Function at 0x140011000
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 0x41], rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov dword [rbp + 0x14], 0x6e657272
mov word [rbp - 4], 0x5241
mov dword [rbp + 0x26], 0x6c6c6174
mov word [rbp + 0x24], 0x736e
mov dword [rbp + 0xc], 0x776f646e
mov word [rbp + 5], 0x6f73
mov dword [rbp + 0x10], 0x75435c73
mov word [rbp - 1], 0x4d5c
mov dword [rbp - 9], 0x54464f53
mov dword [rbp + 0x1d], 0x5c6e6f69
mov word [rbp + 0x21], 0x6e55
mov word [rbp + 2], 0x7263
mov word [rbp + 0x18], 0x5674
mov word [rbp + 0xa], 0x6957
mov byte [rbp - 2], 0x45
mov byte [rbp + 0x23], VarBstrFromUI1
mov word [rbp + 0x1b], 0x7372
mov byte [rbp + 1], VarBstrFromUI1
mov word [rbp + 7], 0x7466
mov byte [rbp + 0x2a], r12b
mov byte [rbp + 9], 0x5c
mov byte [rbp + 4], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0x1a], SHCoCreateInstance
mov byte [rbp - 5], 0x57
mov word [rbp - 0x2e], 0x6974
mov word [rbp - 0x2b], WSAGetLastError
mov dword [rbp - 0x39], 0x74736e49
mov dword [rbp - 0x35], 0x4c6c6c61
mov word [rbp - 0x30], 0x6163
mov byte [rbp - 0x31], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x11], 0x65726946
mov dword [rbp - 0xd], 0x786f66
mov word [rbp - 0x14], 0x616c
mov dword [rbp - 0x19], 0x697a6f4d
mov byte [rbp - 0x12], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x15], WSAGetLastError
lea rdx, [rbp - 0x19]
lea rcx, [rsp + 0x40]
call fcn.140022164
nop
mov dword [rbp - 0x61], 0x200
mov dword [rbp - 0x5d], 0x100
call fcn.140023a0c
mov rcx, rax
test rax, rax
je 0x140011622
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x48], 1
mov r14d, r12d
or r13d, 0xffffffff
mov qword [rbp - 0x69], r12
mov r9d, dword [rbp + r14*4 - 0x61]
or r9d, 0x20019
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, 0xffffffff80000002
call fcn.140147764
mov esi, eax
call fcn.140023a0c
test rax, rax
je 0x140011617
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r12d
test esi, esi
jne 0x14001131f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x1400111db
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140024110
mov rbx, qword [rsp + 0x30]
mov r9d, esi
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14007ca08
test eax, eax
js 0x140011643
cmp eax, dword [rbx - 0xc]
jg 0x140011643
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test esi, esi
jne 0x14001131f
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rsp + 0x30]
call fcn.140023fbc
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140011638
mov rcx, qword [rax]
call fcn.14007cd54
test eax, eax
sete bl
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140011276
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x140011284
mov rbx, qword [rsp + 0x30]
jmp 0x1400111b4
mov dword [rbp - 0x79], 1
mov r8d, 0x104
mov dword [rbp - 0x7d], r8d
mov rax, qword [rdi]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r8d
or ecx, edx
jge 0x1400112b5
mov edx, r8d
mov rcx, rdi
call fcn.140024110
mov rax, qword [rdi]
lea rcx, [rbp - 0x7d]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
lea r8, [rbp - 0x39]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rbp - 0x69]
call fcn.14000514c
mov esi, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400112ee
mov eax, r12d
jmp 0x1400112ff
movsxd rdx, dword [rcx - 0xc]
call fcn.14007ca08
test eax, eax
js 0x14001162d
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14001162d
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test esi, esi
jne 0x1400111b4
mov rax, qword [rdi]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x140011352
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140011344
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc r14
cmp r14, 2
jge 0x140011367
jmp 0x14001115b
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140011367
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, r12
mov qword [rbp - 0x59], r12
mov r9d, dword [rbp + rsi*4 - 0x61]
or r9d, 0x20019
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, 0xffffffff80000001
call fcn.140147764
mov r14d, eax
call fcn.140023a0c
test rax, rax
je 0x14001160c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov r15d, r12d
test r14d, r14d
jne 0x140011537
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov r14d, 0x104
sub eax, r14d
or eax, ecx
jge 0x1400113ef
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.140024110
mov rbx, qword [rsp + 0x38]
mov r9d, r14d
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov r14d, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14007ca08
test eax, eax
js 0x140011664
cmp eax, dword [rbx - 0xc]
jg 0x140011664
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test r14d, r14d
jne 0x140011537
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x38]
call fcn.140023fbc
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140011659
mov rcx, qword [rax]
call fcn.14007cd54
test eax, eax
sete bl
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001148c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x14001149a
mov rbx, qword [rsp + 0x38]
jmp 0x1400113c5
mov dword [rbp - 0x71], 1
mov r8d, 0x104
mov dword [rbp - 0x75], r8d
mov rax, qword [rdi]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r8d
or ecx, edx
jge 0x1400114cb
mov edx, r8d
mov rcx, rdi
call fcn.140024110
mov rax, qword [rdi]
lea rcx, [rbp - 0x75]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
lea r8, [rbp - 0x39]
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call fcn.14000514c
mov r14d, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140011505
mov eax, r12d
jmp 0x140011516
movsxd rdx, dword [rcx - 0xc]
call fcn.14007ca08
test eax, eax
js 0x14001164e
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14001164e
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test r14d, r14d
jne 0x1400113c5
mov rax, qword [rdi]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x14001156a
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001155c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, 2
jge 0x14001157f
jmp 0x14001136a
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14001157f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
cmp dword [rax - 0x10], r12d
je 0x1400115ba
mov word [rbp - 0x29], 0x665c
mov word [rbp - 0x26], 0x6572
mov word [rbp - 0x23], 0x786f
mov dword [rbp - 0x20], 0x657865
mov byte [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp - 0x24], reloc.SHELL32.dll_SHCoCreateInstance
mov byte [rbp - 0x27], VarBstrFromUI1
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.1400230cc
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x1400115dc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140051d60
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400232a8
int3
mov ecx, 0x80004005
call fcn.1400232a8
int3
mov ecx, 0x80004005
call fcn.1400232a8
nop
mov ecx, 0x80070057
call fcn.1400232a8
int3
mov ecx, 0x80004005
call fcn.1400232a8
int3
mov ecx, 0x80070057
call fcn.1400232a8
nop
mov ecx, 0x80070057
call fcn.1400232a8
int3
mov ecx, 0x80004005
call fcn.1400232a8
int3
mov ecx, 0x80070057
call fcn.1400232a8
int3