Function at 0x1800058b0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3040]
mov eax, 0x3140
call fcn.1801082a0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x3178], rbx
mov qword [rsp + 0x3180], rsi
mov qword [rsp + 0x3188], rdi
mov rax, qword [0x18016f298]
xor rax, rsp
mov qword [rbp + 0x3030], rax
movzx r13d, r8b
movzx ebx, dl
mov r15, rcx
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x2030]
call fcn.18010a4e0
mov rdi, 0xffffffff80000002
mov qword [rbp - 0x78], rdi
test r13b, r13b
je 0x180005945
mov rdi, 0xffffffff80000003
mov qword [rbp - 0x78], rdi
lea rcx, [rbp + 0x2030]
call fcn.1800055d0
mov esi, 0x69
mov dword [rbp + 0xa], 0x690073
mov dword [rbp - 0x1e], 0x5c0074
lea r14d, [rsi - 0xd]
mov dword [rbp], 0x74006e
mov r9d, WSAGetLastError
mov dword [rbp + 0x24], r9d
mov dword [rbp - 0x26], 0x73006f
mov dword [rbp - 0x16], 0x64006e
mov dword [rbp - 0x3e], 0x46004f
mov dword [rbp + 0x1a], 0x73006e
mov dword [rbp - 0xe], 0x5c0073
mov dword [rbp - 0x2c], 0x630069
mov dword [rbp + 0x14], 0x6e0055
mov dword [rbp - 0x12], 0x77006f
mov dword [rbp - 0x38], 0x410057
mov dword [rbp + 0x1e], 0x610074
mov eax, 0x53
mov word [rbp - 0x40], ax
mov dword [rbp - 0x1a], 0x690057
xor r12d, r12d
mov dword [rbp - 4], 0x650072
mov dword [rbp - 0xa], 0x750043
mov dword [rbp - 0x30], 0x4d005c
mov dword [rbp + 0xe], 0x6e006f
mov ecx, WSACleanup
mov word [rbp - 6], cx
mov eax, 0x54
mov word [rbp - 0x3a], ax
mov word [rbp + 0x22], r9w
mov dword [rbp + 4], 0x650056
mov word [rbp - 0x28], cx
mov dword [rbp - 0x34], 0x450052
mov word [rbp + 8], cx
mov word [rbp + 0x18], si
mov dword [rbp - 0x22], 0x66006f
mov word [rbp + 0x12], r14w
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x1030]
call fcn.18010a4e0
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x30]
call fcn.18010a4e0
mov dword [rsp + 0x40], 0x800
mov esi, 0x20219
mov eax, 0x20019
test bl, bl
cmovne esi, eax
mov dword [rsp + 0x64], esi
call fcn.180002650
mov rcx, rax
test rax, rax
jne 0x180005a77
mov ecx, 0x80004005
call fcn.180002760
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rbp - 0x40]
lea rax, [rbp - 0x40]
or r14, 0xffffffffffffffff
test rax, 0xffffffffffff0000
jne 0x180005abb
movzx ebx, cx
mov ecx, ebx
call fcn.1800021f0
test rax, rax
je 0x180005ade
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180001f30
jmp 0x180005ade
lea rcx, [rbp - 0x40]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x180005ac2
mov r8d, eax
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.180001df0
nop
test r13b, r13b
je 0x180005aff
lea r9, [rbp - 0x40]
lea r8, [rbp + 0x2030]
lea rdx, [0x180155a88]
lea rcx, [rsp + 0x70]
call fcn.18000a800
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180005b43
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x180005b3c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor al, al
jmp 0x180006140
mov dword [rsp + 0x40], 0x800
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1030]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r12d, 1
test eax, eax
jne 0x180006115
nop word [rax + rax]
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x30]
call fcn.18010a4e0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x1030]
lea rcx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.180002650
test rax, rax
je 0x18000610a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rbp + 0x30]
lea rax, [rbp + 0x30]
test rax, 0xffffffffffff0000
jne 0x180005c11
movzx ebx, cx
mov ecx, ebx
call fcn.1800021f0
test rax, rax
je 0x180005c3c
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180001f30
jmp 0x180005c3c
lea rcx, [rbp + 0x30]
mov rax, r14
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180005c20
mov r8d, eax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.180001df0
nop
test r13b, r13b
je 0x180005c5d
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x2030]
lea rdx, [0x180155a88]
lea rcx, [rsp + 0x68]
call fcn.18000a800
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180005ce2
mov dword [rsp + 0x40], 0x800
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1030]
mov edx, r12d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
inc r12d
lea rdx, [rbx - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1800060b9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
jmp 0x1800060b9
mov dword [rsp + 0x48], 4
xor eax, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x44], 4
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.SystemComponent
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x60], 0
jne 0x180006053
call fcn.180002650
test rax, rax
je 0x1800060ff
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea rax, [0x180155a7a]
mov rdi, rax
shr rdi, 0x10
test rdi, rdi
jne 0x180005d85
movzx esi, ax
mov ecx, esi
call fcn.1800021f0
test rax, rax
je 0x180005d94
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180001f30
jmp 0x180005d8f
lea rcx, [rsp + 0x58]
call fcn.18000a570
mov rbx, qword [rsp + 0x58]
call fcn.180002650
test rax, rax
je 0x1800060f4
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rsi, [rax + 0x18]
mov qword [rsp + 0x50], rsi
test rdi, rdi
jne 0x180005de1
lea rax, [0x180155a7a]
movzx edi, ax
mov ecx, edi
call fcn.1800021f0
test rax, rax
je 0x180005df0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180001f30
jmp 0x180005deb
lea rcx, [rsp + 0x50]
call fcn.18000a570
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x44], 0x1000
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x180005e28
mov edx, 0x800
lea rcx, [rsp + 0x58]
call fcn.180002040
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.180116370
test eax, eax
js 0x1800060e9
cmp eax, dword [rbx - 0xc]
jg 0x1800060e9
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
test edi, edi
jne 0x180006015
mov rax, qword [r15]
mov rdi, qword [rax]
mov qword [rbp - 0x58], rax
cmp rdi, rax
je 0x180005ef8
lea rcx, [rdi + 0x10]
lea rdx, [rbp - 0x60]
call fcn.180005570
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x1800060c6
mov rcx, rbx
call fcn.180115fd4
test eax, eax
sete bl
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180005ed7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x180006010
mov rdi, qword [rdi]
mov rax, qword [r15]
mov qword [rbp - 0x58], rax
mov rbx, qword [rsp + 0x58]
cmp rdi, rax
jne 0x180005e92
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x44], 0x1000
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x180005f28
mov edx, 0x800
lea rcx, [rsp + 0x50]
call fcn.180002040
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.180116370
test eax, eax
js 0x1800060de
cmp eax, dword [rsi - 0xc]
jg 0x1800060de
mov dword [rsi - 0x10], eax
cdqe
xor ecx, ecx
mov word [rsi + rax*2], cx
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180001c00
nop
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.180001c00
nop
mov rbx, qword [r15]
lea r9, [rbp - 0x70]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.18000ad20
mov rdx, qword [r15 + 8]
movabs rcx, 0x7fffffffffffffe
sub rcx, rdx
cmp rcx, 1
jb 0x1800060d1
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180005ff2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180006010
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rsp + 0x50]
lea rdx, [rsi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180006030
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000604f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov esi, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], 0x800
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x1030]
mov edx, r12d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
inc r12d
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800060b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test edi, edi
jne 0x180006115
mov rdi, qword [rbp - 0x78]
jmp 0x180005b90
mov ecx, 0x80004005
call fcn.180002760
nop
lea rcx, str.list_T__too_long
call fcn.180106c54
nop
mov ecx, 0x80070057
call fcn.180002760
int3
mov ecx, 0x80070057
call fcn.180002760
nop
mov ecx, 0x80004005
call fcn.180002760
nop
mov ecx, 0x80004005
call fcn.180002760
nop
mov ecx, 0x80004005
call fcn.180002760
int3
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rsp + 0x70]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x18000613e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov al, 1
mov rcx, qword [rbp + 0x3030]
xor rcx, rsp
call fcn.180107470
lea r11, [rsp + 0x3140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret