Function at 0x140001370
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0xe8]
sub rsp, 0x1e8
mov rax, qword [0x140020040]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [str.fodlwg]
mov eax, dword [str.32_]
xor r14d, r14d
cmp dword [0x140020098], 2
mov r8d, r14d
movups xmm1, xmmword [0x140009888]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140009898]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
jl 0x140001511
movdqa xmm0, xmmword [0x14001c530]
lea rcx, [rsp + 0x54]
movdqa xmm4, xmmword [0x14001c4a0]
movdqa xmm3, xmmword [0x14001c540]
movdqa xmm5, xmmword [str.6666]
movdqa xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
movaps xmmword [rsp + 0x1c0], xmm6
movdqa xmm6, xmmword [0x14001c510]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm4
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, edx
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x28
jl 0x140001420
movaps xmm6, xmmword [rsp + 0x1c0]
cmp r8d, 0x2c
jge 0x140001551
movsxd rax, r8d
lea r9, [rsp + 0x50]
add r9, rax
nop dword [rax]
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 0x2c
jl 0x140001520
mov qword [rsp + 0x200], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x208], rsi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x210], rdi
mov r9d, 0x20019
mov qword [rsp + 0x1e0], r12
xor r8d, r8d
mov qword [rsp + 0x1d8], r13
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001932
cmp byte [0x1400096f9], r14b
movzx eax, word [0x1400096f8]
mov word [rsp + 0x38], ax
mov dword [rbp - 0x78], pe_nt_image_headers64
je 0x1400015d3
xor byte [rsp + 0x39], 0x36
mov byte [rsp + 0x38], 0x30
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x38]
lea rax, [rbp - 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001928
xorps xmm0, xmm0
lea rax, [rbp - 0x50]
mov rsi, 0xffffffffffffffff
movups xmmword [rbp - 0x70], xmm0
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], r14b
jne 0x140001617
movabs r13, 0x7fffffffffffffff
cmp rdi, r13
ja 0x14000197e
cmp rdi, 0xf
ja 0x14000166b
mov r8, rdi
mov qword [rbp - 0x60], rdi
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x58], 0xf
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x70], r14b
mov r13, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x70]
jmp 0x1400016fc
mov rax, rdi
or rax, 0xf
cmp rax, r13
jbe 0x1400016a4
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006f40
test rax, rax
je 0x1400018cf
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400016dc
mov ecx, 0x16
mov r13, rax
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
test rcx, rcx
je 0x1400016dc
cmp rcx, 0x1000
jb 0x1400016d4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001984
jmp 0x140001685
call fcn.140006f40
mov r14, rax
mov r8, rdi
mov qword [rbp - 0x70], r14
lea rdx, [rbp - 0x50]
mov qword [rbp - 0x60], rdi
mov rcx, r14
mov qword [rbp - 0x58], r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
mov eax, dword [0x14001c3d8]
mov cl, 0x56
mov dword [rsp + 0x30], eax
mov r15, rsi
movzx eax, word [0x14001c3dc]
xor byte [rsp + 0x31], 0x36
xor byte [rsp + 0x32], 0x37
xor byte [rsp + 0x33], 0x38
mov word [rsp + 0x34], ax
movzx eax, byte [0x14001c3de]
xor byte [rsp + 0x34], 0x39
xor byte [rsp + 0x35], 0x3a
xor al, 0x3b
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x36], al
lea rax, [rsp + 0x30]
inc r15
cmp byte [rax + r15], 0
jne 0x140001746
cmp r13, 0xf
lea r12, [rbp - 0x70]
cmova r12, r14
cmp r15, rdi
ja 0x1400017e8
mov rax, rdi
sub rax, r15
mov qword [rsp + 0x40], rax
test r15, r15
je 0x1400018df
lea r8, [rax + 1]
movsx edx, cl
add r8, r12
mov rcx, r12
sub r8, r12
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400017e8
nop word [rax + rax]
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400017dc
mov r8, qword [rsp + 0x40]
mov cl, 0x56
inc r8
movsx edx, cl
add r8, r12
inc rbx
sub r8, rbx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400017a0
jmp 0x1400017e8
sub rbx, r12
cmp rbx, rsi
jne 0x1400018df
mov eax, dword [str.ctx_9]
mov cl, 0x56
mov dword [rsp + 0x30], eax
movzx eax, byte [0x14001c3f0]
xor byte [rsp + 0x31], 0x36
xor byte [rsp + 0x32], 0x37
xor byte [rsp + 0x33], 0x38
xor al, 0x39
mov byte [rsp + 0x30], cl
mov byte [rsp + 0x34], al
lea rax, [rsp + 0x30]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140001820
cmp r13, 0xf
lea r15, [rbp - 0x70]
cmova r15, r14
cmp rsi, rdi
ja 0x1400018a4
sub rdi, rsi
test rsi, rsi
je 0x1400018df
movsx r12d, cl
lea r8, [r15 + 1]
add r8, rdi
mov edx, r12d
sub r8, r15
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400018a4
nop word [rax + rax]
mov r8, rsi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400018d6
inc rbx
lea r8, [r15 + 1]
add r8, rdi
mov edx, r12d
sub r8, rbx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140001870
cmp r13, 0xf
jbe 0x140001928
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001920
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x1400018a4
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13, 0xf
jbe 0x14000191c
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001914
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400018cf
mov rcx, r14
call fcn.140006f84
mov al, 1
jmp 0x140001934
mov rcx, r14
call fcn.140006f84
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov r15, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140006f20
add rsp, 0x1e8
pop r14
pop rbp
ret
call fcn.140001320
int3
call fcn.140001280
int3