Function at 0x14003d9f0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
lea rbp, [rsp - 0x1fc0]
mov eax, 0x20c0
call fcn.140049920
sub rsp, rax
movaps xmmword [rsp + 0x20b0], xmm6
lea rax, [rbp + 0x1fe0]
mov rbx, r9
movaps xmmword [rsp + 0x20a0], xmm7
mov r9d, 0x20106
movaps xmmword [rsp + 0x2090], xmm8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14003dc9d
movups xmm0, xmmword [0x140170698]
mov eax, dword [0x1401706c8]
xor ecx, ecx
cmp dword [0x14017a008], 2
movups xmm1, xmmword [0x1401706a8]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1401706cc]
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x64], ax
movups xmm0, xmmword [0x1401706b8]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x14003dbf6
movdqa xmm0, xmmword [str.9999999999999999]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x140170cd0]
mov eax, 4
movdqa xmm4, xmmword [0x1401710c0]
movdqa xmm7, xmmword [str.1111]
movdqa xmmword [rsp + 0x70], xmm0
mov r8d, dword [rsp + 0x70]
movd xmm6, eax
mov eax, 0x1f
movd xmm8, eax
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x30
jl 0x14003daf0
cmp ecx, 0x36
jge 0x14003dc3d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x36
jl 0x14003dc10
lea r9, [rsp + 0x30]
mov edx, 3
mov r8d, 0xbb8
lea rcx, [rbp - 0x80]
call fcn.14003bc00
mov rax, qword [0x14017a050]
cmp rax, qword [0x14017a058]
je 0x14003dc8a
mov r8d, 0x2010
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14017a050], 0x2010
xor al, al
jmp 0x14003df40
lea r8, [rbp - 0x80]
mov rdx, rax
call fcn.1400486a0
xor al, al
jmp 0x14003df40
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14003dcaa
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x10]
lea rdx, str.ProductId
mov r9d, 1
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x1fe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003df31
movups xmm0, xmmword [0x1401706d0]
mov eax, dword [str._b__v_v_r]
xor ecx, ecx
cmp dword [0x14017a008], 2
movups xmm1, xmmword [0x1401706e0]
mov dword [rsp + 0x60], eax
movzx eax, word [0x140170704]
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x64], ax
movups xmm0, xmmword [0x1401706f0]
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x14003de76
movdqa xmm0, xmmword [str.9999999999999999]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x140170cd0]
mov eax, 4
movdqa xmm4, xmmword [0x1401710c0]
movdqa xmm7, xmmword [str.1111]
movdqa xmmword [rsp + 0x70], xmm0
mov r8d, dword [rsp + 0x70]
movd xmm6, eax
mov eax, 0x1f
movd xmm8, eax
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
pxor xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x30
jl 0x14003dd70
cmp ecx, 0x36
jge 0x14003debd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x36
jl 0x14003de90
lea r9, [rsp + 0x30]
mov edx, 3
mov r8d, 0xbb8
lea rcx, [rbp - 0x80]
call fcn.14003bc00
mov rax, qword [0x14017a050]
cmp rax, qword [0x14017a058]
je 0x14003df14
mov r8d, 0x2010
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x1fe0]
add qword [0x14017a050], 0x2010
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x14003df40
lea r8, [rbp - 0x80]
mov rdx, rax
call fcn.1400486a0
mov rcx, qword [rbp + 0x1fe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x14003df40
mov rcx, qword [rbp + 0x1fe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
lea r11, [rsp + 0x20c0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop rbp
ret