor eax, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov esi, eax
mov edi, 0xeb748313
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x140], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x140039303
mov r9, qword [rsp + 0x148]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x1400392fa
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400392d0
cmp r10d, esi
jne 0x14003946a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140039477
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x14003946a
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x14003946a
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14003939a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140039370
cmp r10d, edi
je 0x1400393ac
test r11d, r11d
jne 0x140039350
mov rax, qword [rax]
jmp 0x140039290
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r15
jbe 0x140039472
lea rax, [r15 + r13]
cmp rdx, rax
jae 0x140039472
mov esi, 0x811c9dc5
mov edi, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x140039419
nop dword [rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x1400393f0
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x140039459
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x140039430
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140039290
xor r14d, r14d
jmp 0x14003947d
xor r14d, r14d
mov edx, r14d
call rdx
mov qword [rsp + 0x140], rax
test rax, rax
je 0x140039707
mov dword [rsp + 0x528], r14d
mov esi, r14d
mov edi, 0x41343800
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x100], xmm0
movd eax, xmm0
sub ax, 8
test esi, esi
je 0x140039531
mov r9, qword [rsp + 0x108]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x140039528
nop word [rax + rax]
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140039500
cmp r10d, esi
jne 0x140039676
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x140039683
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x140039676
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x140039676
mov r12d, dword [r15 + 0x20]
dec r11d
lea rax, [rbx + r11*4]
mov r9d, dword [rax + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400395bc
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140039591
cmp r10d, edi
je 0x1400395ce
test r11d, r11d
jne 0x140039571
mov rcx, qword [rcx]
jmp 0x1400394c0
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x14003967e
lea rax, [r15 + r13]
cmp r8, rax
jae 0x14003967e
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x140039635
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x140039610
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x140039665
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x140039640
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x1400394c0
xor r14d, r14d
jmp 0x140039689
xor r14d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x528]
mov rcx, qword [rsp + 0x140]
call r8
test rax, rax
je 0x140039707
cmp dword [rsp + 0x528], 2
jne 0x140039707
lea r8, [rax + 8]
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x1400396fa
mov rdx, qword [r8]
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400396e0
mov rcx, rax
call fcn.14002b6e0
add qword [rbx + 8], 0x20
jmp 0x14003970f
mov rdx, rax
mov rcx, rbx
call fcn.140055130
jmp 0x14003970f
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003ad46
movabs rbx, 0x54582e3d00efae85
mov qword [rsp + 0x3c0], rbx
movabs rdi, 0xc4de4aa888f26952
mov qword [rsp + 0x3c8], rdi
movabs r12, 0xaa70201f35255727
mov qword [rsp + 0x3d0], r12
movabs r15, 0x9954a0b2b7a291e4
mov qword [rsp + 0x3d8], r15
movabs rax, 0x7c2f57717c010ee9
mov qword [rsp + 0x3e0], rax
movabs r13, 0x36b4522c0bcee346
mov qword [rsp + 0x3e8], r13
movabs rax, 0x5e4953c3c27380cb
mov qword [rsp + 0x3f0], rax
movabs rsi, 0xc841f72639cbb948
mov qword [rsp + 0x3f8], rsi
movabs rax, 0x54082e6100d5aec6
mov qword [rsp + 0x270], rax
movabs rax, 0xc4ac4acf889d6920
mov qword [rsp + 0x278], rax
movabs rax, 0xaa36203f35485746
mov qword [rsp + 0x280], rax
movabs rax, 0x9927a0d7b7ce918d
mov qword [rsp + 0x288], rax
movabs rax, 0x7c1757097c290ec9
mov qword [rsp + 0x290], rax
movabs rax, 0x36e752700be7e370
mov qword [rsp + 0x298], rax
movabs rax, 0x5e2453a2c21680bf
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2a8], rsi
movdqa xmm0, xmmword [rsp + 0x270]
pxor xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [rsp + 0x280]
pxor xmm1, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [rsp + 0x290]
pxor xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [rsp + 0x2a0]
pxor xmm1, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x2a0], xmm1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x270]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400398d0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x48]
call fcn.14002b6e0
nop
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rdi
mov qword [rsp + 0x410], r12
mov qword [rsp + 0x418], r15
movabs rax, 0x7c2f57717c010ee9
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r13
movabs rax, 0x5e4953c3c27380cb
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rsi
movabs rax, 0x22266eb569131e8d
mov qword [rsp + 0x440], rax
movabs r13, 0xaf1a11007cb1027a
mov qword [rsp + 0x448], r13
movabs rcx, 0x540c2e7b00a0aed6
mov qword [rsp + 0x2e0], rcx
movabs rcx, 0xc49b4afa88b36905
mov qword [rsp + 0x2e8], rcx
movabs rcx, 0xaa2720503572577b
mov qword [rsp + 0x2f0], rcx
movabs rcx, 0x9966a081b79691d2
mov qword [rsp + 0x2f8], rcx
movabs rcx, 0x7c4a57157c6e0ea7
mov qword [rsp + 0x300], rcx
movabs rcx, 0x36d8524d0b98e31a
mov qword [rsp + 0x308], rcx
movabs rcx, 0x5e1a539fc21680bd
mov qword [rsp + 0x310], rcx
movabs rcx, 0xc82cf74739aeb93c
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], r13
movdqa xmm0, xmmword [rsp + 0x2e0]
pxor xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x2e0], xmm0
movdqa xmm1, xmmword [rsp + 0x2f0]
pxor xmm1, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmm0, xmmword [rsp + 0x300]
pxor xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [rsp + 0x310]
pxor xmm1, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [rsp + 0x320]
pxor xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
lea rax, [rsp + 0x2e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140039ac1
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1b0]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x538]
call fcn.140037630
nop
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x140039b3c
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039b36
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adba
call fcn.14000d9d0
nop
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r15
movabs rax, 0x542c2e4e0081aecc
mov qword [rsp + 0x200], rax
movabs rax, 0xc48e4ac4889e6933
mov qword [rsp + 0x208], rax
movabs rax, 0xaa70207735515746
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r15
movdqa xmm0, xmmword [rsp + 0x200]
pxor xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [rsp + 0x210]
pxor xmm1, xmmword [rsp + 0x250]
movdqa xmmword [rsp + 0x210], xmm1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039c20
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x538]
call fcn.140037b90
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x140039c9a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039c94
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc0
call fcn.14000d9d0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
mov r8, qword [rsp + 0x230]
test r8, r8
je 0x140039ce3
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14002b6e0
nop
mov rax, qword [rsp + 0x238]
cmp rax, 8
jb 0x140039d27
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039d21
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc6
call fcn.14000d9d0
nop
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r14w
mov rcx, qword [rsp + 0x538]
mov esi, 0x80000000
test rcx, rcx
je 0x140039d81
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x140039d81
cmp rcx, 0xffffffff80000007
je 0x140039d81
cmp rcx, 0xffffffff80000060
je 0x140039d81
cmp rcx, 0xffffffff80000050
je 0x140039d81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r15
movabs rax, 0x7c2f57717c010ee9
mov qword [rsp + 0x470], rax
movabs rax, 0x36b4522c0bcee346
mov qword [rsp + 0x478], rax
movabs rax, 0x5e4953c3c27380cb
mov qword [rsp + 0x480], rax
movabs rax, 0xc841f72639cbb948
mov qword [rsp + 0x488], rax
movabs rax, 0x22266eb569131e8d
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r13
movabs rax, 0x54362e54008daed9
mov qword [rsp + 0x330], rax
movabs rax, 0xc4b84acd8891690e
mov qword [rsp + 0x338], rax
movabs rax, 0xaa16207a3546577b
mov qword [rsp + 0x340], rax
movabs rax, 0x993aa0dbb7d591ca
mov qword [rsp + 0x348], rax
movabs rax, 0x7c1b57477c790ede
mov qword [rsp + 0x350], rax
movabs rax, 0x36d152580bbde31a
mov qword [rsp + 0x358], rax
movabs rax, 0x5e2c53b4c21e80aa
mov qword [rsp + 0x360], rax
movabs rax, 0xc82df74339a3b92a
mov qword [rsp + 0x368], rax
movabs rax, 0x22086ec769761efd
mov qword [rsp + 0x370], rax
movabs rax, 0xaf1a11657cc9021f
mov qword [rsp + 0x378], rax
movdqa xmm0, xmmword [rsp + 0x330]
pxor xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [rsp + 0x340]
pxor xmm1, xmmword [rsp + 0x460]
movdqa xmmword [rsp + 0x340], xmm1
movdqa xmm0, xmmword [rsp + 0x350]
pxor xmm0, xmmword [rsp + 0x470]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [rsp + 0x360]
pxor xmm1, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0x360], xmm1
movdqa xmm0, xmmword [rsp + 0x370]
pxor xmm0, xmmword [rsp + 0x490]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140039f50
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x14003adcc
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x1d0]
call fcn.140058720
mov dword [rsp + 0x40], 3
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140039ff0
movups xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x1d0], r14w
add qword [rcx + 8], 0x20
jmp 0x14003a005
lea r8, [rsp + 0x1d0]
call fcn.14002ffb0
mov rax, qword [rsp + 0x1e8]
cmp rax, 8
jb 0x14003a041
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a03b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003add1
call fcn.14000d9d0
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003a07f
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a079
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003add7
call fcn.14000d9d0
nop
jmp 0x14003a0bb
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r15
movabs rax, 0x7c2f57717c010ee9
mov qword [rsp + 0x180], rax
movabs rax, 0x36b4522c0bcee346
mov qword [rsp + 0x188], rax
movabs rax, 0x5e4953c3c27380cb
mov qword [rsp + 0x190], rax
movabs rax, 0xc841f72639cbb948
mov qword [rsp + 0x198], rax
movabs rax, 0x22266eb569131e8d
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r13
movabs rax, 0x540c2e7b00a0aed6
mov qword [rsp + 0xb0], rax
movabs rax, 0xc49b4afa88b36905
mov qword [rsp + 0xb8], rax
movabs rax, 0xaa1920733566577b
mov qword [rsp + 0xc0], rax
movabs rax, 0x9927a0c6b7cc9181
mov qword [rsp + 0xc8], rax
movabs rax, 0x7c4e57057c520eb5
mov qword [rsp + 0xd0], rax
movabs rax, 0x36d152610bbae334
mov qword [rsp + 0xd8], rax
movabs rax, 0x5e27538ac20680a5
mov qword [rsp + 0xe0], rax
movabs rax, 0xc82ff75439aeb93c
mov qword [rsp + 0xe8], rax
movabs rax, 0x22266eb569671ee8
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r13
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rax, [rsp + 0xb0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a2a2
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140037630
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a31d
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a317
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003addd
call fcn.14000d9d0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x150]
call fcn.140038160
nop
cmp byte [rsp + 0x2c8], 1
jne 0x14003ade3
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x128]
cmp rbx, rdi
je 0x14003a3ca
cmp qword [rbx + 0x10], 0
je 0x14003a3c4
cmp r15, qword [rsp + 0x130]
je 0x14003a3a9
mov rdx, rbx
mov rcx, r15
call fcn.14004fe50
add r15, 0x20
mov qword [rsp + 0x128], r15
add rbx, 0x20
jmp 0x14003a376
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x120]
call fcn.140055400
mov r15, qword [rsp + 0x128]
add rbx, 0x20
jmp 0x14003a376
lea rcx, [rsp + 0x2b0]
call fcn.14004ee40
nop
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14003a411
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x14003a411
cmp rcx, 0xffffffff80000007
je 0x14003a411
cmp rcx, 0xffffffff80000060
je 0x14003a411
cmp rcx, 0xffffffff80000050
je 0x14003a411
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14003a41e
movabs r11, 0x36d152610bbae334
movabs r10, 0x7c4e57057c520eb5
movabs r9, 0x9927a0c6b7cc9181
movabs r8, 0xaa1920733566577b
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x9954a0b2b7a291e4
movabs rdi, 0xc4de4aa888f26952
movabs rsi, 0x54582e3d00efae85
mov r13, qword [rsp + 0x120]
mov r12, r13
cmp r13, r15
je 0x14003ad58
cmp qword [r12 + 0x10], 0
je 0x14003acfc
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
movabs rbx, 0xaa70201f35255727
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rcx
movabs rbx, 0x7c2f57717c010ee9
mov qword [rsp + 0x1f0], rbx
movabs rbx, 0x36b4522c0bcee346
mov qword [rsp + 0x1f8], rbx
movabs rdx, 0x543d2e55009caed9
mov qword [rsp + 0x240], rdx
movabs rdx, 0xc4b14af4889e693e
mov qword [rsp + 0x248], rdx
movabs rdx, 0xaa2c207135405757
mov qword [rsp + 0x250], rdx
movabs rdx, 0x9939a0dfb7cd9187
mov qword [rsp + 0x258], rdx
movabs rdx, 0x7c2f57157c6f0e88
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rbx
movups xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4a0], xmm0
pxor xmm1, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4b0], xmm1
pxor xmm2, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x4c0], xmm2
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
movabs rdi, 0xaa70201f35255727
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], rcx
movabs rcx, 0x7c2f57717c010ee9
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rbx
movabs rcx, 0x5e4953c3c27380cb
mov qword [rsp + 0x190], rcx
movabs rcx, 0xc841f72639cbb948
mov qword [rsp + 0x198], rcx
movabs rcx, 0x22266eb569131e8d
mov qword [rsp + 0x1a0], rcx
movabs rbx, 0xaf1a11007cb1027a
mov qword [rsp + 0x1a8], rbx
movabs rcx, 0x540c2e7b00a0aed6
mov qword [rsp + 0xb0], rcx
movabs rcx, 0xc49b4afa88b36905
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r11
movabs rcx, 0x5e27538ac20680a5
mov qword [rsp + 0xe0], rcx
movabs rcx, 0xc82ff75439aeb93c
mov qword [rsp + 0xe8], rcx
movabs rcx, 0x22266ee969671ee8
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rbx
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
movzx ebx, byte [rsp + 0x520]
mov rdx, qword [r12 + 0x10]
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14003a740
sub rax, rdx
cmp rax, rcx
jb 0x14003ae01
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x14003a766
mov rax, qword [r12]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xb0]
lea rcx, [rsp + 0x100]
call fcn.140058720
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x4a0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003a7a4
mov rcx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14003a81c
lea rsi, [rdx + rcx]
mov qword [rsp + 0x110], rsi
lea rdi, [rsp + 0x100]
cmp r8, 8
cmovae rdi, qword [rsp + 0x100]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x4a0]
call fcn.14007bfe0
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x100]
mov edi, dword [rsp + 0x40]
movabs rsi, 0x54582e3d00efae85
jmp 0x14003a83a
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x4a0]
movzx r8d, bl
lea rcx, [rsp + 0x100]
call fcn.14005f320
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x530]
call fcn.140037630
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a8da
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a8d4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ade9
call fcn.14000d9d0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
mov rax, qword [rsp + 0x118]
cmp rax, 8
jb 0x14003a93b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a935
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adef
call fcn.14000d9d0
nop
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x390], rsi
movabs rdi, 0xc4de4aa888f26952
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rdi
movups xmm0, xmmword [rsp + 0x380]
pxor xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a9d0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x530]
call fcn.140037f30
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x14003aa4a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003aa44
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adf5
call fcn.14000d9d0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
cmp byte [rsp + 0x2d0], 1
jne 0x14003acaa
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.14004fe50
nop
lea rax, [rsp + 0x48]
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp r11, 8
jb 0x14003aaa9
mov r8, rcx
lea rdx, [rcx + r9*2]
lea r10, [rcx + r9*2]
jmp 0x14003aabb
lea r10, [rax + r9*2]
lea rdx, [rsp + 0x48]
lea rdx, [rdx + r9*2]
lea r8, [rsp + 0x48]
cmp r8, rdx
je 0x14003ab09
cmp word [r8], 0x22
je 0x14003aad0
add r8, 2
cmp r8, rdx
jne 0x14003aac0
cmp r8, rdx
je 0x14003ab09
lea rax, [r8 + 2]
cmp rax, rdx
je 0x14003ab09
nop
movzx ecx, word [rax]
cmp cx, 0x22
je 0x14003aaf1
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rdx
jne 0x14003aae0
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
sub r10, r8
sar r10, 1
cmp r11, 8
jb 0x14003ab1f
sub r8, rcx
jmp 0x14003ab27
sub r8, rax
lea rcx, [rsp + 0x48]
sar r8, 1
mov rax, r9
sub rax, r8
cmp rax, r10
cmovb r10, rax
lea rcx, [rcx + r8*2]
sub r9, r10
mov qword [rsp + 0x58], r9
lea rdx, [rcx + r10*2]
sub r9, r8
lea r8, [r9*2 + 2]
call fcn.14007bfe0
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
movabs rax, 0x54342e4d0097aee0
mov qword [rsp + 0x3a0], rax
movabs rax, 0xc4de4acd8880693d
mov qword [rsp + 0x3a8], rax
movups xmm0, xmmword [rsp + 0x3a0]
pxor xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.14004fc90
cmp rax, 0xffffffffffffffff
je 0x14003ac04
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac96
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003abf9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adfb
call fcn.14000d9d0
nop
jmp 0x14003ac96
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14003ac4e
mov qword [rdx], r14
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], r14
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
add qword [rcx + 8], 0x20
jmp 0x14003ac5d
lea r8, [rsp + 0x48]
call fcn.14002ffb0
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac96
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003ac90
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adfb
call fcn.14000d9d0
nop
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x2b0]
call fcn.14004eec0
nop
mov rcx, qword [rsp + 0x530]
test rcx, rcx
je 0x14003acfc
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x14003acf4
cmp rcx, 0xffffffff80000007
je 0x14003acf4
cmp rcx, 0xffffffff80000060
je 0x14003acf4
cmp rcx, 0xffffffff80000050
je 0x14003acf4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x530], r14
add r12, 0x20
cmp r12, r15
je 0x14003ad58
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x9954a0b2b7a291e4
movabs r8, 0xaa1920733566577b
movabs r9, 0x9927a0c6b7cc9181
movabs r10, 0x7c4e57057c520eb5
movabs r11, 0x36d152610bbae334
jmp 0x14003a482
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x120]
jmp 0x14003ad60
mov rbx, qword [rsp + 0x520]
test r13, r13
je 0x14003ada4
mov rdx, r15
mov rcx, r13
call fcn.140030250
mov rax, qword [rsp + 0x130]
sub rax, r13
and rax, 0xffffffffffffffe0
mov rcx, r13
cmp rax, 0x1000
jb 0x14003ad9b
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ae07
mov rcx, r13
call fcn.14000d9d0
nop
mov rax, rbx
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400804f4
nop
call fcn.1400804f4
nop
call fcn.1400804f4
nop
call fcn.14002ac40
call fcn.1400804f4
nop
call fcn.1400804f4
nop
call fcn.1400804f4
nop
call fcn.1400375a0
nop
call fcn.1400804f4
nop
call fcn.1400804f4
nop
call fcn.1400804f4
int3
call fcn.1400804f4
nop
call fcn.14002ac40
nop
call fcn.1400804f4
int3