Function at 0x140002e20
Capabilities:
Encode data using xor
Hash data using fnv
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x918]
sub rsp, 0xa18
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
xor r15d, r15d
mov r14d, r15d
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x58], r15
lea rdx, [rbp + 0x10]
call fcn.1400025a0
nop
mov rdi, qword [rbp + 0x18]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140002eb1
mov rsi, qword [rbp - 0x60]
lea r8, [rbx + 0x10]
cmp rsi, r14
je 0x140002e8e
mov rdx, r8
mov rcx, rsi
call fcn.140003f50
add rsi, 0x20
mov qword [rbp - 0x60], rsi
jmp 0x140002ea2
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.1400046e0
mov r14, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x60]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x140002e70
mov qword [rbp - 0x48], r14
mov ecx, r15d
mov dword [rbp + 0x970], ecx
mov r14, qword [rbp - 0x68]
mov rax, r14
mov rbx, qword [rbp - 0x60]
cmp r14, rbx
je 0x140002ee1
nop word [rax + rax]
inc ecx
add rax, 0x20
cmp rax, rbx
jne 0x140002ed0
mov dword [rbp + 0x970], ecx
mov edi, 1
mov dword [rbp + 0x968], edi
lea rdx, [0x14001fb70]
mov rcx, qword [0x14001f2f0]
call fcn.140004510
mov rcx, r15
sub rbx, r14
sar rbx, 5
mov qword [rbp], rbx
test rbx, rbx
je 0x140003745
mov esi, edi
mov qword [rbp - 0x50], rdi
nop dword [rax]
mov dword [rbp - 0x70], edi
shl rcx, 5
add rcx, r14
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140002f38
mov rcx, qword [rcx]
mov rdx, rcx
mov rcx, rax
call fcn.140001810
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14001fb80]
mov rcx, qword [0x14001f2f0]
call fcn.140004510
mov r13, rax
dec rsi
cmp rbx, rsi
jbe 0x140003745
mov rdi, rsi
shl rdi, 5
add rdi, r14
mov r14, qword [rdi + 0x10]
mov r8, rdi
mov r12, qword [rdi + 0x18]
cmp r12, 0x10
jb 0x140002f93
mov r8, qword [rdi]
movabs rdx, 0xcbf29ce484222325
mov rcx, r15
test r14, r14
je 0x140002fc8
movabs r12, 0x100000001b3
nop
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r12
inc rcx
cmp rcx, r14
jb 0x140002fb0
mov r12, qword [rdi + 0x18]
mov rcx, qword [rbp + 0x40]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x28]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [rbp + 0x18]
je 0x140003731
mov r15, qword [rax + rcx*8]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140003002
mov rdx, qword [rdx]
mov rcx, rdi
cmp r12, 0x10
jb 0x14000300e
mov rcx, qword [rdi]
cmp r14, rax
jne 0x14000301f
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000302e
cmp rbx, r15
je 0x140003731
mov rbx, qword [rbx + 8]
jmp 0x140002ff0
test rbx, rbx
je 0x140003731
lea rdx, [rbx + 0x30]
mov r8, qword [rdx + 0x10]
mov rcx, r13
cmp qword [rdx + 0x18], 0x10
jb 0x14000304c
mov rdx, qword [rdx]
call fcn.140001810
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
shl rcx, 5
mov r14, qword [rbp - 0x68]
add rcx, r14
shl rsi, 5
cmp qword [rcx + 0x18], 0x10
jb 0x140003087
mov rsi, qword [rsi + r14]
mov r8, qword [rcx]
add r8, qword [rcx + 0x10]
jmp 0x140003091
mov r8, qword [rcx + 0x10]
add r8, rcx
add rsi, r14
xor r15d, r15d
mov qword [rbp - 0x10], r15
mov eax, 0xf
mov qword [rbp - 8], rax
mov byte [rbp - 0x20], r15b
cmp rsi, r8
je 0x1400030bd
sub r8, rsi
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.140004210
mov rax, qword [rbp - 8]
lea r12, [rbp - 0x20]
cmp rax, 0x10
cmovae r12, qword [rbp - 0x20]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x14001fb90]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003590
mov r13d, r15d
mov dword [rbp + 0x960], 0x400
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x960]
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140003583
nop
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000353d
mov dword [rbp + 0x978], 0x400
lea rax, [rbp + 0x978]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001fbe0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140003532
mov rdx, r12
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
jne 0x140003532
lea rdx, [rsp + 0x48]
call fcn.1400021f0
nop
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov rbx, qword [rsp + 0x58]
lea r15, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x60]
cmp r14, 0x10
cmovae r15, rsi
cmp rbx, 0x10
jae 0x140003218
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 0xf
jmp 0x1400032a5
mov rdi, rbx
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000326c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000373f
mov rcx, rax
call fcn.14001c028
mov rcx, rax
test rax, rax
je 0x140003662
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000327a
test rcx, rcx
je 0x140003278
call fcn.14001c028
jmp 0x14000327a
xor eax, eax
mov qword [rsp + 0x70], rax
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea r15, [rsp + 0x48]
cmp r14, 0x10
cmovae r15, rsi
add r15, rbx
lea rdi, [rsp + 0x48]
cmp r14, 0x10
cmovae rdi, rsi
add rdi, rbx
lea rcx, [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rsi
mov r8, rdi
sub r8, rcx
mov edx, 0x2d
call fcn.14001cfc1
mov rcx, rdi
test rax, rax
cmovne rcx, rax
mov r8, rcx
cmp rcx, rdi
je 0x140003324
inc rcx
cmp rcx, rdi
je 0x140003324
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0x2d
je 0x14000330d
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rdi
jne 0x140003300
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x48]
cmp r14, 0x10
cmovae rax, rsi
mov rdx, r8
sub rdx, rax
sub r15, r8
mov rax, rbx
sub rax, rdx
cmp rax, r15
cmovb r15, rax
lea rcx, [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rsi
add rcx, rdx
sub rbx, r15
mov qword [rsp + 0x58], rbx
sub rbx, rdx
lea r8, [rbx + 1]
lea rdx, [rcx + r15]
call sub.VCRUNTIME140.dll_memmove
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae r8, qword [rsp + 0x48]
add r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
xor r15d, r15d
mov qword [rbp - 0x30], r15
mov eax, 0xf
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x40], r15b
cmp rdx, r8
je 0x1400033bf
sub r8, rdx
lea rcx, [rbp - 0x40]
call fcn.140004210
mov rax, qword [rbp - 0x28]
lea rcx, [rbp - 0x40]
cmp rax, 0x10
cmovae rcx, qword [rbp - 0x40]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400033d3
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14001fbf0]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000345d
lea rdx, [0x14001fc00]
mov rcx, qword [0x14001f2f0]
call fcn.140004510
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
call fcn.140001810
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, r12
xor edx, edx
call fcn.140003750
mov r8, r12
mov edx, 1
call fcn.140003750
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140003498
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000365b
call fcn.14001c064
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400034e4
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003662
call fcn.14001c064
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003532
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000352d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003669
call fcn.14001c064
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x960], 0x400
inc r13d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x960]
lea r8, [rbp + 0x50]
mov edx, r13d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140003140
mov r14, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400035b3
lea rdx, [0x14001fc10]
mov rcx, qword [0x14001f298]
call fcn.140004510
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14001fc58]
mov rcx, qword [0x14001f2f0]
call fcn.140004510
lea rdx, [0x1400015f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, dword [rbp + 0x968]
inc edi
mov dword [rbp + 0x968], edi
mov rsi, qword [rbp - 0x50]
inc rsi
mov qword [rbp - 0x50], rsi
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003626
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003621
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003670
call fcn.14001c064
mov eax, dword [rbp + 0x970]
inc eax
cmp edi, eax
jge 0x140003677
lea rdx, [0x14001fb70]
mov rcx, qword [0x14001f2f0]
call fcn.140004510
movsxd rcx, dword [rbp - 0x70]
mov rbx, qword [rbp]
cmp rbx, rcx
jbe 0x140003745
jmp 0x140002f20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001c064
mov qword [rbp + 0x28], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x18]
call fcn.1400039c0
nop
test r14, r14
je 0x14000371d
mov rdx, qword [rbp - 0x60]
mov rcx, r14
call fcn.140004d10
mov rdx, qword [rbp - 0x48]
sub rdx, r14
and rdx, 0xffffffffffffffe0
mov rax, r14
cmp rdx, 0x1000
jb 0x140003715
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003715
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14001c064
add rsp, 0xa18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x14001fc98]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
call fcn.140001210
nop
call fcn.140004140
int3