Function at 0x14001ac30
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov r15, r8
mov rsi, rdx
mov r14, rcx
movzx eax, byte [0x1401b4d84]
neg al
sbb rdi, rdi
add rdi, 0xffffffff80000002
mov r9d, dword [0x1401b4d80]
lea r8d, [r9 + 1]
imul r8d, r9d
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
xor r12d, r12d
cmp r8d, 0xe
jne 0x14001ad4a
mov edx, r12d
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r9d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r9d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r9d
sar ecx, 1
xor eax, ecx
add r9d, eax
inc edx
cmp edx, 0x100
jl 0x14001acb0
mov dword [0x1401b4d80], r9d
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
mov qword [rbp - 0x29], r12
lea rcx, str._k_f_
mov rax, qword [str._k_f_]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
lea rdx, [0x140140c08]
test rdx, 0xffffffffffff0000
jne 0x14001adb8
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14001adc2
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.1400026c0
jmp 0x14001adc2
lea rcx, [rbp - 0x21]
call fcn.140003500
nop
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 7]
call fcn.14000f640
nop
lea r8, [0x1401b5068]
mov rdx, rax
lea rcx, [rbp + 0x17]
call fcn.14000f640
nop
lea r8, [0x140140b90]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.140019ad0
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14000f640
nop
mov qword [rbp - 9], r12
lea rcx, [rbp - 9]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14001ae43
mov dword [rbp - 0x31], r12d
mov ecx, r12d
mov rax, qword [rbp - 9]
mov qword [rbp - 0x39], rax
test ecx, ecx
setne dil
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
lock add dword [rdx + 0x10], ebx
jg 0x14001ae64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ae7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ae96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001aeaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001aec7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x14001af6f
mov eax, dword [0x1401b4d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 4
jne 0x14001af1e
mov ecx, 4
call fcn.1400c8398
mov rdi, rax
call fcn.1400c84d4
mov dword [rdi], eax
mov dword [0x1401b4d80], eax
mov rcx, rdi
call fcn.1400c7bc0
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14001af31
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001af4e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001af6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14001b0a1
mov dword [rbp + 0x7f], r12d
mov dword [rbp - 0x11], 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0xd]
xor r8d, r8d
mov rdx, qword [rsi]
mov rdi, qword [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b03d
cmp dword [rbp - 0xd], 4
jne 0x14001b03d
test rdi, rdi
je 0x14001afca
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
mov eax, dword [rbp + 0x7f]
mov dword [r15], eax
test rdi, rdi
je 0x14001afe6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b003
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001b01f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b036
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x14001b0ba
test rdi, rdi
je 0x14001b052
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r12
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
test rdi, rdi
je 0x14001b068
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x39], r12
mov dword [rbp - 0x31], r12d
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b085
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001b0a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001b0b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret