Function at 0x140011080
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov rbx, r8
mov r14, rdx
mov qword [rbp - 0x48], rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140011a45
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rsi, [r15 - 1]
test rbx, rbx
je 0x140011111
cmp rbx, 0x10000
jae 0x140011101
movzx edx, bx
lea rcx, [rbp - 0x50]
call fcn.140001fa0
jmp 0x140011121
mov r8, rsi
inc r8
cmp word [rbx + r8*2], 0
jne 0x140011104
jmp 0x140011114
mov r8d, r15d
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140002210
nop
mov rbx, qword [rbp - 0x50]
movsxd rdi, dword [rbx - 0x10]
test edi, edi
js 0x140011a60
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011151
mov edx, edi
lea rcx, [rbp - 0x50]
call fcn.140002b40
mov rbx, qword [rbp - 0x50]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140041228
cmp edi, dword [rbx - 0xc]
jg 0x140011a60
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r15w
xor r13b, r13b
mov edi, dword [rbx - 0x10]
test edi, edi
je 0x1400111f0
js 0x140011a60
cmp word [rbx], 0x40
jne 0x1400111f0
mov r13b, 1
cmp edi, 1
jl 0x1400111f0
dec edi
lea r14d, [rdi + 1]
cmp dword [rbx - 8], 1
jle 0x1400111aa
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140002a20
mov rbx, qword [rbp - 0x50]
movsxd r8, r14d
add r8, r8
lea rdx, [rbx + 2]
je 0x1400111d0
test rbx, rbx
je 0x140011a50
test rdx, rdx
je 0x140011a50
mov rcx, rbx
call fcn.14005a880
test edi, edi
js 0x140011a60
cmp edi, dword [rbx - 0xc]
jg 0x140011a60
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r15w
mov r14, qword [rbp - 0x48]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x10]
call fcn.14005af20
mov ecx, 1
call fcn.140039944
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x30], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140011a6b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea r8, [rbp - 0x10]
call fcn.140013220
cmp al, 1
jne 0x1400114ea
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140040c70
test eax, eax
jne 0x1400114ea
mov dword [rbp - 0x40], r15d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140011a76
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x10]
cmp rax, 0x10000
lea rax, [rbp - 0x10]
jae 0x1400112a5
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140001fa0
jmp 0x1400112ca
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400112b0
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x38]
call fcn.140002210
nop
lea rax, [rsp + 0x38]
mov qword [rbp - 0x80], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140002120
add rax, 0x18
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.140032630
mov dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011323
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rsp + 0x50]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140011387
cmp dword [rbx + 0x10], 0
jl 0x140011372
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x140011372
call fcn.140002120
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140011368
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x140011382
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140002210
mov rax, qword [rsp + 0x50]
mov dword [rsp + 0x30], r15d
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400113a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xf2]
call fcn.14005af20
mov word [rbp + 0xf0], r15w
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [0x14007df78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rbx, qword [rbp - 0x58]
test eax, eax
jne 0x140011475
mov dword [rbp - 0x28], 0x100
mov dword [rbp - 0x24], 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x24]
xor r8d, r8d
lea rdx, str.LastUsedCodeHash
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x68]
test eax, eax
je 0x14001143e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011475
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
lea rdx, [rbp + 0xf0]
sub rdx, rbx
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x140011468
add rax, 2
test cx, cx
jne 0x140011451
mov eax, r15d
jmp 0x14001146d
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400115af
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [0x14007df78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400114e6
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 4
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x1c]
xor r8d, r8d
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x60]
test eax, eax
je 0x14001159f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp - 0x50]
lea r12, [rbx - 0x18]
mov rcx, r12
call fcn.140002120
mov rcx, rax
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
call fcn.140002120
add rax, 0x18
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140032630
mov dword [rsp + 0x30], 1
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011550
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rsp + 0x60]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400115dd
cmp dword [rbx + 0x10], 0
jl 0x1400115c8
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x1400115c8
call fcn.140002120
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140011595
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x1400115d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x40], 1
jne 0x1400114e6
mov r8, qword [rbp - 0x50]
mov rdx, r14
call fcn.140011ee0
mov edi, eax
mov dword [0x14007df70], eax
jmp 0x1400119be
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140002210
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x30], r15d
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400115fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r9, qword [rbp - 0x58]
mov r8, qword [0x14007df78]
call fcn.14000feb0
lea r9, [rbp - 0x10]
mov r8, qword [0x14007df78]
call fcn.14000feb0
mov rbx, qword [rbp - 0x50]
mov r9, rbx
mov r8, qword [0x14007df78]
call fcn.14000feb0
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140011a81
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x38]
mov rdx, rbx
call fcn.140011a90
cmp al, 1
jne 0x140011997
mov rdi, rsi
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x140011664
lea r15, [rdi*2 + 4]
mov rcx, r15
call fcn.140039d3c
mov r14, rax
mov ecx, edi
xor ecx, 0x92781293
mov dword [rax], ecx
xor eax, eax
lea r8d, [rax + 7]
mov r9d, eax
test rdi, rdi
je 0x1400116bd
mov edx, eax
nop dword [rax + rax]
add r8d, 7
movzx ecx, r8w
xor cx, word [rbx + rdx*2]
mov word [r14 + rdx*2 + 4], cx
inc r9d
mov edx, r9d
cmp rdx, rdi
jb 0x1400116a0
test r15d, r15d
je 0x1400116f3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
lea r9, str.HardwareConfig
mov r8, qword [0x14007df78]
mov rdx, 0xffffffff80000002
call fcn.140010280
mov edx, 4
mov rcx, r14
call fcn.140039910
mov rcx, r12
call fcn.140002120
mov rcx, rax
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rbp - 0x70], rax
call fcn.140002120
add rax, 0x18
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140032630
mov dword [rsp + 0x30], 4
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011757
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rsp + 0x70]
lea rcx, [rax - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400117bb
cmp dword [rbx + 0x10], 0
jl 0x1400117a6
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x1400117a6
call fcn.140002120
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14001179c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rVariantCopy + 8]
lea rax, [rdi + 0x18]
mov qword [rbp - 0x58], rax
jmp 0x1400117b6
mov r8d, dword [rax - 0x10]
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.140002210
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400117d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r8, qword [rbp - 0x48]
lea rdx, str.EDDName
mov rcx, qword [0x14007df80]
call fcn.14000b8b0
mov r8, qword [rbp - 0x58]
cmp dword [r8 - 8], 1
jle 0x140011807
mov edx, dword [r8 - 0x10]
lea rcx, [rbp - 0x58]
call fcn.140002a20
mov r8, qword [rbp - 0x58]
lea rdx, str.LastUsedCodeHash
mov rcx, qword [0x14007df80]
call fcn.14000b8b0
mov rdi, qword [rbp - 0x38]
lea rcx, [rdi - 0x18]
call fcn.140002120
lea rbx, [rax + 0x18]
mov qword [rbp - 0x48], rbx
movsxd r14, dword [rax + 8]
test r14d, r14d
js 0x140011a3a
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, r14d
or eax, ecx
jge 0x14001185e
mov edx, r14d
lea rcx, [rbp - 0x48]
call fcn.140002b40
mov rbx, qword [rbp - 0x48]
lea eax, [r14 + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140041228
cmp r14d, dword [rbx - 0xc]
jg 0x140011a3a
mov dword [rbx - 0x10], r14d
xor ecx, ecx
mov word [rbx + r14*2], cx
cmp dword [rbx - 0x10], ecx
jl 0x1400118b2
lea rdx, str.trial
mov rcx, rbx
call fcn.14003b83c
test rax, rax
je 0x1400118b2
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1400118b2
mov rcx, qword [0x14007df80]
call fcn.14000b6d0
cmp dword [rdi - 8], 1
jle 0x1400118c8
mov edx, dword [rdi - 0x10]
lea rcx, [rbp - 0x38]
call fcn.140002a20
mov rdi, qword [rbp - 0x38]
mov r8, rdi
lea rdx, str.ItemName
mov rcx, qword [0x14007df80]
call fcn.14000b8b0
test r13b, r13b
je 0x14001197d
mov rbx, qword [0x14007df80]
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140011a2f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdi, [0x140069640]
lea rcx, [rsp + 0x40]
cmp rdi, 0x10000
jae 0x14001192d
movzx edx, di
call fcn.140001fa0
jmp 0x14001193c
mov r8d, 3
mov rdx, rdi
call fcn.140002210
nop
lea rcx, [rbx + 0x18]
lea rdx, [rsp + 0x40]
call fcn.14000c200
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011968
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.14000bc60
mov rbx, qword [rbp - 0x48]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011997
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400119b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov edi, dword [0x14007df70]
mov rbx, qword [rbp - 0x58]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400119d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov edx, 1
mov rcx, qword [rbp - 0x30]
call fcn.140039910
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140011a03
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
mov eax, edi
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400398f0
mov rbx, qword [rsp + 0x440]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002c40
int3
mov ecx, 0x80070057
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
call fcn.140040b74
mov dword [rax], 0x16
call fcn.140040a50
mov ecx, 0x80070057
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3
mov ecx, 0x80004005
call fcn.140002c40
int3