Function at 0x140004c18
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov qword [rbp + 0x40], 0xfffffffffffffffe
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rdi
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140008548
mov rsi, rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x38], rdi
mov dword [rbp + 0x2c8], edi
mov dword [rbp - 0x40], edi
mov dword [rbp + 0x2d8], edi
mov dword [rbp + 0x2d0], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r14, 0xffffffff80000003
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movabs r15, 0x555555555555554
mov eax, dword [rbp + 0x2c8]
test eax, eax
je 0x140004dcd
mov ebx, edi
mov dword [rbp - 0x3c], 0x104
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x3c]
lea r8, [rbp + 0x50]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140004db1
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], rdi
mov byte [rbp - 0x10], dil
cmp byte [rbp + 0x50], dil
jne 0x140004d3c
mov r8, rdi
jmp 0x140004d4d
lea rax, [rbp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140004d44
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000d058
nop
lea r9, [rbp - 0x10]
mov r8, qword [rsi + 8]
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140009d2c
mov rcx, r15
mov rdx, qword [rbp - 0x28]
sub rcx, rdx
cmp rcx, 1
jb 0x140004dc0
inc rdx
mov qword [rbp - 0x28], rdx
mov qword [rsi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140004dad
inc rdx
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.14000ce04
mov rsi, qword [rbp - 0x30]
inc ebx
cmp ebx, dword [rbp + 0x2c8]
jae 0x140004dcd
jmp 0x140004ceb
lea rcx, str.list_T__too_long
call fcn.1400bc800
nop
mov word [rsp + 0x72], 0x6567
mov dword [rsp + 0x68], 0x666f7250
mov word [rsp + 0x6f], 0x6d49
mov byte [rsp + 0x71], 0x61
mov word [rsp + 0x6c], 0x6c69
mov dword [rsp + 0x75], 0x687461
mov byte [rsp + 0x6e], 0x65
mov byte [rsp + 0x74], 0x50
mov word [rbp - 0x67], 0x2073
mov dword [rbp - 0x79], 0x694d5c45
mov word [rbp - 0x55], 0x5c6e
mov dword [rbp - 0x5a], 0x69737265
mov dword [rbp - 0x64], 0x75435c54
mov dword [rbp - 0x52], 0x69666f72
mov dword [rbp - 0x6e], 0x6e69575c
mov word [rbp - 0x60], 0x7272
mov dword [rbp - 0x72], 0x74666f73
mov dword [rbp - 0x80], 0x54464f53
mov word [rbp - 0x7b], 0x5241
mov word [rbp - 0x5d], 0x746e
mov dword [rbp - 0x4e], 0x694c656c
mov word [rbp - 0x4a], 0x7473
mov byte [rbp - 0x5e], 0x65
mov word [rbp - 0x6a], 0x6f64
mov byte [rbp - 0x7c], 0x57
mov byte [rbp - 0x53], 0x50
mov word [rbp - 0x74], 0x6f72
mov byte [rbp - 0x56], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x65], Ordinal_79
mov byte [rbp - 0x5b], 0x56
mov byte [rbp - 0x75], 0x63
mov byte [rbp - 0x48], dil
mov byte [rbp - 0x68], 0x77
mov word [rsp + 0x63], 0x7265
mov word [rsp + 0x66], reloc.SHELL32.dll_PathGetShortPath
mov word [rsp + 0x61], 0x7375
mov byte [rsp + 0x60], reloc.SHELL32.dll_PathGetShortPath
mov byte [rsp + 0x65], reloc.WS2_32.dll_WSAStartup
mov qword [rbp - 0x38], rdi
mov dword [rbp + 0x2c8], edi
mov dword [rbp - 0x40], edi
mov dword [rbp + 0x2d8], edi
mov dword [rbp + 0x2d0], edi
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400051de
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp + 0x2c8]
test eax, eax
je 0x1400051d3
mov r14d, edi
mov bl, byte [rbp + 0x2c8]
mov dword [rbp - 0x3c], 0x104
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x3c]
lea r8, [rbp + 0x50]
mov edx, r14d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400051b5
mov qword [rbp - 0x18], rdi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400051b5
mov dword [rbp - 0x20], 0x104
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400051ab
mov qword [rbp + 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x20], rdi
mov byte [rbp + 0x10], dil
cmp byte [rbp + 0x160], dil
jne 0x140005016
mov r8, rdi
jmp 0x14000502a
lea rax, [rbp + 0x160]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140005021
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x10]
call fcn.14000d058
nop
lea r13, [rbp + 0x10]
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
cmovae r13, r8
lea rcx, [rbp + 0x10]
cmovae rcx, r8
mov rax, qword [rbp + 0x20]
add rax, rcx
lea r12, [rbp + 0x10]
cmp rdx, 0x10
cmovae r12, r8
mov r15, rax
sub r15, r12
cmp r12, rax
cmova r15, rdi
test r15, r15
je 0x140005094
movsx ecx, byte [rdi + r12]
call fcn.140155970
mov byte [rdi + r13], al
inc rdi
cmp rdi, r15
jne 0x14000507c
xor edi, edi
cmp byte [rsp + 0x60], dil
jne 0x1400050a0
mov r9, rdi
jmp 0x1400050b2
lea rax, [rsp + 0x60]
or r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], dil
jne 0x1400050a9
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x10]
call fcn.1400069d0
cmp rax, 0xffffffffffffffff
je 0x14000518f
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov qword [rbp], rdi
mov byte [rbp - 0x10], dil
cmp byte [rbp + 0x50], dil
jne 0x1400050e8
mov r8, rdi
jmp 0x1400050f9
lea rax, [rbp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400050f0
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000d058
nop
mov byte [rsp + 0x20], bl
lea r9, [rbp - 0x10]
mov r8, rsi
mov rdx, qword [rsi]
lea rcx, [rbp + 0x38]
call fcn.14000a0e0
cmp qword [rbp + 0x38], rsi
setne al
test al, al
je 0x140005172
mov r15, qword [rbp + 0x2c0]
mov rdi, qword [r15]
lea r9, [rbp - 0x10]
mov r8, qword [rdi + 8]
mov rdx, rdi
mov rcx, r15
call fcn.140009cb8
mov rdx, qword [r15 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x1400051c6
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
xor edi, edi
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14000518f
inc rdx
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.14000ce04
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400051ab
inc rdx
mov r8d, 1
mov rcx, qword [rbp + 0x10]
call fcn.14000ce04
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
cmp r14d, dword [rbp + 0x2c8]
jae 0x1400051d3
jmp 0x140004f5a
lea rcx, str.list_T__too_long
call fcn.1400bc800
nop
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x30]
call fcn.140007610
mov edx, 1
lea r8d, [rdx + 0x2f]
mov rcx, qword [rbp - 0x30]
call fcn.14000ce04
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret