Function at 0x140002790
Capabilities:
Encode data using xor
Get cpu information
Get disk information
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
movsxd rcx, ecx
call fcn.140052590
call fcn.1400525d0
call fcn.1400469e0
call fcn.140046254
call fcn.1400525d0
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
lea rdi, [rsp + 0x98]
lea rdx, [0x140138d00]
mov rcx, rdi
call fcn.140052970
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
mov ecx, 0x100
call fcn.140050e20
call fcn.140052710
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x50], rcx
mov edx, eax
call fcn.1400528a0
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
mov ecx, 0x100
call fcn.140050e20
call fcn.140052710
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x48], rcx
mov edx, eax
call fcn.1400528a0
mov qword [rsp + 0x38], 0x100
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
mov r8d, 0x100
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call sub.KERNEL32.dll_GetVolumeInformationW
call fcn.140052800
call fcn.140052800
call fcn.140052710
movsxd rcx, dword [rsp + 0x64]
mov edx, eax
call fcn.140050ec0
call fcn.140052710
lea r14, [rsp + 0x90]
mov edx, eax
mov rcx, r14
call fcn.1400528a0
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x90]
call fcn.1400474a0
call fcn.140052710
mov edx, eax
lea rcx, [0x1402304a8]
call fcn.1400528a0
mov rdx, qword [0x1402304a8]
lea rcx, [0x140230880]
call fcn.1400526d0
test eax, eax
je 0x140002a47
mov rcx, qword [rsp + 0x90]
call fcn.140052930
mov rcx, qword [rsp + 0x98]
call fcn.140052930
mov rcx, qword [rsp + 0xa0]
call fcn.140052930
mov rcx, qword [rsp + 0xa8]
call fcn.140052930
call fcn.140052800
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
lea rcx, str.OSMSG
call fcn.1400014d0
call fcn.140052950
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
lea rcx, str.CRIT
call fcn.1400014d0
call fcn.1400527d0
mov rbx, rax
call fcn.1400527d0
mov rdx, rax
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.14001f458
call fcn.140052760
call fcn.140002720
mov rcx, qword [0x1402307b8]
call sub.KERNEL32.dll_HeapDestroy
movsxd rcx, dword [0x1402307c0]
call sub.KERNEL32.dll_ExitProcess
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x1402304a8]
call fcn.140051010
mov rbx, rax
mov rcx, qword [rsp + 0x90]
call fcn.140052930
mov rcx, qword [rsp + 0x98]
call fcn.140052930
mov rcx, qword [rsp + 0xa0]
call fcn.140052930
mov rcx, qword [rsp + 0xa8]
call fcn.140052930
cmp rbx, 0x20
jne 0x140002990
call fcn.1400525d0
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rax
lea r9, [0x14022f2c0]
mov r8d, 8
mov edx, 2
mov ecx, 8
call fcn.14004a7b8
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 1
mov edx, 0xa5
mov ecx, 1
call fcn.14004a7b8
mov dword [rsp + 0x6c], 0xa4
call fcn.14004280c
lea rcx, [rsp + 0x80]
cmp rax, 0x28
ja 0x140002b5b
movabs rdx, 0x10040000400
bt rdx, rax
jae 0x140002b5b
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
call fcn.140052970
jmp 0x140002b67
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
call fcn.140052970
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov ecx, 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.DigitalProductID
call sub.ADVAPI32.dll_RegQueryValueExW
mov rcx, qword [rsp + 0x70]
call sub.ADVAPI32.dll_RegCloseKey
call fcn.140052800
call fcn.140052800
call fcn.140052710
movsxd rcx, eax
call fcn.140052590
call fcn.1400525d0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x18
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, 1
call fcn.14004a7b8
mov eax, 0x34
nop dword [rax]
mov rdx, qword [rsp + 0x90]
movzx ecx, byte [rdx + rax]
mov rdx, qword [rsp + 0xa0]
mov byte [rdx + rax - 0x34], cl
add rax, 1
cmp rax, 0x43
jne 0x140002c30
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 1
mov edx, 0x19
mov ecx, 1
call fcn.14004a7b8
lea rcx, [0x1401397f4]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx], al
lea rcx, [0x1401397bc]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 1], al
lea rcx, [0x1401397b8]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 2], al
lea rcx, [0x1401397b4]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 3], al
lea rcx, [0x1401397b0]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 4], al
lea rcx, [0x1401397ac]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 5], al
lea rcx, str.JHGFDC
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 6], al
lea rcx, [0x140139784]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 7], al
lea rcx, [0x140139780]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 8], al
lea rcx, [0x140139762]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 9], al
lea rcx, [0x140139758]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xa], al
lea rcx, [0x140139754]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xb], al
lea rcx, [0x140139714]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xc], al
lea rcx, [0x1401395b8]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xd], al
lea rcx, [0x1401395b4]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xe], al
lea rcx, [0x1401395b0]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0xf], al
lea rcx, [0x14013958e]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x10], al
lea rcx, [0x14013993a]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x11], al
lea rcx, [0x140139936]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x12], al
lea rcx, [0x140139932]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x13], al
lea rcx, [0x14013992e]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x14], al
lea rcx, [0x14013992a]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x15], al
lea rcx, [0x140139926]
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x16], al
lea rcx, reloc.WS2_32.dll_gethostname
call fcn.140051030
mov rdx, qword [rsp + 0xa8]
mov byte [rdx + 0x17], al
mov esi, 0x18
movsd xmm6, qword [0x1400f0b48]
movabs rbx, 0x2aaaaaaaaaaaaaab
movabs r12, 0xcccccccccccccccd
movabs rbp, 0x1999999999999999
jmp 0x140002eda
sub rsi, 1
jb 0x140002fed
xor edx, edx
mov r15d, reloc.WS2_32.dll_ntohl
nop word [rax + rax]
shl rdx, 8
mov rax, qword [rsp + 0xa0]
movzx r8d, byte [rax + r15]
xor r8, rdx
mov r13, r8
pxor xmm0, xmm0
cvtsi2sd xmm0, r8
divsd xmm0, xmm6
call fcn.14003d530
mov rdx, qword [rsp + 0xa0]
mov byte [rdx + r15], al
mov rax, r13
imul rbx
sar rdx, 2
mov rax, r13
sar rax, 0x3f
sub rdx, rax
lea rax, [rdx + rdx*2]
shl rax, 3
mov rdx, r13
sub rdx, rax
sub r15, 1
jae 0x140002ee8
mov qword [rsp + 0x40], rdx
call fcn.140052800
call fcn.140052800
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x40]
movsx r15, byte [rax + rdx]
call fcn.140052710
mov edx, eax
mov rcx, r15
call fcn.140051040
mov rcx, qword [rsp + 0x98]
call fcn.140052830
call fcn.140052710
mov edx, eax
mov rcx, rdi
call fcn.1400528a0
mov rax, rsi
imul rax, r12
add rax, rbp
movabs rdx, 0x3333333333333332
cmp rdx, rax
jb 0x140002ed0
test rsi, rsi
je 0x140002ed0
call fcn.140052800
lea rcx, [0x1401399d0]
call fcn.140052830
mov rcx, qword [rsp + 0x98]
call fcn.140052830
call fcn.140052710
mov edx, eax
mov rcx, rdi
call fcn.1400528a0
sub rsi, 1
jmp 0x140002eda
call fcn.140052800
mov rcx, qword [rsp + 0x98]
call fcn.140052830
call fcn.1400527d0
mov rcx, qword [rsp + 0x98]
call fcn.140052930
mov rcx, qword [rsp + 0xa0]
call fcn.14004a970
mov rcx, qword [rsp + 0xa8]
call fcn.14004a970
call fcn.140052710
mov edx, eax
mov rcx, qword [rsp + 0x88]
call fcn.1400528a0
call fcn.140052800
call fcn.140052800
mov rax, qword [rsp + 0x88]
mov rbx, qword [rax]
call fcn.140052710
mov r8d, eax
mov edx, 1
mov rcx, rbx
call fcn.1400474a0
call fcn.140052710
mov edx, eax
lea rcx, [0x1402304a0]
call fcn.1400528a0
mov rdx, qword [0x1402304a0]
lea rcx, [0x140230880]
call fcn.1400526d0
test eax, eax
je 0x1400030bf
mov rcx, qword [rsp + 0x80]
call fcn.140052930
mov rcx, qword [rsp + 0x88]
call fcn.14004a970
mov rcx, qword [rsp + 0x90]
call fcn.14004a970
jmp 0x140002990
mov rcx, qword [0x1402304a0]
call fcn.140051010
mov rbx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140052930
mov rcx, qword [rsp + 0x88]
call fcn.14004a970
mov rcx, qword [rsp + 0x90]
call fcn.14004a970
cmp rbx, 0x20
jne 0x140002990
call fcn.1400525d0
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, rdi
call fcn.140052970
lea rdx, str.ProcessorNameString
mov rcx, qword [rsp + 0x48]
call fcn.140052970
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
mov ecx, 0x270f
call fcn.140050e20
call fcn.140052710
mov edx, eax
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.1400528a0
mov dword [rsp + 0x88], 0xff
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov ecx, 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
test rax, rax
je 0x1400032b8
call fcn.140052800
call fcn.140052800
call fcn.140052800
call fcn.140052800
call fcn.140052710
mov edx, eax
mov rcx, qword [rsp + 0xa0]
call fcn.140051070
call fcn.1400527d0
mov rbx, rax
call fcn.140052710
mov r8d, eax
mov edx, 1
mov rcx, rbx
call fcn.1400474a0
call fcn.140052710
mov edx, eax
lea rcx, [0x140230498]
call fcn.1400528a0
mov rdx, qword [0x140230498]
lea rcx, [0x140230880]
call fcn.1400526d0
test eax, eax
jne 0x140002969
mov rcx, qword [0x140230498]
call fcn.140051010
mov rbx, rax
mov rcx, qword [rsp + 0x98]
call fcn.140052930
mov rcx, qword [rsp + 0xa0]
call fcn.140052930
mov rcx, qword [rsp + 0xa8]
call fcn.140052930
cmp rbx, 0x20
jne 0x140002990
call fcn.14004280c
cmp rax, 0x50
je 0x14000331e
cmp rax, 0x5a
je 0x14000331e
cmp rax, 0x78
jg 0x140003312
cmp rax, 0x63
jle 0x140002990
sub rax, 0x64
mov edx, 0x100401
bt rdx, rax
jae 0x140002990
jmp 0x14000331e
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xa8]
call sub.ADVAPI32.dll_RegQueryValueExW
test rax, rax
jne 0x140003301
mov rcx, qword [rsp + 0x90]
call sub.ADVAPI32.dll_RegCloseKey
jmp 0x1400031c2
lea rdx, [0x1401373c2]
mov rcx, rdi
call fcn.140052970
jmp 0x1400032ef
cmp rax, 0xc8
jne 0x140002990
call fcn.140052800
call fcn.140052800
call fcn.140052800
call fcn.140052800
call fcn.140052800
mov rcx, qword [0x1402304a8]
call fcn.140052830
mov rcx, qword [0x1402304a0]
call fcn.140052830
mov rcx, qword [0x140230498]
call fcn.140052830
call fcn.1400527d0
mov rbx, rax
call fcn.140052710
mov r9d, eax
mov r8d, 0x100
mov edx, 5
mov rcx, rbx
call fcn.1400475a0
call fcn.1400527d0
mov rbx, rax
call fcn.140052710
mov edx, eax
mov rcx, rbx
call fcn.140051160
call fcn.1400527d0
jmp 0x140002a2b