Function at 0x14029f3ab
Capabilities:
Authenticate hmac
Query or enumerate registry value

Disassembly:
push rax
pushf
mov eax, 0x7fb2f777
pushf
not eax
add eax, 0xafd68144
xor eax, 0xb75cff0a
rol eax, 0x28
popf
pushf
not eax
add eax, 0xc7177d4e
xor eax, 0xa0a0f84a
rol eax, 0x51
popf
pushf
not eax
add eax, 0xc6d25f63
xor eax, 0xb248a19c
rol eax, 0x81
popf
pushf
not eax
add eax, 0xca5efadc
xor eax, 0x927e98de
rol eax, 0xac
popf
cmp eax, 4
jne 0x14029f40e
popf
pop rax
jmp 0x14029fa43
cmp eax, 0
jne 0x14029f41d
popf
pop rax
jmp 0x14029f459
cmp eax, 3
jne 0x14029f42c
popf
pop rax
jmp 0x14029f98c
cmp eax, 1
jne 0x14029f43b
popf
pop rax
jmp 0x14029f6a4
cmp eax, 5
jne 0x14029f44a
popf
pop rax
jmp 0x14029fa97
cmp eax, 2
jne 0x14029f459
popf
pop rax
jmp 0x14029f981
push rbp
push r14
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
movdqa xmm1, xmmword [0x140092790]
mov r8b, 0x64
pushf
not r8b
add r8b, 0x9b
xor r8b, 0x8a
rol r8b, 0x79
popf
pushf
not r8b
add r8b, 8
xor r8b, 0x2f
rol r8b, 0xac
popf
pushf
not r8b
add r8b, 0xcc
xor r8b, 0xe2
rol r8b, 0xda
popf
pushf
not r8b
add r8b, 0xa9
xor r8b, 0x80
rol r8b, 0x5a
popf
movd ecx, xmm1
movzx r9d, r8b
movdqa xmm2, xmmword [0x140092810]
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0x13], xmm2
xor byte [rbp + 0x14], cl
xor r8b, cl
xor byte [rbp + 0x15], cl
xor r9b, cl
xor byte [rbp + 0x16], cl
mov dl, 0x82
pushf
not dl
add dl, 0x47
xor dl, 0xc2
rol dl, 0x96
popf
pushf
not dl
add dl, 0x95
xor dl, 0x7f
rol dl, 0xd6
popf
pushf
not dl
add dl, 0xb
xor dl, 0xf2
rol dl, 0xa7
popf
pushf
not dl
add dl, 0xc1
xor dl, 0xc0
rol dl, 0x3f
popf
xor byte [rbp + 0x17], cl
xor dl, cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor byte [rbp + 0x20], cl
xor byte [rbp + 0x21], cl
xor byte [rbp + 0x22], cl
movdqu xmmword [rbp + 3], xmm1
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0x23], dl
lea rdx, [rbp + 4]
mov byte [rbp + 0x24], r8b
xor r8d, r8d
xor al, cl
mov byte [rbp + 0x25], r9b
mov byte [rbp + 4], al
mov r9d, 0x4cc0df57
pushf
not r9d
add r9d, 0xd2d18698
xor r9d, 0xcef28c77
rol r9d, 0x78
popf
pushf
not r9d
add r9d, 0x8ced85cc
xor r9d, 0xe76ec7f6
rol r9d, 0xbe
popf
pushf
not r9d
add r9d, 0xc0e45a8d
xor r9d, 0xe4313174
rol r9d, 0x44
popf
movd eax, xmm2
mov byte [rbp + 0x26], 0
xor al, cl
mov rcx, 0xffffffff80000001
mov byte [rbp + 0x13], al
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
jmp 0x14029f60a
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14029f64b
push rax
pushf
mov eax, 0x36457c7c
pushf
not eax
add eax, 0xac021b4f
xor eax, 0xb6c8828c
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xd191a1c3
xor eax, 0xe01693f2
rol eax, 0x41
popf
jmp 0x14029f3ff
push rax
pushf
mov eax, 0x85d47c87
pushf
not eax
add eax, 0xf128d43c
xor eax, 0xcc47df36
rol eax, 0x43
popf
pushf
not eax
add eax, 0xd4946656
xor eax, 0xd9090b02
rol eax, 0x49
popf
pushf
not eax
add eax, 0xc120a69b
xor eax, 0xb089b2f4
rol eax, 0x64
popf
pushf
not eax
add eax, 0xdcefe32d
xor eax, 0xf876d456
rol eax, 0x3a
popf
jmp 0x14029f3ff
mov qword [rsp + 0x80], rbx
mov r10b, 0xa5
pushf
not r10b
add r10b, 0xd4
xor r10b, 0x9f
rol r10b, 0xd1
popf
pushf
not r10b
add r10b, 0x3f
xor r10b, 0xd4
rol r10b, 0x65
popf
pushf
not r10b
add r10b, 0x9b
xor r10b, 0x15
rol r10b, 0x99
popf
mov qword [rsp + 0x78], rsi
mov al, 0x5c
pushf
not al
add al, 0x95
xor al, 0xa4
rol al, 1
popf
pushf
not al
add al, 0xd
xor al, 0xdd
rol al, 0x75
popf
pushf
not al
add al, 0x64
xor al, 0x3e
rol al, 0x48
popf
pushf
not al
add al, 0xa1
xor al, 0xf1
rol al, 0x46
popf
xor al, 0x3c
mov qword [rsp + 0x70], rdi
mov byte [rbp - 8], al
movzx edi, r10b
mov cl, 0xb1
pushf
not cl
add cl, 0xd
xor cl, 0xd9
rol cl, 0x43
popf
pushf
not cl
add cl, 0xa
xor cl, 0x57
rol cl, 0x2b
popf
pushf
not cl
add cl, 7
xor cl, 0x8c
rol cl, 0x36
popf
mov qword [rsp + 0x68], r15
xor cl, 0x3c
mov dword [rbp + 0x77], 4
mov dl, 0xfc
pushf
not dl
add dl, 0xa3
xor dl, 0x31
rol dl, 0xc2
popf
pushf
not dl
add dl, 0x31
xor dl, 0xda
rol dl, 0xeb
popf
pushf
not dl
add dl, 0x7e
xor dl, 0x34
rol dl, 0xf3
popf
mov byte [rbp - 7], cl
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
xor dl, 0x3c
mov qword [rsp + 0x28], rax
mov r8b, 0xd1
pushf
not r8b
add r8b, 0xf7
xor r8b, 0x29
rol r8b, 0xfa
popf
pushf
not r8b
add r8b, 0xb5
xor r8b, 0x2e
rol r8b, 0x15
popf
mov byte [rbp - 6], dl
xor r8b, 0x3c
mov dword [rbp + 0x6f], 4
mov r9b, 0x87
pushf
not r9b
add r9b, 5
xor r9b, 0x8a
rol r9b, 0x77
popf
pushf
not r9b
add r9b, 0x98
xor r9b, 0x38
rol r9b, 0xe4
popf
mov byte [rbp - 5], r8b
xor r9b, 0x3c
mov byte [rbp - 9], 0x3c
mov r11b, 0xa3
pushf
not r11b
add r11b, 0x59
xor r11b, 0xfb
rol r11b, 0x5e
popf
pushf
not r11b
add r11b, 0x71
xor r11b, 0x78
rol r11b, 0xbe
popf
mov byte [rbp - 4], r9b
lea rax, [rbp + 0x67]
xor r14d, r14d
xor r10b, 0x3c
mov qword [rsp + 0x20], rax
xor r11b, 0x3c
mov dword [rbp + 0x67], r14d
mov bl, 0x2a
pushf
not bl
add bl, 0x5d
xor bl, 7
rol bl, 0xb6
popf
pushf
not bl
add bl, 0xb7
xor bl, 0x74
rol bl, 0x73
popf
pushf
not bl
add bl, 0x86
xor bl, 0xd2
rol bl, 0x20
popf
mov byte [rbp - 3], r10b
mov sil, 0xac
pushf
not sil
add sil, 0x48
xor sil, 0x7d
rol sil, 0x8e
popf
pushf
not sil
add sil, 0xcf
xor sil, 0x67
rol sil, 0xc5
popf
mov byte [rbp - 2], r11b
xor bl, 0x3c
mov byte [rbp + 2], r14b
xor dil, 0x3c
mov byte [rbp - 1], bl
xor sil, 0x3c
mov byte [rbp], dil
lea r9, [rbp + 0x77]
mov byte [rbp + 1], sil
xor r8d, r8d
lea rdx, [rbp - 8]
jmp 0x14029f8e7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
test eax, eax
jne 0x14029f94e
push rax
pushf
mov eax, 0x1992e631
pushf
not eax
add eax, 0x8854aaac
xor eax, 0x9d3c6953
rol eax, 0x31
popf
pushf
not eax
add eax, 0x9ace0e73
xor eax, 0xe8db4776
rol eax, 0x38
popf
pushf
not eax
add eax, 0x9e399d90
xor eax, 0x9490fc2e
rol eax, 0xe6
popf
jmp 0x14029f3ff
push rax
pushf
mov eax, 0x76eaa0dc
pushf
not eax
add eax, 0xcc7cf364
xor eax, 0xe0ccef03
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xcd55411f
xor eax, 0xa7824b32
rol eax, 0x8d
popf
jmp 0x14029f3ff
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x14029fa43
mov r14d, eax
movabs rax, 0x4656d220210f3e34
pushf
not rax
add rax, 0x7f8e8f3f
xor rax, 0x6ab3b5be
rol rax, 0x1b
popf
pushf
not rax
add rax, 0x6101acfc
xor rax, 0x44cb9c51
rol rax, 0x61
popf
pushf
not rax
add rax, 0x65936f13
xor rax, 0x68e07d5d
rol rax, 0xd2
popf
push rax
not rax
sub r14, rax
pop rax
sub r14, 1
push rax
pushf
mov eax, 0x2c5de135
pushf
not eax
add eax, 0xb275c871
xor eax, 0xf99fa2f7
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xcfe89350
xor eax, 0xbde7a367
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xa07433c1
xor eax, 0xff98f80f
rol eax, 0xc
popf
pushf
not eax
add eax, 0xbb07c4b9
xor eax, 0xa338973d
rol eax, 5
popf
jmp 0x14029f3ff
mov rax, r14
add rsp, 0x88
pop r14
pop rbp
ret
xor eax, eax
add rsp, 0x88
pop r14
pop rbp
ret