Function at 0x140039230
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
xor eax, eax
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x40], 1
mov esi, eax
mov edi, 0xeb748313
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x140], xmm0
movd ecx, xmm0
sub cx, 8
test esi, esi
je 0x140039303
mov r9, qword [rsp + 0x148]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x1400392fa
nop word [rax + rax]
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400392d0
cmp r10d, esi
jne 0x14003946a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140039477
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x14003946a
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x14003946a
mov r12d, dword [r15 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r11d
lea rcx, [r12 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x811c9dc5
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x14003939a
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140039370
cmp r10d, edi
je 0x1400393ac
test r11d, r11d
jne 0x140039350
mov rax, qword [rax]
jmp 0x140039290
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r15
jbe 0x140039472
lea rax, [r15 + r13]
cmp rdx, rax
jae 0x140039472
mov esi, 0x811c9dc5
mov edi, esi
movzx r8d, byte [rdx]
cmp r8b, 0x2e
je 0x140039419
nop dword [rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc rdx
movzx r8d, byte [rdx]
cmp r8b, 0x2e
jne 0x1400393f0
inc rdx
movzx r8d, byte [rdx]
test r8b, r8b
je 0x140039459
nop word [rax + rax]
movsx eax, r8b
sub r8b, 0x41
mov ecx, eax
or ecx, 0x20
cmp r8b, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea rdx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jne 0x140039430
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140039290
xor r14d, r14d
jmp 0x14003947d
xor r14d, r14d
mov edx, r14d
call rdx
mov qword [rsp + 0x140], rax
test rax, rax
je 0x140039707
mov dword [rsp + 0x528], r14d
mov esi, r14d
mov edi, 0x41343800
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x100], xmm0
movd eax, xmm0
sub ax, 8
test esi, esi
je 0x140039531
mov r9, qword [rsp + 0x108]
movzx eax, ax
shr rax, 1
lea r11, [r9 + rax*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x140039528
nop word [rax + rax]
movsx eax, byte [r9]
mov edx, eax
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x140039500
cmp r10d, esi
jne 0x140039676
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x140039683
movsxd rax, dword [rbx + 0x3c]
mov rdx, qword [rax + rbx + 0x88]
mov r13, rdx
shr r13, 0x20
mov r15d, edx
add r15, rbx
cmp r15, rbx
je 0x140039676
mov r11d, dword [r15 + 0x18]
test r11d, r11d
je 0x140039676
mov r12d, dword [r15 + 0x20]
dec r11d
lea rax, [rbx + r11*4]
mov r9d, dword [rax + r12]
add r9, rbx
mov r10d, 0x811c9dc5
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400395bc
movsx eax, r8b
sub r8b, 0x41
mov edx, eax
or edx, 0x20
cmp r8b, 0x19
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140039591
cmp r10d, edi
je 0x1400395ce
test r11d, r11d
jne 0x140039571
mov rcx, qword [rcx]
jmp 0x1400394c0
mov ecx, dword [r15 + 0x1c]
add rcx, rbx
mov eax, dword [r15 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, r15
jbe 0x14003967e
lea rax, [r15 + r13]
cmp r8, rax
jae 0x14003967e
mov esi, 0x811c9dc5
mov edi, esi
movzx edx, byte [r8]
cmp dl, 0x2e
je 0x140039635
nop
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, esi
imul esi, ecx, 0x1000193
inc r8
movzx edx, byte [r8]
cmp dl, 0x2e
jne 0x140039610
inc r8
movzx edx, byte [r8]
test dl, dl
je 0x140039665
movsx eax, dl
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
cmova ecx, eax
xor ecx, edi
imul edi, ecx, 0x1000193
lea r8, [r8 + 1]
movzx edx, byte [r8]
test dl, dl
jne 0x140039640
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx]
jmp 0x1400394c0
xor r14d, r14d
jmp 0x140039689
xor r14d, r14d
mov r8d, r14d
lea rdx, [rsp + 0x528]
mov rcx, qword [rsp + 0x140]
call r8
test rax, rax
je 0x140039707
cmp dword [rsp + 0x528], 2
jne 0x140039707
lea r8, [rax + 8]
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x1400396fa
mov rdx, qword [r8]
mov qword [rax], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400396e0
mov rcx, rax
call fcn.14002b6e0
add qword [rbx + 8], 0x20
jmp 0x14003970f
mov rdx, rax
mov rcx, rbx
call fcn.1400550c0
jmp 0x14003970f
mov rbx, qword [rsp + 0x520]
mov rax, qword [rbx + 8]
cmp qword [rbx], rax
jne 0x14003ad46
movabs rbx, 0x397a9e19b9d82f9d
mov qword [rsp + 0x3c0], rbx
movabs rdi, 0x35fae148278a2caa
mov qword [rsp + 0x3c8], rdi
movabs r12, 0x2c48a75b027dda7f
mov qword [rsp + 0x3d0], r12
movabs r15, 0x49f01a2af1b445cc
mov qword [rsp + 0x3d8], r15
movabs rax, 0xf30b90adf19be8b1
mov qword [rsp + 0x3e0], rax
movabs r13, 0xd68b6f2c511cafee
mov qword [rsp + 0x3e8], r13
movabs rax, 0x5344c64fa13d3e53
mov qword [rsp + 0x3f0], rax
movabs rsi, 0xe7bbf6ce0eb4f800
mov qword [rsp + 0x3f8], rsi
movabs rax, 0x392a9e45b9e22fde
mov qword [rsp + 0x270], rax
movabs rax, 0x3588e12f27e52cd8
mov qword [rsp + 0x278], rax
movabs rax, 0x2c0ea77b0210da1e
mov qword [rsp + 0x280], rax
movabs rax, 0x49831a4ff1d845a5
mov qword [rsp + 0x288], rax
movabs rax, 0xf33390d5f1b3e891
mov qword [rsp + 0x290], rax
movabs rax, 0xd6d86f705135afd8
mov qword [rsp + 0x298], rax
movabs rax, 0x5329c62ea1583e27
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x2a8], rsi
movdqa xmm0, xmmword [rsp + 0x270]
pxor xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmm1, xmmword [rsp + 0x280]
pxor xmm1, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmm0, xmmword [rsp + 0x290]
pxor xmm0, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x290], xmm0
movdqa xmm1, xmmword [rsp + 0x2a0]
pxor xmm1, xmmword [rsp + 0x3f0]
movdqa xmmword [rsp + 0x2a0], xmm1
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rax, [rsp + 0x270]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400398d0
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x48]
call fcn.14002b6e0
nop
mov qword [rsp + 0x400], rbx
mov qword [rsp + 0x408], rdi
mov qword [rsp + 0x410], r12
mov qword [rsp + 0x418], r15
movabs rax, 0xf30b90adf19be8b1
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r13
movabs rax, 0x5344c64fa13d3e53
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rsi
movabs rax, 0xeb42f1163c98e45
mov qword [rsp + 0x440], rax
movabs r13, 0x1ab37d00a568b8d2
mov qword [rsp + 0x448], r13
movabs rcx, 0x392e9e5fb9972fce
mov qword [rsp + 0x2e0], rcx
movabs rcx, 0x35bfe11a27cb2cfd
mov qword [rsp + 0x2e8], rcx
movabs rcx, 0x2c1fa714022ada23
mov qword [rsp + 0x2f0], rcx
movabs rcx, 0x49c21a19f18045fa
mov qword [rsp + 0x2f8], rcx
movabs rcx, 0xf36e90c9f1f4e8ff
mov qword [rsp + 0x300], rcx
movabs rcx, 0xd6e76f4d514aafb2
mov qword [rsp + 0x308], rcx
movabs rcx, 0x5317c613a1583e25
mov qword [rsp + 0x310], rcx
movabs rcx, 0xe7d6f6af0ed1f874
mov qword [rsp + 0x318], rcx
mov qword [rsp + 0x320], rax
mov qword [rsp + 0x328], r13
movdqa xmm0, xmmword [rsp + 0x2e0]
pxor xmm0, xmmword [rsp + 0x400]
movdqa xmmword [rsp + 0x2e0], xmm0
movdqa xmm1, xmmword [rsp + 0x2f0]
pxor xmm1, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x2f0], xmm1
movdqa xmm0, xmmword [rsp + 0x300]
pxor xmm0, xmmword [rsp + 0x420]
movdqa xmmword [rsp + 0x300], xmm0
movdqa xmm1, xmmword [rsp + 0x310]
pxor xmm1, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x310], xmm1
movdqa xmm0, xmmword [rsp + 0x320]
pxor xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x320], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
lea rax, [rsp + 0x2e0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140039ac1
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x1b0]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x1b0]
lea rcx, [rsp + 0x538]
call fcn.140037630
nop
mov rax, qword [rsp + 0x1c8]
cmp rax, 8
jb 0x140039b3c
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039b36
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adba
call fcn.14000d9d0
nop
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], r14w
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], r12
mov qword [rsp + 0x258], r15
movabs rax, 0x390e9e6ab9b62fd4
mov qword [rsp + 0x200], rax
movabs rax, 0x35aae12427e62ccb
mov qword [rsp + 0x208], rax
movabs rax, 0x2c48a7330209da1e
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r15
movdqa xmm0, xmmword [rsp + 0x200]
pxor xmm0, xmmword [rsp + 0x240]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [rsp + 0x210]
pxor xmm1, xmmword [rsp + 0x250]
movdqa xmmword [rsp + 0x210], xmm1
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x200]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140039c20
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x538]
call fcn.140037b90
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x140039c9a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039c94
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc0
call fcn.14000d9d0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
mov r8, qword [rsp + 0x230]
test r8, r8
je 0x140039ce3
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
cmovae rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14002b6e0
nop
mov rax, qword [rsp + 0x238]
cmp rax, 8
jb 0x140039d27
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140039d21
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adc6
call fcn.14000d9d0
nop
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], r14w
mov rcx, qword [rsp + 0x538]
mov esi, 0x80000000
test rcx, rcx
je 0x140039d81
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x140039d81
cmp rcx, 0xffffffff80000007
je 0x140039d81
cmp rcx, 0xffffffff80000060
je 0x140039d81
cmp rcx, 0xffffffff80000050
je 0x140039d81
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], rdi
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r15
movabs rax, 0xf30b90adf19be8b1
mov qword [rsp + 0x470], rax
movabs rax, 0xd68b6f2c511cafee
mov qword [rsp + 0x478], rax
movabs rax, 0x5344c64fa13d3e53
mov qword [rsp + 0x480], rax
movabs rax, 0xe7bbf6ce0eb4f800
mov qword [rsp + 0x488], rax
movabs rax, 0xeb42f1163c98e45
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r13
movabs rax, 0x39149e70b9ba2fc1
mov qword [rsp + 0x330], rax
movabs rax, 0x359ce12d27e92cf6
mov qword [rsp + 0x338], rax
movabs rax, 0x2c2ea73e021eda23
mov qword [rsp + 0x340], rax
movabs rax, 0x499e1a43f1c345e2
mov qword [rsp + 0x348], rax
movabs rax, 0xf33f909bf1e3e886
mov qword [rsp + 0x350], rax
movabs rax, 0xd6ee6f58516fafb2
mov qword [rsp + 0x358], rax
movabs rax, 0x5321c638a1503e32
mov qword [rsp + 0x360], rax
movabs rax, 0xe7d7f6ab0edcf862
mov qword [rsp + 0x368], rax
movabs rax, 0xe9a2f6363ac8e35
mov qword [rsp + 0x370], rax
movabs rax, 0x1ab37d65a510b8b7
mov qword [rsp + 0x378], rax
movdqa xmm0, xmmword [rsp + 0x330]
pxor xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmm1, xmmword [rsp + 0x340]
pxor xmm1, xmmword [rsp + 0x460]
movdqa xmmword [rsp + 0x340], xmm1
movdqa xmm0, xmmword [rsp + 0x350]
pxor xmm0, xmmword [rsp + 0x470]
movdqa xmmword [rsp + 0x350], xmm0
movdqa xmm1, xmmword [rsp + 0x360]
pxor xmm1, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0x360], xmm1
movdqa xmm0, xmmword [rsp + 0x370]
pxor xmm0, xmmword [rsp + 0x490]
movdqa xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x330]
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140039f50
movabs rax, 0x7ffffffffffffffe
mov rdx, qword [rsp + 0x58]
sub rax, rdx
cmp rax, rcx
jb 0x14003adcc
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x330]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x1d0]
call fcn.1400586b0
mov dword [rsp + 0x40], 3
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140039ff0
movups xmm0, xmmword [rsp + 0x1d0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x1e0]
movups xmmword [rdx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x1d0], r14w
add qword [rcx + 8], 0x20
jmp 0x14003a005
lea r8, [rsp + 0x1d0]
call fcn.14002ffb0
mov rax, qword [rsp + 0x1e8]
cmp rax, 8
jb 0x14003a041
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a03b
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003add1
call fcn.14000d9d0
nop
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003a07f
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a079
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003add7
call fcn.14000d9d0
nop
jmp 0x14003a0bb
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r12
mov qword [rsp + 0x178], r15
movabs rax, 0xf30b90adf19be8b1
mov qword [rsp + 0x180], rax
movabs rax, 0xd68b6f2c511cafee
mov qword [rsp + 0x188], rax
movabs rax, 0x5344c64fa13d3e53
mov qword [rsp + 0x190], rax
movabs rax, 0xe7bbf6ce0eb4f800
mov qword [rsp + 0x198], rax
movabs rax, 0xeb42f1163c98e45
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], r13
movabs rax, 0x392e9e5fb9972fce
mov qword [rsp + 0xb0], rax
movabs rax, 0x35bfe11a27cb2cfd
mov qword [rsp + 0xb8], rax
movabs rax, 0x2c21a737023eda23
mov qword [rsp + 0xc0], rax
movabs rax, 0x49831a5ef1da45a9
mov qword [rsp + 0xc8], rax
movabs rax, 0xf36a90d9f1c8e8ed
mov qword [rsp + 0xd0], rax
movabs rax, 0xd6ee6f615168af9c
mov qword [rsp + 0xd8], rax
movabs rax, 0x532ac606a1483e3d
mov qword [rsp + 0xe0], rax
movabs rax, 0xe7d5f6bc0ed1f874
mov qword [rsp + 0xe8], rax
movabs rax, 0xeb42f1163bd8e20
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], r13
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rax, [rsp + 0xb0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a2a2
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x150]
call fcn.140037630
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a31d
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a317
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003addd
call fcn.14000d9d0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x150]
call fcn.140038160
nop
cmp byte [rsp + 0x2c8], 1
jne 0x14003ade3
mov rbx, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x128]
cmp rbx, rdi
je 0x14003a3ca
cmp qword [rbx + 0x10], 0
je 0x14003a3c4
cmp r15, qword [rsp + 0x130]
je 0x14003a3a9
mov rdx, rbx
mov rcx, r15
call fcn.14004fde0
add r15, 0x20
mov qword [rsp + 0x128], r15
add rbx, 0x20
jmp 0x14003a376
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x120]
call fcn.140055390
mov r15, qword [rsp + 0x128]
add rbx, 0x20
jmp 0x14003a376
lea rcx, [rsp + 0x2b0]
call fcn.14004edd0
nop
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x14003a411
lea rax, [rcx + rsi]
cmp rax, 5
jbe 0x14003a411
cmp rcx, 0xffffffff80000007
je 0x14003a411
cmp rcx, 0xffffffff80000060
je 0x14003a411
cmp rcx, 0xffffffff80000050
je 0x14003a411
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x14003a41e
movabs r11, 0xd6ee6f615168af9c
movabs r10, 0xf36a90d9f1c8e8ed
movabs r9, 0x49831a5ef1da45a9
movabs r8, 0x2c21a737023eda23
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x49f01a2af1b445cc
movabs rdi, 0x35fae148278a2caa
movabs rsi, 0x397a9e19b9d82f9d
mov r13, qword [rsp + 0x120]
mov r12, r13
cmp r13, r15
je 0x14003ad58
cmp qword [r12 + 0x10], 0
je 0x14003acfc
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rdi
movabs rbx, 0x2c48a75b027dda7f
mov qword [rsp + 0x1e0], rbx
mov qword [rsp + 0x1e8], rcx
movabs rbx, 0xf30b90adf19be8b1
mov qword [rsp + 0x1f0], rbx
movabs rbx, 0xd68b6f2c511cafee
mov qword [rsp + 0x1f8], rbx
movabs rdx, 0x391f9e71b9ab2fc1
mov qword [rsp + 0x240], rdx
movabs rdx, 0x3595e11427e62cc6
mov qword [rsp + 0x248], rdx
movabs rdx, 0x2c14a7350218da0f
mov qword [rsp + 0x250], rdx
movabs rdx, 0x499d1a47f1db45af
mov qword [rsp + 0x258], rdx
movabs rdx, 0xf30b90c9f1f5e8d0
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rbx
movups xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
pxor xmm0, xmmword [rsp + 0x1d0]
movdqa xmmword [rsp + 0x4a0], xmm0
pxor xmm1, xmmword [rsp + 0x1e0]
movdqa xmmword [rsp + 0x4b0], xmm1
pxor xmm2, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x4c0], xmm2
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rdi
movabs rdi, 0x2c48a75b027dda7f
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], rcx
movabs rcx, 0xf30b90adf19be8b1
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rbx
movabs rcx, 0x5344c64fa13d3e53
mov qword [rsp + 0x190], rcx
movabs rcx, 0xe7bbf6ce0eb4f800
mov qword [rsp + 0x198], rcx
movabs rcx, 0xeb42f1163c98e45
mov qword [rsp + 0x1a0], rcx
movabs rbx, 0x1ab37d00a568b8d2
mov qword [rsp + 0x1a8], rbx
movabs rcx, 0x392e9e5fb9972fce
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x35bfe11a27cb2cfd
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0xd0], r10
mov qword [rsp + 0xd8], r11
movabs rcx, 0x532ac606a1483e3d
mov qword [rsp + 0xe0], rcx
movabs rcx, 0xe7d5f6bc0ed1f874
mov qword [rsp + 0xe8], rcx
movabs rcx, 0xeb42f4d63bd8e20
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rbx
movdqa xmm0, xmmword [rsp + 0xb0]
pxor xmm0, xmmword [rsp + 0x160]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [rsp + 0xc0]
pxor xmm1, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [rsp + 0xd0]
pxor xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [rsp + 0xe0]
pxor xmm1, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [rsp + 0xf0]
pxor xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xf0], xmm0
lea r8, [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
movzx ebx, byte [rsp + 0x520]
mov rdx, qword [r12 + 0x10]
nop dword [rax]
inc rcx
cmp word [r8 + rcx*2], 0
jne 0x14003a740
sub rax, rdx
cmp rax, rcx
jb 0x14003ae01
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x14003a766
mov rax, qword [r12]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xb0]
lea rcx, [rsp + 0x100]
call fcn.1400586b0
mov edi, dword [rsp + 0x40]
or edi, 4
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x4a0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003a7a4
mov rcx, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14003a81c
lea rsi, [rdx + rcx]
mov qword [rsp + 0x110], rsi
lea rdi, [rsp + 0x100]
cmp r8, 8
cmovae rdi, qword [rsp + 0x100]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rsp + 0x4a0]
call fcn.14007bf70
mov word [rdi + rsi*2], r14w
lea rax, [rsp + 0x100]
mov edi, dword [rsp + 0x40]
movabs rsi, 0x397a9e19b9d82f9d
jmp 0x14003a83a
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x4a0]
movzx r8d, bl
lea rcx, [rsp + 0x100]
call fcn.14005f2b0
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x88]
lea rcx, [rsp + 0x530]
call fcn.140037630
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 8
jb 0x14003a8da
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a8d4
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003ade9
call fcn.14000d9d0
nop
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], 7
mov word [rsp + 0x88], r14w
mov rax, qword [rsp + 0x118]
cmp rax, 8
jb 0x14003a93b
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x100]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003a935
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adef
call fcn.14000d9d0
nop
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], 7
mov word [rsp + 0x100], r14w
mov qword [rsp + 0x390], rsi
movabs rdi, 0x35fae148278a2caa
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rdi
movups xmm0, xmmword [rsp + 0x380]
pxor xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
lea rax, [rsp + 0x140]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14003a9d0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x68]
call fcn.14002b6e0
nop
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x530]
call fcn.140037f30
nop
mov rax, qword [rsp + 0x80]
cmp rax, 8
jb 0x14003aa4a
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003aa44
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adf5
call fcn.14000d9d0
nop
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r14w
cmp byte [rsp + 0x2d0], 1
jne 0x14003acaa
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.14004fde0
nop
lea rax, [rsp + 0x48]
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
cmp r11, 8
jb 0x14003aaa9
mov r8, rcx
lea rdx, [rcx + r9*2]
lea r10, [rcx + r9*2]
jmp 0x14003aabb
lea r10, [rax + r9*2]
lea rdx, [rsp + 0x48]
lea rdx, [rdx + r9*2]
lea r8, [rsp + 0x48]
cmp r8, rdx
je 0x14003ab09
cmp word [r8], 0x22
je 0x14003aad0
add r8, 2
cmp r8, rdx
jne 0x14003aac0
cmp r8, rdx
je 0x14003ab09
lea rax, [r8 + 2]
cmp rax, rdx
je 0x14003ab09
nop
movzx ecx, word [rax]
cmp cx, 0x22
je 0x14003aaf1
mov word [r8], cx
add r8, 2
add rax, 2
cmp rax, rdx
jne 0x14003aae0
mov r11, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
sub r10, r8
sar r10, 1
cmp r11, 8
jb 0x14003ab1f
sub r8, rcx
jmp 0x14003ab27
sub r8, rax
lea rcx, [rsp + 0x48]
sar r8, 1
mov rax, r9
sub rax, r8
cmp rax, r10
cmovb r10, rax
lea rcx, [rcx + r8*2]
sub r9, r10
mov qword [rsp + 0x58], r9
lea rdx, [rcx + r10*2]
sub r9, r8
lea r8, [r9*2 + 2]
call fcn.14007bf70
mov qword [rsp + 0x3b0], rsi
mov qword [rsp + 0x3b8], rdi
movabs rax, 0x39169e69b9a02ff8
mov qword [rsp + 0x3a0], rax
movabs rax, 0x35fae12d27f82cc5
mov qword [rsp + 0x3a8], rax
movups xmm0, xmmword [rsp + 0x3a0]
pxor xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x100], xmm0
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.14004fc20
cmp rax, 0xffffffffffffffff
je 0x14003ac04
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac96
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003abf9
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adfb
call fcn.14000d9d0
nop
jmp 0x14003ac96
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14003ac4e
mov qword [rdx], r14
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], r14
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x58], r14
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
add qword [rcx + 8], 0x20
jmp 0x14003ac5d
lea r8, [rsp + 0x48]
call fcn.14002ffb0
mov rax, qword [rsp + 0x60]
cmp rax, 8
jb 0x14003ac96
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003ac90
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003adfb
call fcn.14000d9d0
nop
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x2b0]
call fcn.14004ee50
nop
mov rcx, qword [rsp + 0x530]
test rcx, rcx
je 0x14003acfc
mov eax, 0x80000000
add rax, rcx
cmp rax, 5
jbe 0x14003acf4
cmp rcx, 0xffffffff80000007
je 0x14003acf4
cmp rcx, 0xffffffff80000060
je 0x14003acf4
cmp rcx, 0xffffffff80000050
je 0x14003acf4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x530], r14
add r12, 0x20
cmp r12, r15
je 0x14003ad58
movabs rax, 0x7ffffffffffffffe
movabs rcx, 0x49f01a2af1b445cc
movabs r8, 0x2c21a737023eda23
movabs r9, 0x49831a5ef1da45a9
movabs r10, 0xf36a90d9f1c8e8ed
movabs r11, 0xd6ee6f615168af9c
jmp 0x14003a482
mov r15, qword [rsp + 0x128]
mov r13, qword [rsp + 0x120]
jmp 0x14003ad60
mov rbx, qword [rsp + 0x520]
test r13, r13
je 0x14003ada4
mov rdx, r15
mov rcx, r13
call fcn.140030250
mov rax, qword [rsp + 0x130]
sub rax, r13
and rax, 0xffffffffffffffe0
mov rcx, r13
cmp rax, 0x1000
jb 0x14003ad9b
mov r13, qword [r13 - 8]
sub rcx, r13
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ae07
mov rcx, r13
call fcn.14000d9d0
nop
mov rax, rbx
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140080484
nop
call fcn.140080484
nop
call fcn.140080484
nop
call fcn.14002ac40
call fcn.140080484
nop
call fcn.140080484
nop
call fcn.140080484
nop
call fcn.1400375a0
nop
call fcn.140080484
nop
call fcn.140080484
nop
call fcn.140080484
int3
call fcn.140080484
nop
call fcn.14002ac40
nop
call fcn.140080484
int3