Function at 0x140004d7c
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x268]
sub rsp, 0x368
mov r15, rcx
xor r13d, r13d
mov esi, r13d
mov qword [rbp + 0x30], r13
xor r8d, r8d
xor edx, edx
call fcn.140008a24
mov rdi, rax
mov qword [rbp + 0x28], rax
mov qword [rbp - 0x38], r13
mov dword [rbp + 0x2b8], r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp + 0x2c8], r13d
mov dword [rbp + 0x2c0], r13d
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r14, 0xffffffff80000003
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movabs r12, 0x555555555555554
mov eax, dword [rbp + 0x2b8]
test eax, eax
je 0x140004f43
mov ebx, r13d
mov dword [rbp - 0x3c], 0x104
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x3c]
lea r8, [rbp + 0x40]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140004f35
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r13
mov byte [rbp - 0x30], r13b
cmp byte [rbp + 0x40], r13b
jne 0x140004e9c
mov r8, r13
jmp 0x140004ead
lea rax, [rbp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x140004ea4
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.14000da24
nop
lea r9, [rbp - 0x30]
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.14000a844
mov rcx, r12
sub rcx, rsi
cmp rcx, 1
jb 0x140005427
inc rsi
mov qword [rbp + 0x30], rsi
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x140004f35
inc rax
mov rcx, qword [rbp - 0x30]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140004f30
test dl, 0x1f
jne 0x140005421
mov rcx, qword [rcx - 8]
cmp rcx, rdx
jae 0x140005421
sub rdx, rcx
sub rdx, 8
cmp rdx, 0x1f
ja 0x140005421
call fcn.140133ea8
inc ebx
cmp ebx, dword [rbp + 0x2b8]
jb 0x140004e4b
mov word [rsp + 0x72], 0x6567
mov dword [rsp + 0x68], 0x666f7250
mov word [rsp + 0x6f], 0x6d49
mov byte [rsp + 0x71], 0x61
mov word [rsp + 0x6c], 0x6c69
mov dword [rsp + 0x75], 0x687461
mov byte [rsp + 0x6e], 0x65
mov byte [rsp + 0x74], 0x50
mov word [rbp - 0x67], 0x2073
mov dword [rbp - 0x79], 0x694d5c45
mov word [rbp - 0x55], 0x5c6e
mov dword [rbp - 0x5a], 0x69737265
mov dword [rbp - 0x64], 0x75435c54
mov dword [rbp - 0x52], 0x69666f72
mov dword [rbp - 0x6e], 0x6e69575c
mov word [rbp - 0x60], 0x7272
mov dword [rbp - 0x72], 0x74666f73
mov dword [rbp - 0x80], 0x54464f53
mov word [rbp - 0x7b], 0x5241
mov word [rbp - 0x5d], 0x746e
mov dword [rbp - 0x4e], 0x694c656c
mov word [rbp - 0x4a], 0x7473
mov byte [rbp - 0x5e], 0x65
mov word [rbp - 0x6a], 0x6f64
mov byte [rbp - 0x7c], 0x57
mov byte [rbp - 0x53], 0x50
mov word [rbp - 0x74], 0x6f72
mov byte [rbp - 0x56], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x65], Ordinal_79
mov byte [rbp - 0x5b], 0x56
mov byte [rbp - 0x75], 0x63
mov byte [rbp - 0x48], r13b
mov byte [rbp - 0x68], 0x77
mov word [rsp + 0x63], 0x7265
mov word [rsp + 0x66], reloc.SHELL32.dll_PathGetShortPath
mov word [rsp + 0x61], 0x7375
mov byte [rsp + 0x60], reloc.SHELL32.dll_PathGetShortPath
mov byte [rsp + 0x65], reloc.WS2_32.dll_WSAStartup
mov dword [rbp + 0x2b8], r13d
mov dword [rbp - 0x40], r13d
mov dword [rbp + 0x2c8], r13d
mov dword [rbp + 0x2c0], r13d
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400053c9
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp + 0x2b8]
test eax, eax
je 0x1400053be
mov r12d, r13d
mov dword [rbp - 0x3c], 0x104
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x3c]
lea r8, [rbp + 0x40]
mov edx, r12d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400053ae
mov qword [rbp - 8], r13
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400053ae
mov dword [rbp - 0x10], 0x104
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400053a4
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x10], r13
mov byte [rbp], r13b
cmp byte [rbp + 0x150], r13b
jne 0x140005186
mov r8, r13
jmp 0x14000519a
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x140005191
lea rdx, [rbp + 0x150]
lea rcx, [rbp]
call fcn.14000da24
nop
lea r14, [rbp]
mov r8, qword [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r14, r8
lea rcx, [rbp]
cmovae rcx, r8
mov rbx, qword [rbp + 0x10]
add rbx, rcx
lea rsi, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rsi, r8
cmp rsi, rbx
je 0x1400051f4
sub r14, rsi
movsx ecx, byte [rsi]
call fcn.140172bc0
mov byte [r14 + rsi], al
inc rsi
cmp rsi, rbx
jne 0x1400051e0
cmp byte [rsp + 0x60], r13b
jne 0x140005200
mov r9, r13
jmp 0x140005212
lea rax, [rsp + 0x60]
or r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], r13b
jne 0x140005209
lea rdx, [rsp + 0x60]
lea rcx, [rbp]
call fcn.140006de0
cmp rax, 0xffffffffffffffff
je 0x140005360
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], r13
mov byte [rbp - 0x30], r13b
cmp byte [rbp + 0x40], r13b
jne 0x140005245
mov r8, r13
jmp 0x140005256
lea rax, [rbp + 0x40]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x14000524d
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.14000da24
nop
mov rbx, qword [rdi]
mov r13, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x30]
cmp rbx, rdi
je 0x140005319
mov r15, qword [rbp - 0x20]
lea rdx, [rbp - 0x30]
cmp r13, 0x10
cmovae rdx, rsi
cmp qword [rbx + 0x28], 0x10
jb 0x140005295
mov rcx, qword [rbx + 0x10]
jmp 0x140005299
lea rcx, [rbx + 0x10]
mov r14, qword [rbx + 0x20]
mov r8, r15
cmp r14, r15
cmovb r8, r14
test r8, r8
je 0x1400052b5
call fcn.1401383d0
test eax, eax
jne 0x1400052bc
cmp r14, r15
jb 0x1400052bc
jbe 0x1400052c4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000527c
mov r15, qword [rbp + 0x2b0]
cmp rbx, rdi
je 0x140005319
mov rbx, qword [r15]
lea r9, [rbp - 0x30]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.14000a7e4
mov rdx, qword [r15 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140005434
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov r13, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x30]
cmp r13, 0x10
jb 0x14000535d
lea rax, [r13 + 1]
mov rdx, rsi
cmp rax, 0x1000
jb 0x140005355
test dl, 0x1f
jne 0x140005415
mov rsi, qword [rsi - 8]
cmp rsi, rdx
jae 0x140005415
sub rdx, rsi
sub rdx, 8
cmp rdx, 0x1f
ja 0x140005415
mov rcx, rsi
call fcn.140133ea8
xor r13d, r13d
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x1400053a4
inc rax
mov rcx, qword [rbp]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14000539f
test dl, 0x1f
jne 0x14000541b
mov rcx, qword [rcx - 8]
cmp rcx, rdx
jae 0x14000541b
sub rdx, rcx
sub rdx, 8
cmp rdx, 0x1f
ja 0x14000541b
call fcn.140133ea8
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
cmp r12d, dword [rbp + 0x2b8]
jb 0x1400050ca
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rsi, qword [rdi]
mov qword [rdi], rdi
mov qword [rdi + 8], rdi
cmp rsi, rdi
je 0x1400053f9
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
xor r8d, r8d
mov dl, 1
call fcn.14000d8e0
mov rcx, rsi
call fcn.140133ea8
mov rsi, rbx
cmp rbx, rdi
jne 0x1400053d8
mov rcx, rdi
call fcn.140133ea8
add rsp, 0x368
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
nop
lea rcx, str.list_T__too_long
call fcn.140101700
nop
lea rcx, str.list_T__too_long
call fcn.140101700
int3