Function at 0x14001e9d0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xca0]
sub rsp, 0xda0
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xdf0], rbx
mov rax, qword [0x1401c3e90]
xor rax, rsp
mov qword [rbp + 0xc90], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x38], rcx
mov eax, dword [0x1401cbd80]
imul eax, eax
and eax, 0x8000000f
jge 0x14001ea31
dec eax
or eax, 0xfffffff0
inc eax
xor r14d, r14d
cmp eax, 2
jne 0x14001ea6f
lea ecx, [rax + 0x26]
call fcn.1400d0cc8
mov rdi, rax
mov ebx, r14d
call fcn.1400d2038
add eax, dword [0x1401cbd80]
mov dword [rdi + rbx*4], eax
inc rbx
cmp rbx, 0xa
jl 0x14001ea47
mov ecx, dword [rdi + 0x24]
mov dword [0x1401cbd80], ecx
mov rcx, rdi
call fcn.1400d272c
movzx eax, byte [0x1401cbd84]
neg al
sbb rbx, rbx
add rbx, 0xffffffff80000002
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, dword [0x1401cbd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 9
jne 0x14001eaf0
mov ecx, r14d
lea rdx, [rbp + 0x40]
nop
mov eax, dword [rdx]
imul eax, eax, 0x55
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x324
jb 0x14001ead0
mov dword [0x1401cbd80], r8d
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r14
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [0x140156ad8]
test rdx, 0xffffffffffff0000
jne 0x14001eb4a
movzx edi, dx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14001eb55
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400025b0
jmp 0x14001eb55
lea rcx, [rsp + 0x50]
call fcn.140003350
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140010500
nop
lea r8, [0x1401cc220]
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140010500
nop
lea r8, [0x140156a68]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14001c930
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140010500
nop
mov qword [rbp - 0x80], r14
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r13d, 1
mov r9d, r13d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x14001ebdd
mov dword [rsp + 0x60], r14d
mov ecx, r14d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x58], rax
test ecx, ecx
setne bl
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
lock add dword [rdx + 0x10], r12d
jg 0x14001ebff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ec18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ec31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ec4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ec63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14001ecbe
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001ec7c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001eca0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001ecb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14001f4e7
mov dword [rsp + 0x48], 0x400
mov word [rbp + 0x490], r14w
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x492]
call fcn.1400d6ac0
call fcn.14001dda0
test al, al
jne 0x14001ed17
mov ecx, r13d
mov r8d, dword [0x1401cbd80]
cmp r8d, ecx
jle 0x14001ed0f
nop word [rax + rax]
mov eax, r8d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r8d
jl 0x14001ed00
mov dword [0x1401cbd80], ecx
jmp 0x14001ed1d
mov ecx, dword [0x1401cbd80]
mov ebx, r14d
imul ecx, ecx
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 7
jne 0x14001edb6
mov word [rbp + 0x370], r14w
xor edx, edx
mov r8d, 0x11e
lea rcx, [rbp + 0x372]
call fcn.1400d6ac0
mov r10, r14
mov r9, r14
mov r8, r14
test r10, r10
je 0x14001ed90
test r8, r8
je 0x14001ed90
lea rdx, [r9 + r8]
lea rax, [r9 + r8]
movzx ecx, word [rbp + rax*2 + 0x358]
inc cx
add cx, word [rbp + rdx*2 + 0x36e]
mov word [rbp + rdx*2 + 0x370], cx
inc r8
cmp r8, 0xc
jl 0x14001ed63
inc r10
add r9, 0xc
cmp r9, 0x90
jl 0x14001ed60
movsx eax, word [rbp + 0x48e]
mov dword [0x1401cbd80], eax
mov rdi, qword [rsp + 0x58]
nop dword [rax + rax]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x490]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
mov dword [rsp + 0x4c], eax
inc ebx
mov dword [rsp + 0x78], ebx
call fcn.14001dcf0
test al, al
jne 0x14001ef17
mov rbx, r14
call fcn.1400d2038
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [rbp + rbx*8 - 0x30], xmm0
inc rbx
cmp rbx, 0xd
jb 0x14001ee07
mov r8, r14
mov r9d, 0xc
lea r10d, [r9 + 1]
mov ecx, 0xc
cmp r8, rcx
jge 0x14001ef08
cmp r9, 4
jl 0x14001eedd
lea rax, [rbp + 0x20]
mov edx, 8
sub rdx, r8
shr rdx, 2
inc rdx
mov ecx, 3
sub rcx, rdx
shl rcx, 2
nop word [rax + rax]
movsd xmm0, qword [rax + 0x10]
movsd xmm1, qword [rax + 8]
comisd xmm0, xmm1
jbe 0x14001ee8a
movsd qword [rax + 0x10], xmm1
movsd qword [rax + 8], xmm0
movsd xmm0, qword [rax + 8]
movsd xmm1, qword [rax]
comisd xmm0, xmm1
jbe 0x14001eea2
movsd qword [rax + 8], xmm1
movsd qword [rax], xmm0
movsd xmm0, qword [rax]
movsd xmm1, qword [rax - 8]
comisd xmm0, xmm1
jbe 0x14001eeba
movsd qword [rax], xmm1
movsd qword [rax - 8], xmm0
movsd xmm0, qword [rax - 8]
movsd xmm1, qword [rax - 0x10]
comisd xmm0, xmm1
jbe 0x14001eed4
movsd qword [rax - 8], xmm1
movsd qword [rax - 0x10], xmm0
sub rax, 0x20
dec rdx
jne 0x14001ee70
cmp rcx, r8
jle 0x14001ef08
movsd xmm0, qword [rbp + rcx*8 - 0x30]
movsd xmm1, qword [rbp + rcx*8 - 0x38]
comisd xmm0, xmm1
jbe 0x14001ef00
movsd qword [rbp + rcx*8 - 0x30], xmm1
movsd qword [rbp + rcx*8 - 0x38], xmm0
dec rcx
cmp rcx, r8
jg 0x14001eee2
inc r8
dec r9
dec r10
jne 0x14001ee30
test esi, esi
je 0x14001ef27
cmp esi, 0x103
jne 0x14001f397
lea rcx, [0x1401c39a8]
mov rax, qword [0x1401c39a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rcx, [rbp + 0x490]
lea rax, [rbp + 0x490]
test rax, 0xffffffffffff0000
jne 0x14001ef84
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14001f06f
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400025b0
mov rbx, qword [rsp + 0x40]
jmp 0x14001f06f
lea rax, [rbp + 0x490]
mov rdi, r12
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14001ef90
test edi, edi
jne 0x14001eff0
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14001f06f
cmp dword [rdx + 0x10], 0
jge 0x14001efcc
cmp dword [rbx - 0xc], 0
jl 0x14001f403
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x14001f06f
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001efdc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
jmp 0x14001f06f
mov r14d, dword [rbx - 0x10]
lea rsi, [rbp + 0x490]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x14001f4dc
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14001f029
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400023b0
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp rsi, r14
lea r14, [rax + rax]
mov r9, r14
ja 0x14001f04d
lea r8, [rbx + rsi*2]
call fcn.1400d1ea4
jmp 0x14001f059
lea r8, [rbp + 0x490]
call fcn.1400d2064
cmp edi, dword [rbx - 0xc]
jg 0x14001f4d1
mov dword [rbx - 0x10], edi
xor eax, eax
mov word [r14 + rbx], ax
xor r14d, r14d
cmp dword [rbx - 0x10], 0
je 0x14001f35d
mov rcx, qword [r15 + 8]
lea rax, [rsp + 0x40]
cmp rax, rcx
jae 0x14001f19c
mov r8, qword [r15]
lea rax, [rsp + 0x40]
cmp r8, rax
ja 0x14001f19c
lea rdi, [rsp + 0x40]
sub rdi, r8
sar rdi, 3
mov rdx, qword [r15 + 0x10]
cmp rcx, rdx
jne 0x14001f115
mov rax, rdx
sub rax, rcx
sar rax, 3
cmp rax, 1
jae 0x14001f115
sub rcx, r8
sar rcx, 3
movabs r10, 0x1fffffffffffffff
mov rax, r10
sub rax, rcx
cmp rax, 1
jb 0x14001f40e
lea r9, [rcx + 1]
sub rdx, r8
sar rdx, 3
mov rcx, rdx
shr rcx, 1
mov rax, r10
sub rax, rcx
cmp rax, rdx
jae 0x14001f103
mov rdx, r14
jmp 0x14001f106
add rdx, rcx
cmp rdx, r9
cmovb rdx, r9
mov rcx, r15
call fcn.14001fe70
mov rax, qword [r15]
mov r14, qword [r15 + 8]
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
test r14, r14
je 0x14001f197
mov rdi, qword [rax + rdi*8]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14001f155
cmp rax, qword [rdi - 0x18]
jne 0x14001f155
lea rsi, [rdi - 0x18]
lock inc dword [rdi - 8]
mov rbx, qword [rsp + 0x40]
jmp 0x14001f190
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14001f41b
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.1400d2064
lea rax, [rsi + 0x18]
mov qword [r14], rax
jmp 0x14001f287
mov rdx, qword [r15 + 0x10]
cmp rcx, rdx
jne 0x14001f20c
mov rax, rdx
sub rax, rcx
sar rax, 3
cmp rax, 1
jae 0x14001f20c
mov r8, qword [r15]
sub rcx, r8
sar rcx, 3
movabs r10, 0x1fffffffffffffff
mov rax, r10
sub rax, rcx
cmp rax, 1
jb 0x14001f421
lea r9, [rcx + 1]
sub rdx, r8
sar rdx, 3
mov rcx, rdx
shr rcx, 1
mov rax, r10
sub rax, rcx
cmp rax, rdx
jae 0x14001f1fa
mov rdx, r14
jmp 0x14001f1fd
add rdx, rcx
cmp rdx, r9
cmovb rdx, r9
mov rcx, r15
call fcn.14001fe70
mov r14, qword [r15 + 8]
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x70], r14
test r14, r14
je 0x14001f287
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x14001f245
cmp rax, qword [rbx - 0x18]
jne 0x14001f245
lea rsi, [rbx - 0x18]
lock inc dword [rbx - 8]
mov rbx, qword [rsp + 0x40]
jmp 0x14001f280
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14001f42e
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.1400d2064
lea rax, [rsi + 0x18]
mov qword [r14], rax
add qword [r15 + 8], 8
mov r8d, dword [0x1401cbd80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
xor r14d, r14d
cmp ecx, 4
jne 0x14001f35d
mov edx, r14d
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x14001f2c3
mov dword [0x1401cbd80], r8d
mov dword [rsp + 0x48], 0x400
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x490]
call fcn.1400d6ac0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f38e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x4c]
mov rdi, qword [rsp + 0x58]
mov ecx, dword [0x1401cbd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 9
jne 0x14001f3f6
mov eax, 0xcb
mov r8d, 0xc9
test r8d, r8d
je 0x14001f3ed
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x14001f3d8
add eax, r8d
mov dword [0x1401cbd80], eax
test esi, esi
jne 0x14001f434
mov ebx, dword [rsp + 0x78]
jmp 0x14001edc0
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, str.vector_T__too_long
call fcn.1400d0c58
nop
call fcn.1400024a0
nop
lea rcx, str.vector_T__too_long
call fcn.1400d0c58
nop
call fcn.1400024a0
nop
test rdi, rdi
je 0x14001f44a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
call fcn.14001dc50
test al, al
jne 0x14001f47b
mov ecx, dword [0x1401cbd80]
cmp ecx, 1
jle 0x14001f474
mov eax, ecx
cdq
idiv r13d
inc r13d
add r13d, edx
cmp r13d, ecx
jl 0x14001f463
mov dword [0x1401cbd80], r13d
test rdi, rdi
je 0x14001f48e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], r14d
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
jg 0x14001f4b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
mov rdx, qword [rdx]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14001f4cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x14001f4e7
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov rcx, qword [rbp + 0xc90]
xor rcx, rsp
call fcn.1400d1680
mov rbx, qword [rsp + 0xdf0]
add rsp, 0xda0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret