Function at 0x140052d70
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7d8]
sub rsp, 0x8b0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401d5e90]
xor rax, rsp
mov qword [rbp + 0x7a0], rax
mov r13, rcx
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
call fcn.140052730
lea r15d, [r12 + 1]
test al, al
jne 0x140052de2
mov eax, dword [0x1401ddd80]
test eax, eax
cmove eax, r15d
mov dword [0x1401ddd80], eax
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov word [rbp - 0x60], r12w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp - 0x5e]
call fcn.1400dc6e0
mov eax, dword [0x1401ddd80]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x8000000f
jge 0x140052e2d
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xd
jne 0x140052e45
lea edx, [rcx + 0x34]
lea r8d, [rcx + 0x35]
lea rcx, [0x140164084]
call fcn.1400d7c60
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x70], r12
mov r8d, dword [0x1401ddd80]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
or r14, 0xffffffffffffffff
cmp ecx, 2
jne 0x140052ec6
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.1400d68e8
mov rcx, rax
call fcn.1400d834c
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
lea r8, str.SOFTWAREWow6432NodeMicr
test r8, 0xffffffffffff0000
jne 0x140052f16
movzx edi, r8w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140052f8c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002a60
jmp 0x140052f8c
mov r12d, dword [rdi - 0x10]
mov rsi, r8
sub rsi, rdi
sar rsi, 1
mov ecx, r15d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x19
or eax, ecx
jge 0x140052f4e
mov edx, 0x19
lea rcx, [rsp + 0x40]
call fcn.140002860
mov rdi, qword [rsp + 0x40]
lea r8, str.SOFTWAREWow6432NodeMicr
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x32
mov rcx, rdi
add rdx, rdx
cmp rsi, r12
ja 0x140052f6e
lea r8, [rdi + rsi*2]
call fcn.1400d7ac4
jmp 0x140052f73
call fcn.1400d7bc0
cmp dword [rdi - 0xc], 0x19
jl 0x140053768
mov dword [rdi - 0x10], 0x19
xor r12d, r12d
mov word [rdi + 0x32], r12w
mov r8d, 0x17
lea rdx, str.osoftInternet_Explorer
lea rcx, [rsp + 0x40]
call fcn.1400114a0
mov rax, qword [rsp + 0x40]
mov ecx, r15d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x140052fc1
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140002860
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, eax
test eax, eax
jne 0x140052ffe
mov dword [rsp + 0x68], r12d
mov r9d, r12d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov r8d, dword [0x1401ddd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0x11
jne 0x140053036
test r8d, r8d
cmove r8d, r15d
mov dword [0x1401ddd80], r8d
test r9d, r9d
jne 0x140053703
mov dword [rsp + 0x5c], 0x800
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.svcVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140053212
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 1
ja 0x140053212
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x1400530ab
test al, 1
jne 0x140053212
shr rax, 1
cmp word [rbp + rax*2 - 0x62], 0
je 0x1400530b0
jmp 0x140053212
mov word [rbp - 0x60], r12w
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
test rax, 0xffffffffffff0000
jne 0x140053107
movzx esi, cx
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x1400531f7
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002a60
mov rdi, qword [rsp + 0x48]
jmp 0x1400531f7
lea rax, [rbp - 0x60]
mov rsi, r14
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140053110
test esi, esi
jne 0x14005317c
lea rdx, [rdi - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400531f7
cmp dword [rdx + 0x10], 0
jge 0x140053153
cmp dword [rdi - 0xc], 0
jge 0x140053146
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], r12d
mov word [rdi], r12w
jmp 0x1400531f7
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053163
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x48], rdi
mov rbx, qword [rsp + 0x38]
jmp 0x1400531f7
mov r13d, dword [rdi - 0x10]
lea r12, [rbp - 0x60]
sub r12, rdi
sar r12, 1
test esi, esi
jns 0x140053199
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, r15d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400531b9
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.140002860
mov rdi, qword [rsp + 0x48]
movsxd rax, esi
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
add rdx, rdx
cmp r12, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x1400531dd
lea r8, [rdi + r12*2]
call fcn.1400d7ac4
jmp 0x1400531e6
lea r8, [rbp - 0x60]
call fcn.1400d7bc0
cmp esi, dword [rdi - 0xc]
jg 0x140053207
mov dword [rdi - 0x10], esi
xor r12d, r12d
mov word [r13 + rdi], r12w
mov dword [rsp + 0x30], r15d
cmp dword [rdi - 0x10], 0
je 0x140053217
mov sil, 1
jmp 0x14005321a
mov ecx, 0x80070057
call fcn.140001920
nop
mov rdi, qword [rsp + 0x48]
xor sil, sil
mov eax, dword [rsp + 0x30]
test al, 1
je 0x140053240
and dword [rsp + 0x30], 0xfffffffe
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005323b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
test sil, sil
je 0x140053314
lea rax, [rbp - 0x60]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140053250
test edi, edi
jne 0x140053297
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400536e5
cmp dword [rdx + 0x10], 0
jge 0x14005363a
cmp dword [rbx - 0xc], 0
jge 0x14005328a
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x1400536e5
mov r12d, dword [rbx - 0x10]
lea rsi, [rbp - 0x60]
sub rsi, rbx
sar rsi, 1
test edi, edi
jns 0x1400532b4
mov ecx, 0x80070057
call fcn.140001920
int3
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r15d
jge 0x1400532d3
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140002860
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
lea r15, [rax + rax]
add rdx, rdx
mov r9, r15
cmp rsi, r12
ja 0x1400532f7
lea r8, [rbx + rsi*2]
call fcn.1400d7ac4
jmp 0x140053300
lea r8, [rbp - 0x60]
call fcn.1400d7bc0
cmp edi, dword [rbx - 0xc]
jle 0x1400536da
mov ecx, 0x80070057
call fcn.140001920
int3
mov r8d, dword [0x1401ddd80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 6
jne 0x1400533ea
mov edx, r12d
nop word [rax + rax]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x140053350
mov dword [0x1401ddd80], r8d
mov dword [rsp + 0x58], 0x800
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, [0x140165e60]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400535c2
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x1400535c2
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140053456
test al, 1
jne 0x1400535c2
shr rax, 1
cmp word [rbp + rax*2 - 0x62], 0
je 0x14005345b
jmp 0x1400535c2
mov word [rbp - 0x60], r12w
lea rcx, [0x1401d59a8]
mov rax, qword [0x1401d59a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
test rax, 0xffffffffffff0000
jne 0x1400534b2
movzx esi, cx
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x1400535a7
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140002a60
mov rdi, qword [rsp + 0x50]
jmp 0x1400535a7
lea rax, [rbp - 0x60]
mov rsi, r14
nop dword [rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400534c0
test esi, esi
jne 0x14005352c
lea rdx, [rdi - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400535a7
cmp dword [rdx + 0x10], 0
jge 0x140053503
cmp dword [rdi - 0xc], 0
jge 0x1400534f6
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], r12d
mov word [rdi], r12w
jmp 0x1400535a7
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
mov rbx, qword [rsp + 0x38]
jmp 0x1400535a7
mov r13d, dword [rdi - 0x10]
lea r12, [rbp - 0x60]
sub r12, rdi
sar r12, 1
test esi, esi
jns 0x140053549
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, r15d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x140053569
mov edx, esi
lea rcx, [rsp + 0x50]
call fcn.140002860
mov rdi, qword [rsp + 0x50]
movsxd rax, esi
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
add rdx, rdx
cmp r12, r13
lea r13, [rax + rax]
mov r9, r13
ja 0x14005358d
lea r8, [rdi + r12*2]
call fcn.1400d7ac4
jmp 0x140053596
lea r8, [rbp - 0x60]
call fcn.1400d7bc0
cmp esi, dword [rdi - 0xc]
jg 0x1400535b7
mov dword [rdi - 0x10], esi
xor r12d, r12d
mov word [r13 + rdi], r12w
or dword [rsp + 0x30], 2
cmp dword [rdi - 0x10], 0
je 0x1400535c7
mov sil, 1
jmp 0x1400535ca
mov ecx, 0x80070057
call fcn.140001920
nop
mov rdi, qword [rsp + 0x50]
xor sil, sil
mov eax, dword [rsp + 0x30]
test al, 2
je 0x1400535f0
and dword [rsp + 0x30], 0xfffffffd
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400535eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
test sil, sil
je 0x1400536e5
lea rax, [rbp - 0x60]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140053600
test edi, edi
jne 0x140053661
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x1400536e5
cmp dword [rdx + 0x10], 0
jge 0x14005363a
cmp dword [rbx - 0xc], 0
jge 0x14005328a
mov ecx, 0x80070057
call fcn.140001920
int3
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005364a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x1400536e5
mov r12d, dword [rbx - 0x10]
lea rsi, [rbp - 0x60]
sub rsi, rbx
sar rsi, 1
test edi, edi
jns 0x14005367e
mov ecx, 0x80070057
call fcn.140001920
int3
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r15d
jge 0x14005369d
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140002860
mov rbx, qword [rsp + 0x38]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
lea r15, [rax + rax]
add rdx, rdx
mov r9, r15
cmp rsi, r12
ja 0x1400536c1
lea r8, [rbx + rsi*2]
call fcn.1400d7ac4
jmp 0x1400536ca
lea r8, [rbp - 0x60]
call fcn.1400d7bc0
cmp edi, dword [rbx - 0xc]
jle 0x1400536da
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rbx - 0x10], edi
xor r12d, r12d
mov word [r15 + rbx], r12w
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400536fa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov r13, qword [rbp - 0x78]
lea rcx, [rbx - 0x18]
call fcn.1400028c0
add rax, 0x18
mov qword [r13], rax
or dword [rsp + 0x30], 4
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140053733
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140053748
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
lock add dword [rbx - 8], 0xffffffff
jg 0x140053763
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, r13
jmp 0x140053773
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0x7a0]
xor rcx, rsp
call fcn.1400d72a0
lea r11, [rsp + 0x8b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret