Function at 0x18005e170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x618], rbx
mov rax, qword [0x18012b010]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r15, r8
mov qword [rsp + 0x78], r8
mov edi, edx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x34], eax
movzx ebx, dx
imul r12d, ebx, 0x10001
mov dword [rbp + 0x20], 0x790053
mov dword [rbp + 0x24], 0x740073
mov dword [rbp + 0x28], 0x6d0065
mov dword [rbp + 0x2c], 0x43005c
mov dword [rbp + 0x30], 0x720075
mov dword [rbp + 0x34], 0x650072
mov dword [rbp + 0x38], 0x74006e
mov dword [rbp + 0x3c], 0x6f0043
mov dword [rbp + 0x40], 0x74006e
mov dword [rbp + 0x44], 0x6f0072
mov dword [rbp + 0x48], 0x53006c
mov dword [rbp + 0x4c], 0x740065
mov dword [rbp + 0x50], 0x43005c
mov dword [rbp + 0x54], 0x6e006f
mov dword [rbp + 0x58], 0x720074
mov dword [rbp + 0x5c], 0x6c006f
mov dword [rbp + 0x60], 0x4b005c
mov dword [rbp + 0x64], 0x790065
mov dword [rbp + 0x68], 0x6f0062
mov dword [rbp + 0x6c], 0x720061
mov dword [rbp + 0x70], 0x200064
mov dword [rbp + 0x74], 0x61004c
mov dword [rbp + 0x78], 0x6f0079
mov dword [rbp + 0x7c], 0x740075
mov dword [rbp + 0x80], 0x73
xor r13d, r13d
lea rcx, [rbp]
call fcn.180005e80
nop
cmp edi, r12d
cmovne ebx, edi
mov r9d, ebx
lea r8, [rbp + 0x20]
lea rdx, str._s_08x
lea rcx, [rbp]
call fcn.18006bbb0
mov rcx, qword [r14]
test rcx, rcx
je 0x18005ea1d
lea rdx, [0x1800f40b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rbp - 0x78], rax
lea rdx, [0x1800f40d8]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rbp - 0x70], rax
test rbx, rbx
je 0x18005ea1d
test rsi, rsi
je 0x18005ea1d
test rax, rax
je 0x18005ea1d
mov qword [rbp - 0x60], r13
lea rcx, [rbp]
call fcn.18000618c
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call rbx
test eax, eax
jne 0x18005ea1d
test edi, 0xffff0000
cmove edi, r12d
mov dword [r15], edi
mov dword [rbp - 0x54], r13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x90]
call fcn.1800a4070
mov dword [rbp - 0x58], 0x208
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.Ime_File
mov rcx, qword [rbp - 0x60]
call rsi
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x20]
call fcn.180005e38
nop
lea rcx, [rbp - 0x20]
call fcn.180005f10
test rax, rax
je 0x18005e94a
lea rcx, [rbp - 0x50]
call fcn.180005e80
nop
lea rdx, str.Shell32.dll
lea rcx, [rsp + 0x48]
call fcn.180005e38
nop
call fcn.180077ff0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.180078090
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.180005de4
test rbx, rbx
je 0x18005e45e
lea rdx, [0x1800f5bc0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18005e45e
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x2a0]
call fcn.1800a4070
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x25]
xor ecx, ecx
call rbx
test eax, eax
jne 0x18005e45e
lea rcx, [rbp + 0x2a0]
call fcn.18000608c
mov r8, rax
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp - 0x50]
call fcn.180005f18
mov edx, 0x10
lea rcx, [rbp - 0x50]
call fcn.180072b40
nop
lea rcx, [rsp + 0x48]
call fcn.180005e80
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x34], 1
lea rcx, [rbp - 0x50]
call fcn.180005f10
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.180005f10
lea rdx, [rax + rbx]
lea rcx, [rsp + 0x48]
call fcn.18000dc90
lea rcx, [rbp - 0x50]
call fcn.180005ea0
mov r13, rax
cmp qword [rax + 0x18], 8
jb 0x18005e4bc
mov r13, qword [rax]
mov r14, qword [rax + 0x10]
lea rcx, [rsp + 0x48]
call fcn.180005ea0
mov rdi, rax
mov rbx, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov rax, r12
sub rax, rbx
cmp r14, rax
ja 0x18005e51d
lea r15, [rbx + r14]
mov qword [rdi + 0x10], r15
mov rsi, rdi
cmp r12, 8
jb 0x18005e4f4
mov rsi, qword [rdi]
lea rcx, [rsi + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rcx, [rsi + r15*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
jmp 0x18005e6e3
lea rcx, [rsp + 0x48]
call fcn.180006114
sub rax, rbx
cmp rax, r14
jb 0x18005ea5b
lea r15, [rbx + r14]
lea rcx, [rsp + 0x48]
call fcn.180006114
mov rsi, rax
lea rcx, [rsp + 0x48]
call fcn.180005ea0
mov rcx, r15
or rcx, 7
mov qword [rbp - 0x30], rcx
cmp rcx, rsi
ja 0x18005e58d
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp rdx, rax
ja 0x18005e58d
lea rax, [rdx + rcx]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.18000602c
mov rsi, qword [rax]
mov rax, rsi
add rax, 1
mov r8, 0xffffffffffffffff
cmovb rax, r8
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18005e5b7
mov rdx, r8
jmp 0x18005e5c0
cmp rdx, 0x1000
jb 0x18005e5ea
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1800a0a38
mov rcx, rax
test rax, rax
je 0x18005ea61
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18005e5fb
test rdx, rdx
je 0x18005e5f9
mov rcx, rdx
call fcn.1800a0a38
jmp 0x18005e5fb
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov r15, qword [rsp + 0x38]
mov r8, rbx
mov rcx, r15
cmp r12, 8
jb 0x18005e68b
mov rsi, qword [rdi]
mov rdx, rsi
call fcn.180006084
lea rcx, [r15 + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rbx + r14]
lea rcx, [r15 + rax*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x18005e679
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x18005ea67
mov rsi, rcx
mov rcx, rsi
call fcn.1800a0284
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x18005e6e3
mov rdx, rdi
call fcn.180006084
lea rcx, [r15 + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rbx + r14]
lea rcx, [r15 + rax*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
mov rcx, rdi
call fcn.180005ea0
mov rdx, rax
mov ecx, 8
call fcn.180005ca4
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.180005ea0
mov rcx, qword [rax]
mov qword [rbx], rcx
lea rcx, [rbp - 0x20]
call fcn.180005ea0
mov r13, rax
cmp qword [rax + 0x18], 8
jb 0x18005e6f9
mov r13, qword [rax]
mov r14, qword [rax + 0x10]
mov rbx, qword [rdi + 0x10]
mov r12, qword [rdi + 0x18]
mov rax, r12
sub rax, rbx
cmp r14, rax
ja 0x18005e74a
lea rsi, [rbx + r14]
mov qword [rdi + 0x10], rsi
cmp r12, 8
jb 0x18005e721
mov rdi, qword [rdi]
lea rcx, [rdi + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rcx, [rdi + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
jmp 0x18005e910
lea rcx, [rsp + 0x48]
call fcn.180006114
sub rax, rbx
cmp rax, r14
jb 0x18005ea6d
lea r15, [rbx + r14]
lea rcx, [rsp + 0x48]
call fcn.180006114
mov rsi, rax
lea rcx, [rsp + 0x48]
call fcn.180005ea0
mov rcx, r15
or rcx, 7
mov qword [rbp - 0x28], rcx
cmp rcx, rsi
ja 0x18005e7ba
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rsi
sub rax, rcx
cmp rdx, rax
ja 0x18005e7ba
lea rax, [rdx + rcx]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.18000602c
mov rsi, qword [rax]
mov rax, rsi
add rax, 1
mov r8, 0xffffffffffffffff
cmovb rax, r8
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18005e7e4
mov rdx, r8
jmp 0x18005e7ed
cmp rdx, 0x1000
jb 0x18005e817
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1800a0a38
mov rcx, rax
test rax, rax
je 0x18005ea73
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18005e828
test rdx, rdx
je 0x18005e826
mov rcx, rdx
call fcn.1800a0a38
jmp 0x18005e828
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], rsi
mov r15, qword [rsp + 0x40]
mov r8, rbx
mov rcx, r15
cmp r12, 8
jb 0x18005e8b8
mov rsi, qword [rdi]
mov rdx, rsi
call fcn.180006084
lea rcx, [r15 + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rbx + r14]
lea rcx, [r15 + rax*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
lea rdx, [r12*2 + 2]
cmp rdx, 0x1000
jb 0x18005e8a6
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x18005ea55
mov rsi, rcx
mov rcx, rsi
call fcn.1800a0284
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
jmp 0x18005e910
mov rdx, rdi
call fcn.180006084
lea rcx, [r15 + rbx*2]
mov r8, r14
mov rdx, r13
call fcn.180006084
xor eax, eax
mov word [rsp + 0x30], ax
lea rax, [rbx + r14]
lea rcx, [r15 + rax*2]
lea rdx, [rsp + 0x30]
call fcn.18000607c
mov rcx, rdi
call fcn.180005ea0
mov rdx, rax
mov ecx, 8
call fcn.180005ca4
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.180005ea0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov r15, qword [rsp + 0x78]
lea rcx, [r15 + 8]
mov rdx, qword [rbp - 0x80]
call fcn.1800066cc
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x48]
call fcn.180005de4
nop
lea rcx, [rbp - 0x50]
call fcn.180005de4
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x70]
mov dword [rbp - 0x58], 0x208
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.Layout_Display_Name
mov rcx, qword [rbp - 0x60]
call rsi
test eax, eax
jne 0x18005e9c1
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x50]
call fcn.180005e38
nop
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.18005ea80
nop
lea rcx, [r15 + 0x28]
mov rdx, rax
call fcn.1800066cc
nop
lea rcx, [rsp + 0x48]
call fcn.180005de4
nop
lea rcx, [rbp - 0x50]
call fcn.180005de4
jmp 0x18005ea09
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.Layout_Text
mov rcx, qword [rbp - 0x60]
call rsi
lea rcx, [rbp + 0x90]
call fcn.18000608c
lea rcx, [r15 + 0x28]
mov r8, rax
lea rdx, [rbp + 0x90]
call fcn.180005f18
mov rcx, qword [rbp - 0x60]
call r14
mov bl, 1
lea rcx, [rbp - 0x20]
call fcn.180005de4
jmp 0x18005ea1f
xor bl, bl
lea rcx, [rbp]
call fcn.180005de4
movzx eax, bl
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1800a0260
mov rbx, qword [rsp + 0x618]
add rsp, 0x5c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a6cbc
nop
call fcn.180006100
int3
call fcn.1800a6cbc
int3
call fcn.1800a6cbc
int3
call fcn.180006100
int3
call fcn.1800a6cbc
int3