Function at 0x14030ea36
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
push rax
pushf
mov eax, 0x44679605
pushf
not eax
add eax, 0xc4fd0c7d
xor eax, 0xafdd4bcd
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xf79ffac4
xor eax, 0xc74e83cd
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xc5271b85
xor eax, 0xfc419291
rol eax, 0xff
popf
cmp eax, 4
jne 0x14030ea86
popf
pop rax
jmp 0x14030f3db
cmp eax, 0
jne 0x14030ea95
popf
pop rax
jmp 0x14030eb58
cmp eax, 3
jne 0x14030eaa4
popf
pop rax
jmp 0x14030f2c9
cmp eax, 1
jne 0x14030eab3
popf
pop rax
jmp 0x14030f1cb
cmp eax, 0xd
jne 0x14030eac2
popf
pop rax
jmp 0x14030ffa7
cmp eax, 7
jne 0x14030ead1
popf
pop rax
jmp 0x14030fca2
cmp eax, 0xe
jne 0x14030eae0
popf
pop rax
jmp 0x14031000d
cmp eax, 0xb
jne 0x14030eaef
popf
pop rax
jmp 0x14030fec2
cmp eax, 0xc
jne 0x14030eafe
popf
pop rax
jmp 0x14030ff6a
cmp eax, 8
jne 0x14030eb0d
popf
pop rax
jmp 0x14030fd6f
cmp eax, 5
jne 0x14030eb1c
popf
pop rax
jmp 0x14030fbb8
cmp eax, 2
jne 0x14030eb2b
popf
pop rax
jmp 0x14030f267
cmp eax, 9
jne 0x14030eb3a
popf
pop rax
jmp 0x14030fe23
cmp eax, 0xa
jne 0x14030eb49
popf
pop rax
jmp 0x14030fe73
cmp eax, 6
jne 0x14030eb58
popf
pop rax
jmp 0x14030fc3c
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x14010a0d0]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rbx, rcx
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], rcx
xor edx, edx
mov r8d, 0xe83094e8
pushf
not r8d
add r8d, 0xbe47f1cf
xor r8d, 0xe8399b98
rol r8d, 0x5d
popf
pushf
not r8d
add r8d, 0xad74fa14
xor r8d, 0xe58f2124
rol r8d, 0x94
popf
lea rcx, [rbp + 0x100]
call fcn.14004a970
mov ecx, 0xf7813ae
pushf
not ecx
add ecx, 0xa731f7a0
xor ecx, 0xa85d6b2f
rol ecx, 0xdf
popf
pushf
not ecx
add ecx, 0xec5d92f1
xor ecx, 0xcc6b5701
rol ecx, 0x59
popf
mov dword [rbp - 0x60], 0x600033
mov r13d, 0xe5eaedee
pushf
not r13d
add r13d, 0xd73082a9
xor r13d, 0xeeb0e9ea
rol r13d, 0x12
popf
pushf
not r13d
add r13d, 0xb6f8307b
xor r13d, 0xef01efd2
rol r13d, 0x5a
popf
pushf
not r13d
add r13d, 0xfaab9459
xor r13d, 0xc1add4a0
rol r13d, 0xc6
popf
pushf
not r13d
add r13d, 0xb14149a2
xor r13d, 0x99e5ad6a
rol r13d, 0xbc
popf
mov dword [rsp + 0x30], r13d
mov dword [rbp - 0x5c], 0x75007c
mov dword [rbp - 0x58], 0x640067
mov dword [rbp - 0x54], 0x610072
mov dword [rbp - 0x50], 0x6f0076
mov dword [rbp - 0x4c], 0x5a007e
mov dword [rbp - 0x48], 0x410050
mov dword [rbp - 0x44], 0x40005c
mov dword [rbp - 0x40], 0x55005c
mov dword [rbp - 0x3c], 0x6f0047
mov dword [rbp - 0x38], 0x5a0064
mov dword [rbp - 0x34], 0x57005d
mov dword [rbp - 0x30], 0x44005c
mov dword [rbp - 0x2c], 0x6f0040
mov dword [rbp - 0x28], 0x460070
mov dword [rbp - 0x24], 0x410041
mov dword [rbp - 0x20], 0x5d0056
mov dword [rbp - 0x1c], 0x650047
mov dword [rbp - 0x18], 0x410056
mov dword [rbp - 0x14], 0x5a0040
mov dword [rbp - 0x10], 0x5d005c
mov dword [rbp - 0xc], 0x66006f
mov dword [rbp - 8], 0x5a005d
mov dword [rbp - 4], 0x40005d
mov dword [rbp], 0x520047
mov dword [rbp + 4], 0x5f005f
mov dword [rbp + 8], 0x60006f
mov dword [rbp + 0xc], 0x560047
mov dword [rbp + 0x10], 0x5e0052
lea edi, [rcx - 0x20]
mov dword [rbp + 0x14], 0x720013
mov dword [rbp + 0x18], 0x430043
mov dword [rbp + 0x1c], 0x10013
mov dword [rbp + 0x20], 0x10006
mov dword [rbp + 0x24], 0xa0007
mov dword [rbp + 0x28], 0x330003
movzx eax, word [0x1400f866a]
xor ax, cx
mov word [rbp + 0x2c], ax
movzx eax, word [0x1400f866c]
xor ax, cx
mov word [rbp + 0x2e], ax
movzx eax, word [0x1400f866e]
xor ax, cx
mov word [rbp + 0x30], ax
movzx eax, word [str.InstallLocation]
xor ax, cx
mov word [rbp + 0x32], ax
movzx eax, word [0x1400f8672]
xor ax, cx
mov word [rbp + 0x34], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, cx
mov word [rbp + 0x36], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, cx
mov word [rbp + 0x38], ax
movzx eax, word [0x1400f8678]
xor ax, cx
mov word [rbp + 0x3a], ax
movzx eax, word [0x1400f867a]
xor ax, cx
mov word [rbp + 0x3c], ax
movzx eax, word [0x1400f867c]
xor ax, cx
mov word [rbp + 0x3e], ax
movzx eax, word [0x1400f867e]
xor ax, cx
mov word [rbp + 0x40], ax
movzx eax, word [0x1400f8680]
xor ax, cx
mov word [rbp + 0x42], ax
movzx eax, word [0x1400f8682]
xor ax, cx
mov word [rbp + 0x44], ax
movzx eax, word [0x1400f8684]
xor ax, cx
mov word [rbp + 0x46], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, cx
mov word [rbp + 0x48], ax
movzx eax, word [0x1400f8688]
xor ax, cx
mov word [rbp + 0x4a], ax
movzx eax, word [0x1400f868a]
xor ax, cx
mov word [rbp + 0x4c], ax
movzx eax, word [0x1400f868c]
xor ax, cx
mov word [rbp + 0x4e], ax
movzx eax, word [0x1400f868e]
xor ax, cx
mov word [rbp + 0x50], ax
movzx eax, word [str..GlobalEneIo]
xor ax, cx
mov word [rbp + 0x52], ax
movzx eax, word [0x1400f8692]
xor ax, cx
mov word [rbp + 0x54], ax
movzx eax, word [0x1400f8694]
xor ax, cx
mov word [rbp + 0x56], ax
movzx eax, word [0x1400f8696]
xor ax, cx
mov word [rbp + 0x58], ax
movzx eax, word [0x1400f8698]
xor ax, cx
mov word [rbp + 0x5a], ax
movzx eax, word [0x1400f869a]
xor ax, cx
mov word [rbp + 0x5c], ax
movzx eax, word [0x1400f869c]
xor ax, cx
mov word [rbp + 0x5e], ax
movzx eax, word [0x1400f869e]
xor ax, cx
mov word [rbp + 0x60], ax
movzx eax, word [0x1400f86a0]
xor ax, cx
mov word [rbp + 0x62], ax
movzx eax, word [0x1400f86a2]
xor ax, cx
mov word [rbp + 0x64], ax
movzx eax, word [0x1400f86a4]
xor ax, cx
mov word [rbp + 0x66], ax
movzx eax, word [0x1400f86a6]
xor ax, cx
mov word [rbp + 0x68], ax
movzx eax, word [0x1400f86a8]
xor ax, cx
mov word [rbp + 0x6a], ax
movzx eax, word [0x1400f86aa]
xor ax, cx
mov word [rbp + 0x6c], ax
movzx eax, word [0x1400f86ac]
xor ax, cx
mov word [rbp + 0x6e], ax
movzx eax, word [0x1400f86ae]
xor ax, cx
mov word [rbp + 0x70], ax
movzx eax, word [0x1400f86b0]
xor ax, cx
mov word [rbp + 0x72], ax
movzx eax, word [0x1400f86b2]
xor ax, cx
mov word [rbp + 0x74], ax
movzx eax, word [0x1400f86b4]
xor ax, cx
mov word [rbp + 0x76], ax
movzx eax, word [0x1400f86b6]
xor ax, cx
mov word [rbp + 0x78], ax
movzx eax, word [str..sys]
xor ax, cx
mov word [rbp + 0x7a], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, cx
mov word [rbp + 0x7c], ax
movzx eax, word [0x1400f86bc]
xor ax, cx
mov word [rbp + 0x7e], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, cx
mov word [rbp + 0x80], ax
movzx eax, word [0x1400f86c0]
xor ax, cx
mov word [rbp + 0x82], ax
movzx eax, word [0x1400f86c2]
xor ax, cx
mov word [rbp + 0x84], ax
movzx eax, word [0x1400f86c4]
xor ax, cx
mov word [rbp + 0x86], ax
movzx eax, word [0x1400f86c6]
xor ax, cx
mov word [rbp + 0x88], ax
movzx eax, word [str.ExFreePoolWithTag]
xor ax, cx
mov word [rbp + 0x8a], ax
movzx eax, word [0x1400f86ca]
xor ax, cx
mov word [rbp + 0x8c], ax
movzx eax, word [0x1400f86cc]
xor ax, cx
mov word [rbp + 0x8e], ax
movzx eax, word [0x1400f86ce]
xor ax, cx
mov word [rbp + 0x90], ax
movzx eax, word [0x1400f86d0]
xor ax, cx
mov word [rbp + 0x92], ax
movzx eax, word [0x1400f86d2]
xor ax, cx
mov word [rbp + 0x94], ax
movzx eax, word [0x1400f86d4]
xor ax, cx
mov word [rbp + 0x96], ax
movzx eax, word [0x1400f86d6]
xor ax, cx
mov word [rbp + 0x98], ax
movzx eax, word [0x1400f86d8]
xor ax, cx
mov word [rbp + 0x9a], ax
movzx eax, word [0x1400f86da]
xor ax, cx
mov word [rbp + 0x9c], ax
movzx eax, word [str.memset]
xor ax, cx
mov word [rbp + 0x9e], ax
movzx eax, word [0x1400f86de]
xor ax, cx
mov word [rbp + 0xa0], ax
movzx eax, word [0x1400f86e0]
xor ax, cx
mov word [rbp + 0xa2], ax
movzx eax, word [0x1400f86e2]
xor ax, cx
mov word [rbp + 0xa4], ax
movzx eax, word [0x1400f86e4]
xor ax, cx
mov word [rbp + 0xa6], ax
movzx eax, word [0x1400f86e6]
xor ax, cx
mov word [rbp + 0xa8], ax
movzx eax, word [0x1400f86e8]
xor ax, cx
mov word [rbp + 0xaa], ax
movzx eax, word [0x1400f86ea]
xor ax, cx
mov word [rbp + 0xac], ax
movzx eax, word [0x1400f86ec]
xor ax, cx
mov word [rbp + 0xae], ax
movzx eax, word [0x1400f86ee]
xor ax, cx
mov word [rbp + 0xb0], ax
movzx eax, word [str._registrymachineSYSTEMCurrentControlSetServices_]
xor ax, cx
mov word [rbp + 0xb2], ax
xor eax, eax
mov word [rbp + 0xb4], ax
xor esi, esi
nop word [rax + rax]
push rax
pushf
mov eax, 0x84073761
pushf
not eax
add eax, 0xb2d1b61f
xor eax, 0xe90c1bfa
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xfb8652bf
xor eax, 0xbd481f96
rol eax, 0xbf
popf
jmp 0x14030ea77
xor word [rbp + rax*2 - 0x5e], cx
inc rax
cmp rax, 0x89
jae 0x14030f20e
push rax
pushf
mov eax, 0xa45e3f61
pushf
not eax
add eax, 0x96e84810
xor eax, 0x887c9d70
rol eax, 3
popf
pushf
not eax
add eax, 0xd5f934f5
xor eax, 0xfe448605
rol eax, 0x3f
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0xf4daf1d0
pushf
not eax
add eax, 0xed505fde
xor eax, 0xba578a84
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xe888c86e
xor eax, 0xdadd80fd
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xe8818fdc
xor eax, 0xe991b662
rol eax, 0x90
popf
pushf
not eax
add eax, 0xe7cee274
xor eax, 0xc39ce4b5
rol eax, 0x26
popf
jmp 0x14030ea77
movzx ecx, word [rbp - 0x60]
jmp 0x14030f1cb
mov word [rbp + 0xb4], si
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xb50f2193
pushf
not r9d
add r9d, 0xf147d800
xor r9d, 0xeeecb46b
rol r9d, 0x1f
popf
pushf
not r9d
add r9d, 0x8821426b
xor r9d, 0x84dca3c5
rol r9d, 0x43
popf
pushf
not r9d
add r9d, 0xc848e2c0
xor r9d, 0xce9d06da
rol r9d, 6
popf
pushf
not r9d
add r9d, 0x89269840
xor r9d, 0xebf3badd
rol r9d, 0x5e
popf
xor r8d, r8d
lea rdx, [rbp - 0x5e]
mov rcx, 0xffffffff80000002
jmp 0x14030f355
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14030f395
push rax
pushf
mov eax, 0x9b40cc04
pushf
not eax
add eax, 0xf96fdb03
xor eax, 0xb35cd46a
rol eax, 0xe
popf
pushf
not eax
add eax, 0xe79f8d41
xor eax, 0xf0fa51e6
rol eax, 1
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0xb33f62dd
pushf
not eax
add eax, 0xbec5e395
xor eax, 0xc2c782a2
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x9a8eaad2
xor eax, 0x99abd2b6
rol eax, 2
popf
pushf
not eax
add eax, 0xcc207766
xor eax, 0x8cfd4181
rol eax, 0x78
popf
jmp 0x14030ea77
mov dword [rbp + 0xd8], 0x200
mov word [rsp + 0x50], r13w
lea edx, [rax + 0x12]
lea ecx, [rax + 8]
mov eax, 0x93a38b43
pushf
not eax
add eax, 0xf87f84e8
xor eax, 0x854bd763
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x9d5fb97f
xor eax, 0x9afee886
rol eax, 0x33
popf
pushf
not eax
add eax, 0xb59feee5
xor eax, 0xd495d6ac
rol eax, 0x85
popf
pushf
not eax
add eax, 0xafb62304
xor eax, 0xcb0710b4
rol eax, 0xb9
popf
mov word [rsp + 0x34], ax
mov r13d, 0xbd299dc9
pushf
not r13d
add r13d, 0x961c401d
xor r13d, 0x82b1ef23
rol r13d, 0x7d
popf
pushf
not r13d
add r13d, 0xf9c2ceb0
xor r13d, 0xa4b232a1
rol r13d, 0x7e
popf
pushf
not r13d
add r13d, 0xa425598b
xor r13d, 0x919b43a2
rol r13d, 0xed
popf
mov word [rsp + 0x36], r13w
mov word [rsp + 0x38], cx
mov word [rsp + 0x3a], di
mov word [rsp + 0x3c], dx
movzx eax, word [str..GlobalEneIo]
xor ax, 0x7c
mov word [rsp + 0x3e], ax
movzx eax, word [0x1400f8692]
xor ax, 0x7c
mov word [rsp + 0x40], ax
movzx r12d, word [0x1400f8694]
xor r12w, 0x7c
mov word [rsp + 0x42], r12w
movzx r15d, word [0x1400f8696]
xor r15w, 0x7c
movzx r14d, word [0x1400f8698]
xor r14w, 0x7c
movzx esi, word [0x1400f869a]
xor si, 0x7c
movzx edi, word [0x1400f869c]
xor di, 0x7c
movzx ebx, word [0x1400f869e]
xor bx, 0x7c
movzx r11d, word [0x1400f86a0]
xor r11w, 0x7c
movzx r10d, word [0x1400f86a2]
xor r10w, 0x7c
movzx r9d, word [0x1400f86a4]
xor r9w, 0x7c
movzx r8d, word [0x1400f86a6]
xor r8w, 0x7c
movzx edx, word [0x1400f86a8]
xor dx, 0x7c
movzx ecx, word [0x1400f86aa]
xor cx, 0x7c
movzx eax, word [0x1400f86ac]
xor ax, 0x7c
mov r12d, 0xe4315209
pushf
not r12d
add r12d, 0xd352f1b3
xor r12d, 0xbccbffc1
rol r12d, 0xdc
popf
pushf
not r12d
add r12d, 0x953d12f6
xor r12d, 0xc414ebb7
rol r12d, 0xa7
popf
pushf
not r12d
add r12d, 0xe9b3c081
xor r12d, 0xac997873
rol r12d, 0xbe
popf
pushf
not r12d
add r12d, 0x9aaa80a0
xor r12d, 0x84703f05
rol r12d, 0xf9
popf
xor r12w, word [rsp + 0x30]
mov word [rsp + 0x52], r12w
mov r12d, 0x9b43e0df
pushf
not r12d
add r12d, 0x87a43888
xor r12d, 0xfb990b71
rol r12d, 0x65
popf
pushf
not r12d
add r12d, 0xe6114ae5
xor r12d, 0x905dbe06
rol r12d, 0x35
popf
pushf
not r12d
add r12d, 0xfd89fa4a
xor r12d, 0xf01c1de2
rol r12d, 0xae
popf
pushf
not r12d
add r12d, 0x967eaa9d
xor r12d, 0xc6d55d6a
rol r12d, 1
popf
xor r12w, word [rsp + 0x30]
mov word [rsp + 0x54], r12w
mov r12d, 0x5f4130c8
pushf
not r12d
add r12d, 0xd841fa94
xor r12d, 0x892a47ca
rol r12d, 0xda
popf
pushf
not r12d
add r12d, 0xf62f964a
xor r12d, 0xc1a70744
rol r12d, 0x64
popf
pushf
not r12d
add r12d, 0xae7badae
xor r12d, 0xb1dcf823
rol r12d, 0xdd
popf
xor r12w, word [rsp + 0x30]
mov word [rsp + 0x56], r12w
mov r12d, 0x9f040490
pushf
not r12d
add r12d, 0xc3dde031
xor r12d, 0xfbf9cb70
rol r12d, 0x1b
popf
pushf
not r12d
add r12d, 0xb62d022b
xor r12d, 0xf2d0d74a
rol r12d, 0x23
popf
pushf
not r12d
add r12d, 0xa8b87879
xor r12d, 0xbd91c102
rol r12d, 0x49
popf
xor r12w, word [rsp + 0x30]
mov word [rsp + 0x58], r12w
mov r12d, 0xa32ffb18
pushf
not r12d
add r12d, 0xa35b31bf
xor r12d, 0xe3443610
rol r12d, 0x7e
popf
pushf
not r12d
add r12d, 0xf4937a0a
xor r12d, 0xfe4649cb
rol r12d, 0xa4
popf
pushf
not r12d
add r12d, 0xf247eb94
xor r12d, 0x9328f517
rol r12d, 0xda
popf
xor r13w, r12w
mov word [rsp + 0x5a], r13w
mov r13d, 0x49f0b3aa
pushf
not r13d
add r13d, 0xbddb7751
xor r13d, 0xbd9b4515
rol r13d, 0xfb
popf
pushf
not r13d
add r13d, 0x870ab4b7
xor r13d, 0x92eea004
rol r13d, 0x13
popf
pushf
not r13d
add r13d, 0xa64a7184
xor r13d, 0xeb675eae
rol r13d, 0x6a
popf
pushf
not r13d
add r13d, 0xcad007c2
xor r13d, 0xe3c3a59c
rol r13d, 0x7a
popf
xor r13w, r12w
mov word [rsp + 0x5c], r13w
movzx r13d, word [rsp + 0x34]
xor r13w, r12w
mov word [rsp + 0x5e], r13w
mov r13d, 0xc39a7e0b
pushf
not r13d
add r13d, 0xfe6100ef
xor r13d, 0xd7edd08e
rol r13d, 0x1a
popf
pushf
not r13d
add r13d, 0xfd9077c9
xor r13d, 0xb42b9607
rol r13d, 0x56
popf
pushf
not r13d
add r13d, 0xd9063e15
xor r13d, 0xa2c9c1fd
rol r13d, 0x29
popf
xor r13w, r12w
mov word [rsp + 0x60], r13w
mov r12d, 0x949a8b5a
pushf
not r12d
add r12d, 0xce301376
xor r12d, 0xcdae820e
rol r12d, 0xfb
popf
pushf
not r12d
add r12d, 0xf3191a51
xor r12d, 0xbe7e659f
rol r12d, 0xa2
popf
pushf
not r12d
add r12d, 0xb919e2f3
xor r12d, 0xb5f52449
rol r12d, 0xae
popf
pushf
not r12d
add r12d, 0xe85e1535
xor r12d, 0xd0d778f4
rol r12d, 0x8d
popf
xor r12w, 0x7c
mov word [rsp + 0x62], r12w
mov r13d, 0xd7d02a6d
pushf
not r13d
add r13d, 0xdd888eff
xor r13d, 0xc85c25c8
rol r13d, 0x26
popf
pushf
not r13d
add r13d, 0x8dbe2e02
xor r13d, 0xcba95e5f
rol r13d, 0x25
popf
pushf
not r13d
add r13d, 0x87e9ad85
xor r13d, 0xa7477349
rol r13d, 0x10
popf
mov r12d, 0xa22ad80
pushf
not r12d
add r12d, 0xee93dc25
xor r12d, 0xde02cee0
rol r12d, 0x88
popf
pushf
not r12d
add r12d, 0xb29c46df
xor r12d, 0xb21eb5cf
rol r12d, 0xb6
popf
pushf
not r12d
add r12d, 0xabf51be3
xor r12d, 0xd111f2c5
rol r12d, 0x5e
popf
xor r13w, r12w
mov word [rsp + 0x64], r13w
movzx r13d, word [rsp + 0x36]
xor r13w, r12w
mov word [rsp + 0x66], r13w
movzx r13d, word [rsp + 0x38]
xor r13w, r12w
mov word [rsp + 0x68], r13w
mov r13d, 0x815ad1af
pushf
not r13d
add r13d, 0xdfe0f88b
xor r13d, 0xe7a79e42
rol r13d, 0xca
popf
pushf
not r13d
add r13d, 0x8b915899
xor r13d, 0xb6740627
rol r13d, 0x30
popf
pushf
not r13d
add r13d, 0xa98a9c7a
xor r13d, 0xb1fc699f
rol r13d, 0x71
popf
xor r13w, r12w
mov word [rsp + 0x6a], r13w
movzx r13d, word [rsp + 0x3a]
xor r13w, r12w
mov word [rsp + 0x6c], r13w
movzx r13d, word [rsp + 0x3c]
xor r13w, r12w
mov word [rsp + 0x6e], r13w
movzx r13d, r12w
xor r13w, r12w
mov word [rsp + 0x70], r13w
movzx r13d, word [rsp + 0x3e]
xor r13w, r12w
mov word [rsp + 0x72], r13w
movzx r13d, word [rsp + 0x40]
xor r13w, r12w
mov word [rsp + 0x74], r13w
movzx r12d, word [rsp + 0x42]
mov r13d, 0x51eb07d7
pushf
not r13d
add r13d, 0xef653cfb
xor r13d, 0x88b7093a
rol r13d, 0x85
popf
pushf
not r13d
add r13d, 0xcb004085
xor r13d, 0x996a19f1
rol r13d, 0xb4
popf
pushf
not r13d
add r13d, 0x94d05382
xor r13d, 0x8b97d050
rol r13d, 0x24
popf
xor r12w, r13w
mov word [rsp + 0x76], r12w
xor r15w, r13w
mov word [rsp + 0x78], r15w
xor r14w, r13w
mov word [rsp + 0x7a], r14w
xor si, r13w
mov word [rsp + 0x7c], si
xor di, r13w
mov word [rsp + 0x7e], di
xor bx, r13w
mov word [rbp - 0x80], bx
xor r11w, r13w
mov word [rbp - 0x7e], r11w
xor r10w, r13w
mov word [rbp - 0x7c], r10w
xor r9w, r13w
mov word [rbp - 0x7a], r9w
xor r8w, r13w
mov word [rbp - 0x78], r8w
xor dx, r13w
mov word [rbp - 0x76], dx
xor cx, r13w
mov word [rbp - 0x74], cx
xor ax, r13w
mov word [rbp - 0x72], ax
xor eax, eax
mov word [rbp - 0x70], ax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp + 0xd0]
jmp 0x14030fb35
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea rax, [rbp + 0x100]
mov r8, 0xffffffffffffffff
nop
push rax
pushf
mov eax, 0x385cbe2c
pushf
not eax
add eax, 0xfb4008f8
xor eax, 0xc957bd0f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x9915c78e
xor eax, 0xdf0f8ac9
rol eax, 0x40
popf
pushf
not eax
add eax, 0xd8309e2f
xor eax, 0xf029734c
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xa8b6c036
xor eax, 0xc521a87f
rol eax, 0x88
popf
jmp 0x14030ea77
inc r8
cmp word [rax + r8*2], 0
jne 0x14030fbf6
push rax
pushf
mov eax, 0x2c3421d2
pushf
not eax
add eax, 0xce6c3407
xor eax, 0xc911d188
rol eax, 0x53
popf
pushf
not eax
add eax, 0xc83e0771
xor eax, 0xaa5aa222
rol eax, 0x97
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0x21c60827
pushf
not eax
add eax, 0xec99dfba
xor eax, 0xc05cbc29
rol eax, 0xe
popf
pushf
not eax
add eax, 0xc41facb3
xor eax, 0xb9fefb67
rol eax, 0x54
popf
pushf
not eax
add eax, 0xddd689d5
xor eax, 0xc7517e73
rol eax, 0xf9
popf
jmp 0x14030ea77
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0xe0]
call fcn.140226231
nop
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae rdx, qword [rbp + 0xe0]
mov rax, qword [rbp + 0xf0]
lea r8, [rdx + rax*2]
lea rdx, [rbp + 0xe0]
cmovae rdx, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0xc8]
mov rcx, rbx
call fcn.14014b511
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x14030ffa7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14030fd16
push rax
pushf
mov eax, 0xbedbf96e
pushf
not eax
add eax, 0xe74baa68
xor eax, 0xe318e4c5
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xdc13e9d2
xor eax, 0xfd2bfeaa
rol eax, 3
popf
pushf
not eax
add eax, 0xd00b2a6e
xor eax, 0xfd08b2e2
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xcd7567a7
xor eax, 0xbfeb3529
rol eax, 0x67
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0xed2782fd
pushf
not eax
add eax, 0xbf28f71c
xor eax, 0xde5e4675
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x8eed5193
xor eax, 0xc0d0ea39
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xd03cdfe7
xor eax, 0xcffa6416
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x91af570e
xor eax, 0xc5f3fab0
rol eax, 0xf6
popf
jmp 0x14030ea77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14030fddd
push rax
pushf
mov eax, 0xbac19b5b
pushf
not eax
add eax, 0x87a565e8
xor eax, 0xd1b5396b
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x8181e645
xor eax, 0xa2d46d88
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xb9ac8b18
xor eax, 0x99a057f2
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xd5a88670
xor eax, 0xbeb46089
rol eax, 0xcc
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0x61afa53e
pushf
not eax
add eax, 0xe89ce4fe
xor eax, 0xd090c1d1
rol eax, 0x93
popf
pushf
not eax
add eax, 0xddae4f9a
xor eax, 0xdb14688c
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xcc5c350b
xor eax, 0xcdf76e05
rol eax, 0x5c
popf
jmp 0x14030ea77
call fcn.14021a52b
jmp 0x14030ffa7
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
push rax
pushf
mov eax, 0xe0991c3f
pushf
not eax
add eax, 0x9f1a525c
xor eax, 0xf3e739fd
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x839e6247
xor eax, 0xdf74b585
rol eax, 0x45
popf
jmp 0x14030ea77
inc r8
cmp byte [rsi + r8], sil
jne 0x14030ff24
push rax
pushf
mov eax, 0x65f81e9c
pushf
not eax
add eax, 0xe205f9a2
xor eax, 0xdeae40d0
rol eax, 0xe
popf
pushf
not eax
add eax, 0xefaa6953
xor eax, 0xb6e90390
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xbe6523b4
xor eax, 0xc444e386
rol eax, 0x10
popf
pushf
not eax
add eax, 0xab055cce
xor eax, 0x94d077bc
rol eax, 0x5e
popf
jmp 0x14030ea77
push rax
pushf
mov eax, 0x4a8ecf04
pushf
not eax
add eax, 0xb3a41866
xor eax, 0xf4936bb0
rol eax, 0x52
popf
pushf
not eax
add eax, 0xc88f7236
xor eax, 0xfd74bd44
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xff92c2c7
xor eax, 0xa992b3b6
rol eax, 0xec
popf
jmp 0x14030ea77
xor edx, edx
mov rcx, rbx
call fcn.14028bc24
push rax
pushf
mov eax, 0xa9956ab9
pushf
not eax
add eax, 0xfc824806
xor eax, 0xbd2ca745
rol eax, 0x21
popf
pushf
not eax
add eax, 0xab2450ac
xor eax, 0xcba35c82
rol eax, 0x3f
popf
jmp 0x14030ea77
mov rax, rbx
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1402ac965
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401f095d
int3