Function at 0x1400852f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Query or enumerate registry value
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400c71c0]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
lea rcx, [rsp + 0x2f8]
movabs rdx, 0xff00ff00ff00ff00
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rcx
mov rax, qword [rcx]
xor rax, rdx
mov qword [rbp + 0x50], rax
xor r12d, r12d
mov qword [rcx], r12
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400853f7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400853f7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400853f2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400853d0
cmp edx, 0xbdcac9ce
je 0x14008591b
test r8d, r8d
jne 0x1400853b0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14008540d
cmp qword [rax + 0x30], 0
jne 0x140085380
mov r10, r12
movabs rax, 0x4c842e7228817634
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x2fdb344b01443ecc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x6096a2bea8dda994
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rcx, 0x23734cb31a5887f3
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs r14, 0x34eb6c2474af2a68
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs r13, 0x6ba95019682a5781
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x6096a2bea8dda9da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x80], ymm1
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 7]
lea rcx, [rbp + 0x80]
vzeroupper
call r10
cmp rax, 0xffffffffffffffff
jne 0x140085993
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400855b7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400855b7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400855b2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085590
cmp edx, 0x53b2070f
je 0x140085938
test r8d, r8d
jne 0x140085570
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400855cd
cmp qword [rax + 0x30], 0
jne 0x140085540
mov rdx, r12
movabs rax, 0x5f84036c0cc0683e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x6ba95019044633af
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call rdx
test rax, rax
jne 0x140085993
mov qword [rbp + 0x140], r12
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400856d7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400856d7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400856d2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400856b0
cmp edx, 0xdf6a51c
je 0x140085954
test r8d, r8d
jne 0x140085690
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400856ed
cmp qword [rax + 0x30], 0
jne 0x140085660
mov r10, r12
movabs rax, 0x71b92d7320e9653b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x37cc3c7a095818dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x22fac3cbdcafc08c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x570029c65d78ff9c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x7cf4a3918d9725ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xc579b69dca8970eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x6096a2bea8dda9da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x23734cb31a5887f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x139dd7f8e9f364cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xc579b69dca890385
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x100]
mov rcx, 0xffffffff80000002
vzeroupper
call r10
test eax, eax
jne 0x1400859e8
cmp qword [rbp + 0x140], 0
je 0x1400859e8
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085903
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085903
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400858fe
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400858e0
cmp edx, 0x1242154a
je 0x140085971
test r8d, r8d
jne 0x1400858c0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140085989
cmp qword [rax + 0x30], 0
jne 0x140085890
jmp 0x140085989
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140085410
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x1400855d0
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x1400856f0
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r12d, dword [rcx + rax*4]
add r12, r9
mov rcx, qword [rbp + 0x140]
call r12
mov r12d, 1
mov rcx, qword [rbp + 0x50]
movabs rdx, 0xff00ff00ff00ff00
xor rcx, rdx
lea rdx, [rsp + 0x2f8]
mov qword [rdx], rcx
mov eax, r12d
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400870c0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp + 0x140], r12
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085a87
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085a87
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140085a82
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085a60
cmp edx, 0xdf6a51c
je 0x1400863ce
test r8d, r8d
jne 0x140085a40
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140085a9d
cmp qword [rax + 0x30], 0
jne 0x140085a10
mov r10, r12
movabs rax, 0x71b92d7330fd6b20
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x3be0025a3b6f13dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x13eff1e2e692e08e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x23734cb31a35e287
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x6096a2bea8dda9da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x23734cb31a5887f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0xa0]
mov rcx, 0xffffffff80000002
vzeroupper
call r10
test eax, eax
jne 0x14008649f
mov dword [rbp + 0x148], r12d
mov dword [rbp + 0x14c], 0x100
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085c47
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085c47
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140085c42
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085c20
cmp edx, 0xc2c33c3d
je 0x1400863eb
test r8d, r8d
jne 0x140085c00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140085c5d
cmp qword [rax + 0x30], 0
jne 0x140085bd0
mov r8, r12
mov edx, 0x10a
mov ecx, 0x40
call r8
mov r14, rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov ebx, dword [rcx + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085d07
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085d07
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140085d02
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085ce0
cmp edx, 0x9027eb7c
je 0x140086408
test r8d, r8d
jne 0x140085cc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140085d1d
cmp qword [rax + 0x30], 0
jne 0x140085c90
mov r10, r12
movabs rax, 0x5da9014100dc533b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x4c0236b0d7c24ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x6096a2bea8dda9b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rcx, 0x23734cb31a5887f3
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rbx, 0x34eb6c2474af2a68
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x6096a2bea8dda9da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rax, [rbp + 0x14c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x148]
xor r8d, r8d
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp + 0x140]
vzeroupper
call r10
test eax, eax
jne 0x140085ea4
mov rdx, r14
mov rcx, r15
call fcn.140085270
mov eax, dword [rbp + 0x148]
cmp eax, 1
je 0x140085e3e
cmp eax, 7
jne 0x140085ea4
movabs rax, 0x34eb6c240cc0481e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
mov rcx, r14
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140085993
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085f37
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085f37
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140085f32
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085f10
cmp edx, 0xbf0306f6
je 0x140086425
test r8d, r8d
jne 0x140085ef0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140085f4d
cmp qword [rax + 0x30], 0
jne 0x140085ec0
mov rdx, r12
mov rcx, r14
call rdx
mov dword [rbp + 0x148], r12d
mov dword [rbp + 0x14c], 0x200
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140085ff7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140085ff7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140085ff2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140085fd0
cmp edx, 0xc2c33c3d
je 0x140086441
test r8d, r8d
jne 0x140085fb0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14008600d
cmp qword [rax + 0x30], 0
jne 0x140085f80
mov r8, r12
mov edx, 0x20a
mov ecx, 0x40
call r8
mov r14, rax
movabs rax, 0x5b822e4b11cb433e
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x5c6396a1a4f01f2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
movabs rdx, 0x6096a2bea8dda9da
mov qword [rbp], rdx
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
movabs rcx, 0x23734cb31a5887f3
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x34eb6c2474af2a68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rax, [rbp + 0x14c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x148]
xor r8d, r8d
lea rdx, [rbp + 0xe0]
mov rcx, qword [rbp + 0x140]
vzeroupper
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14008625d
cmp dword [rbp + 0x148], 7
jne 0x14008625d
mov rbx, r14
cmp byte [r14], al
je 0x14008625d
movabs rdi, 0x56870d5100dd431e
movabs rsi, 0x6ba95019682a2fee
movabs r13, 0x34eb094817ce5807
mov rdx, rbx
mov rcx, r15
call fcn.140085270
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x6ba95019682a5781
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x34eb6c2474af2a68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140085993
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x34eb6c2474af2a68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x6ba95019682a5781
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
mov rcx, rbx
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140085993
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x140086245
inc rbx
add rbx, rax
cmp byte [rbx], 0
jne 0x140086153
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400862f7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400862f7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x811c9dc5
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400862f2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400862d0
cmp edx, 0xbf0306f6
je 0x14008645e
test r8d, r8d
jne 0x1400862b0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14008630d
cmp qword [rax + 0x30], 0
jne 0x140086280
mov rdx, r12
mov rcx, r14
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400863a7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400863a7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400863a2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140086380
cmp edx, 0x1242154a
je 0x14008647a
test r8d, r8d
jne 0x140086360
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400863bd
cmp qword [rax + 0x30], 0
jne 0x140086330
mov rdx, r12
mov rcx, qword [rbp + 0x140]
call rdx
jmp 0x140085999
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140085aa0
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r8d, dword [rcx + rax*4]
add r8, r9
jmp 0x140085c60
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140085d20
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x140085f50
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r8d, dword [rcx + rax*4]
add r8, r9
jmp 0x140086010
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x140086310
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
mov rcx, qword [rbp + 0x140]
call rdx
jmp 0x140085999
mov rax, qword [rbp + 0x50]
movabs rdx, 0xff00ff00ff00ff00
xor rax, rdx
lea rdx, [rsp + 0x2f8]
mov qword [rdx], rax
jmp 0x1400859b8