Function at 0x140071810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r15, rdx
mov dword [rbp - 0x20], 0x4f0053
mov dword [rbp - 0x1c], 0x540046
mov dword [rbp - 0x18], 0x410057
mov dword [rbp - 0x14], 0x450052
mov dword [rbp - 0x10], 0x4d005c
mov dword [rbp - 0xc], 0x630061
mov dword [rbp - 8], 0x6f0072
mov dword [rbp - 4], 0x65006d
mov dword [rbp], 0x690064
mov dword [rbp + 4], 0x5c0061
mov dword [rbp + 8], 0x6c0046
mov dword [rbp + 0xc], 0x730061
mov dword [rbp + 0x10], 0x500068
mov dword [rbp + 0x14], 0x61006c
mov dword [rbp + 0x18], 0x650079
mov dword [rbp + 0x1c], 0x410072
mov dword [rbp + 0x20], 0x740063
mov dword [rbp + 0x24], 0x760069
mov dword [rbp + 0x28], 0x580065
xor r13d, r13d
mov word [rbp + 0x2c], r13w
lea rcx, [rbp - 0x58]
call fcn.140001fec
nop
lea edx, [r13 + 8]
lea rcx, [rbp - 0x80]
call fcn.140042dc0
lea ecx, [r13 + 0x10]
call fcn.1400a08c4
mov rbx, rax
mov qword [rsp + 0x40], rax
mov dword [rax], r13d
lea rdx, str.Advapi32.dll
lea rcx, [rsp + 0x48]
call fcn.140001c78
nop
call fcn.1400161e0
mov rcx, rax
lea rdx, [rsp + 0x48]
call fcn.140016280
mov qword [rbx + 8], rax
lea rcx, [rsp + 0x48]
call fcn.140001c70
nop
mov qword [rbp - 0x80], rbx
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x48]
call fcn.140001c78
nop
mov qword [rsp + 0x78], r13
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140071961
mov bl, 1
jmp 0x1400719b1
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14007197a
mov bl, 1
jmp 0x1400719b1
mov rax, qword [rbp - 0x80]
mov ebx, dword [rax]
or ebx, 0x20019
lea rcx, [rsp + 0x48]
call fcn.140001c60
mov rdx, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
call rdi
test eax, eax
setne bl
lea rcx, [rsp + 0x48]
call fcn.140001c70
test bl, bl
jne 0x140071c6a
mov dword [rbp - 0x38], 0x6c0050
mov dword [rbp - 0x34], 0x790061
mov dword [rbp - 0x30], 0x720065
mov dword [rbp - 0x2c], 0x610050
mov dword [rbp - 0x28], 0x680074
mov word [rbp - 0x24], r13w
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x48]
call fcn.140001c78
nop
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.14000ca50
movzx ebx, al
lea rcx, [rsp + 0x48]
call fcn.140001c70
mov rcx, qword [rbp - 0x80]
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140071a4e
lea rdx, str.RegCloseKey
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140071a4e
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140071a4e
call rax
mov qword [rsp + 0x78], r13
test bl, bl
je 0x140071c6a
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x78]
call fcn.140016c70
nop
lea rcx, [rbp - 0x78]
call fcn.140002da0
test al, al
je 0x140071a78
xor bl, bl
jmp 0x140071c5f
lea rcx, [rbp - 0x78]
call fcn.140001ca0
cmp r15, rax
je 0x140071c5d
lea rcx, [rbp - 0x78]
call fcn.140001ca0
mov r12, rax
cmp qword [rax + 0x18], 8
jb 0x140071aa0
mov r12, qword [rax]
mov rsi, qword [rax + 0x10]
mov rcx, r15
call fcn.140001ca0
mov rdi, rax
mov r14, qword [rax + 0x18]
cmp rsi, r14
ja 0x140071aef
mov rbx, rax
cmp r14, 8
jb 0x140071ac4
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x140071c5d
mov rcx, r15
call fcn.140001f74
cmp rsi, rax
ja 0x140071cbd
mov rcx, r15
call fcn.140001f74
mov rbx, rax
mov rcx, r15
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x40], rcx
cmp rcx, rbx
ja 0x140071b54
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x140071b54
lea rax, [rcx + rdx]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x140071b77
mov rdx, r8
jmp 0x140071b80
cmp rdx, 0x1000
jb 0x140071baa
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x140071cc3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140071bbc
test rdx, rdx
je 0x140071bb9
mov rcx, rdx
call fcn.1400a08c4
jmp 0x140071bbc
mov rax, r13
mov qword [rsp + 0x38], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x38]
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
cmp r14, 8
jb 0x140071c35
mov rcx, qword [rdi]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x140071c26
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140071cb7
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x140071c5d
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov bl, 1
lea rcx, [rbp - 0x78]
call fcn.140001c70
jmp 0x140071c6c
xor bl, bl
mov edx, 0x10
mov rcx, qword [rbp - 0x80]
call fcn.1400a0900
mov qword [rbp - 0x80], r13
lea rcx, [rbp - 0x58]
call fcn.140001c70
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400a08a0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400a4d80
nop
call fcn.140001f60
int3
call fcn.1400a4d80
int3