Function at 0x14002c9b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1800]
mov eax, 0x1900
call fcn.1400549d0
sub rsp, rax
mov eax, dword [0x14009b2d8]
xor r15d, r15d
mov qword [rsp + 0x60], r15
xorps xmm0, xmm0
mov qword [rbp + 0x1858], r15
mov r14, rcx
mov dword [rsp + 0x70], 0x460074
mov dword [rsp + 0x74], 0x8b007f
mov dword [rsp + 0x78], 0xa20038
mov dword [rsp + 0x7c], 0xd8006d
mov dword [rbp - 0x80], 0x44007b
mov dword [rbp - 0x7c], 0xbc0050
mov dword [rbp - 0x78], 0x8c001d
mov dword [rbp - 0x74], 0xf2004c
mov dword [rbp - 0x70], 0x7d0041
mov dword [rbp - 0x6c], 0x880065
mov dword [rbp - 0x68], 0x8d0006
mov dword [rbp - 0x64], 0xf2005b
mov dword [rbp - 0x60], 0x7a0050
mov dword [rbp - 0x5c], 0x9c0065
mov dword [rbp - 0x58], 0x91001a
mov dword [rbp - 0x54], 0xf8004d
mov dword [rbp - 0x50], 0x7d0049
mov dword [rbp - 0x4c], 0xba006f
mov dword [rbp - 0x48], 0x90001d
mov dword [rbp - 0x44], 0xf20056
mov dword [rbp - 0x40], 0x550049
mov dword [rbp - 0x3c], 0xb1006c
mov dword [rbp - 0x38], 0x8d0006
mov dword [rbp - 0x34], 0xe9004c
mov dword [rbp - 0x30], 0x650046
mov dword [rbp - 0x2c], 0xdf0055
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
test al, 1
jne 0x14002cb2c
movaps xmm0, xmmword [rsp + 0x70]
lea rcx, [0x14007ee18]
movaps xmm1, xmmword [rbp - 0x80]
or eax, 1
movaps xmmword [0x14009b2e0], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movaps xmmword [0x14009b300], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movaps xmmword [0x14009b2f0], xmm1
movaps xmm1, xmmword [rbp - 0x60]
movaps xmmword [0x14009b320], xmm0
movsd xmm0, qword [rbp - 0x30]
movaps xmmword [0x14009b310], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movsd qword [0x14009b340], xmm0
mov dword [0x14009b2d8], eax
mov byte [0x14009b348], 1
movaps xmmword [0x14009b330], xmm1
call fcn.140054418
cmp byte [0x14009b348], r15b
lea rbx, [0x14009b2e0]
mov r9d, 0xff
je 0x14002cb74
mov r8, r15
mov cl, r8b
movabs rdx, 0x9d3fe36fdf390927
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r9w
xor word [rbx + r8*2], dx
inc r8
cmp r8, 0x34
jb 0x14002cb45
mov byte [0x14009b348], r15b
mov r12d, 0xf
mov dword [rbp + 0x1850], 0xf003f
xorps xmm0, xmm0
mov qword [rsp + 0x50], 0xd
lea rdx, str.RegOpenKeyExW
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x40]
lea r8d, [r12 - 2]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4d], r15b
call fcn.14002d240
lea rcx, [rsp + 0x60]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rbx
call rax
mov rdx, qword [rsp + 0x58]
mov edi, 0x1000
cmp rdx, r12
jbe 0x14002cc1b
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002cc16
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d21b
call fcn.140054430
mov ebx, r15d
xorps xmm0, xmm0
mov dword [rbp + 0x1840], 0x800
mov r8d, 0xd
mov qword [rsp + 0x50], 0xd
lea rdx, str.RegEnumKeyExW
mov qword [rsp + 0x58], r12
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4d], r15b
call fcn.14002d240
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0x1840]
mov qword [rsp + 0x38], r15
lea r8, [rbp + 0x800]
mov qword [rsp + 0x30], r15
mov edx, ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call rax
mov rdx, qword [rsp + 0x58]
mov esi, eax
cmp rdx, r12
jbe 0x14002ccc9
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002ccc4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d227
call fcn.140054430
test esi, esi
jne 0x14002d17b
lea rax, [rbp + 0x800]
mov edx, 0x400
lea r9, [0x14009b2e0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x1000]
call fcn.14002c790
xorps xmm0, xmm0
mov qword [rsp + 0x58], r12
lea r8d, [rsi + 0xd]
lea rdx, str.RegOpenKeyExW
mov qword [rsp + 0x50], r8
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4d], r15b
call fcn.14002d240
lea rcx, [rbp + 0x1858]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x1000]
mov rcx, 0xffffffff80000002
xor r8d, r8d
call rax
mov rdx, qword [rsp + 0x58]
mov edi, eax
cmp rdx, r12
jbe 0x14002cd95
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cd90
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d22d
call fcn.140054430
xorps xmm0, xmm0
test edi, edi
je 0x14002ce98
mov esi, 0xb
mov qword [rsp + 0x58], r12
mov r8d, esi
mov qword [rsp + 0x50], rsi
lea rdx, str.RegCloseKey
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4b], r15b
call fcn.14002d240
mov rcx, qword [rbp + 0x1858]
call rax
mov rdx, qword [rsp + 0x58]
mov edi, 0x1000
cmp rdx, r12
jbe 0x14002ce1d
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002ce18
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d233
call fcn.140054430
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
mov r8, rsi
mov qword [rsp + 0x58], r12
lea rdx, str.RegCloseKey
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4b], r15b
call fcn.14002d240
mov rcx, qword [rsp + 0x60]
call rax
mov rdx, qword [rsp + 0x58]
cmp rdx, r12
jbe 0x14002ce91
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002ce8c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d239
call fcn.140054430
inc ebx
jmp 0x14002cc1e
mov r8d, 0x10
mov dword [rbp + 0x1840], 0x800
lea rdx, str.RegQueryValueExW
mov qword [rbp - 0x10], r15
lea rcx, [rbp - 0x20]
mov qword [rbp - 8], r15
movups xmmword [rbp - 0x20], xmm0
call fcn.14000a604
lea rcx, [rbp - 0x20]
call fcn.14002d240
mov rdi, rax
mov dword [rsp + 0x40], 0xac00e7
mov eax, dword [0x14009b360]
mov dword [rsp + 0x44], 0x900fe
mov dword [rsp + 0x48], 0x3c0091
mov dword [rsp + 0x4c], 0xdb004c
mov dword [rsp + 0x50], 0xa800c2
mov dword [rsp + 0x54], 0x7900e8
test al, 1
jne 0x14002cf40
movups xmm0, xmmword [rsp + 0x40]
lea rcx, [0x14007edf8]
or eax, 1
movsd xmm1, qword [rsp + 0x50]
movaps xmmword [0x14009b370], xmm0
mov dword [0x14009b360], eax
mov byte [0x14009b388], 1
movsd qword [0x14009b380], xmm1
call fcn.140054418
cmp byte [0x14009b388], r15b
je 0x14002cf8f
mov r8, r15
mov r12d, 0xff
lea r15, [0x14009b370]
mov cl, r8b
movabs rdx, 0x95355dfd798dc5a3
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r12w
xor word [r15 + r8*2], dx
inc r8
cmp r8, 0xc
jb 0x14002cf59
xor r15d, r15d
mov byte [0x14009b388], r15b
lea r12d, [r15 + 0xf]
mov rcx, qword [rbp + 0x1858]
lea rax, [rbp + 0x1840]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1850]
lea rax, [rbp]
xor r8d, r8d
lea rdx, [0x14009b370]
mov qword [rsp + 0x20], rax
call rdi
mov rdx, qword [rbp - 8]
mov edi, eax
cmp rdx, r12
jbe 0x14002cffa
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cff5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d20f
call fcn.140054430
test edi, edi
jne 0x14002d0f7
mov eax, dword [0x14009b354]
mov dword [rbp + 0x1848], 0xe700d5
test al, 1
jne 0x14002d03e
or eax, 1
mov byte [0x14009b350], 1
mov dword [0x14009b354], eax
lea rcx, [0x14007edec]
mov eax, dword [rbp + 0x1848]
mov dword [0x14009b34c], eax
call fcn.140054418
cmp byte [0x14009b350], r15b
lea rdi, [0x14009b34c]
je 0x14002d08c
mov r8, r15
mov r12d, 0xff
mov cl, r8b
movabs rdx, 0x7393dc74711e7eb
and cl, 7
shl cl, 3
shr rdx, cl
and dx, r12w
xor word [rdi + r8*2], dx
inc r8
cmp r8, 2
jb 0x14002d057
mov r12d, 0xf
mov byte [0x14009b350], r15b
xorps xmm0, xmm0
mov qword [rbp - 0x10], r15
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], r15
lea rax, [rbp]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14002d0a3
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.140007b80
mov r8, rdi
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14002053c
cmp qword [rax + 0x18], 7
mov r8, qword [rax + 0x10]
jbe 0x14002d0d9
mov rax, qword [rax]
mov rdx, rax
mov rcx, r14
call fcn.14000b170
lea rcx, [rsp + 0x40]
call fcn.140007a6c
lea rcx, [rbp - 0x20]
call fcn.140007a6c
mov eax, 0xb
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r8d, eax
lea rdx, str.RegCloseKey
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4b], r15b
call fcn.14002d240
mov rcx, qword [rbp + 0x1858]
call rax
mov rdx, qword [rsp + 0x58]
mov edi, 0x1000
cmp rdx, r12
jbe 0x14002d17b
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002ce8c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d215
jmp 0x14002ce8c
inc ebx
test esi, esi
je 0x14002cc1e
mov eax, 0xb
mov qword [rsp + 0x58], r12
xorps xmm0, xmm0
mov qword [rsp + 0x50], rax
mov r8d, eax
lea rdx, str.RegCloseKey
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14007c060
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4b], r15b
call fcn.14002d240
mov rcx, qword [rsp + 0x60]
call rax
mov rdx, qword [rsp + 0x58]
cmp rdx, r12
jbe 0x14002d1fa
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x14002d1f5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d221
call fcn.140054430
mov rax, r14
add rsp, 0x1900
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3
call fcn.14005af0c
int3