Function at 0x180004190
Capabilities:
Hash data with md5
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x1a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1800f10e0]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r15d, r15d
mov esi, r15d
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rbp + 0x10], reloc.WS2_32.dll_ntohs
mov qword [rbp + 8], r15
mov byte [rbp - 8], sil
lea r8d, [r15 + 0xa]
lea rdx, str.shellext64
lea rcx, [rbp - 8]
call fcn.1800051c0
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdx, qword [rbp - 8]
lea rcx, [rbp - 0x40]
call fcn.18000e0f0
nop
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r15
mov word [rbp - 0x60], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x1800f9148]
lea rcx, [rbp - 0x60]
call fcn.180007830
nop
xor r14b, r14b
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], r15
mov dword [rbp - 0x18], r15d
mov qword [rbp - 0x10], r15
mov rbx, 0xffffffff80000001
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x70]
mov ecx, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov rdx, qword [rsp + 0x70]
test eax, eax
cmovne rdx, rbx
mov qword [rsp + 0x70], rdx
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r8, qword [rbp - 0x60]
mov r9d, 0xf003f
lea rcx, [rbp - 0x20]
call fcn.180002bf0
mov rdi, qword [rbp - 0x20]
test eax, eax
jne 0x180004606
mov dword [rsp + 0x68], r15d
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180004606
cmp dword [rsp + 0x78], 3
jne 0x180004606
mov ecx, dword [rsp + 0x68]
call fcn.18006c7cc
mov rbx, rax
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.180071390
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], r14b
mov r8d, dword [rsp + 0x68]
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1800051c0
mov edx, dword [rsp + 0x68]
cmp rdx, 4
jb 0x18000443f
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rcx, rbx
call fcn.18000e400
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x18000443f
cmp qword [rsp + 0x58], r15
jbe 0x18000443f
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r15
mov byte [rsp + 0x30], r14b
lea r8d, [r15 + 0xb]
lea rdx, str.internetgif
lea rcx, [rsp + 0x30]
call fcn.1800051c0
nop
lea rcx, [rsp + 0x30]
call fcn.180002cf0
nop
lea rcx, [rsp + 0x30]
call fcn.1800052f0
mov byte [rbp + 0x88], r14b
mov qword [rbp + 0x30], r15
mov dword [rbp + 0x20], 0x67452301
mov dword [rbp + 0x24], 0xefcdab89
mov dword [rbp + 0x28], 0x98badcfe
mov dword [rbp + 0x2c], 0x10325476
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp + 0x20]
call fcn.18000d330
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.18000dea0
mov rdx, rax
lea rcx, [0x1800f9040]
call fcn.180005380
lea rcx, [rsp + 0x30]
call fcn.1800052f0
mov r14b, 1
mov rcx, rbx
call fcn.18006c7c4
nop
mov rax, qword [rbp - 0x68]
cmp rax, 0x10
jb 0x18000449e
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, 0x1000
jb 0x180004499
test cl, 0x1f
je 0x18000446c
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000447b
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x18000448a
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x180004496
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
test r14b, r14b
je 0x180004606
mov rcx, rsi
call qword [0x1800f9348]
mov qword [0x1800f7de8], rax
test rax, rax
je 0x18000468d
lea rdx, str.funcDoStrategy
mov rcx, rax
call qword [0x1800f9350]
mov qword [0x1800f7dc8], rax
lea rdx, str.funcEndStrategy
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7dd0], rax
lea rdx, str.funcGetMinSupportVersion
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7de0], rax
lea rdx, str.funcSetReportInterval
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7db0], rax
lea rdx, str.funcSetStringVal
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7db8], rax
lea rdx, str.funcSetIntVal
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7dc0], rax
lea rdx, str.funcSetWStringVal
mov rcx, qword [0x1800f7de8]
call qword [0x1800f9350]
mov qword [0x1800f7df0], rax
cmp qword [0x1800f7dc8], 0
je 0x1800045c1
cmp qword [0x1800f7dd0], 0
je 0x1800045c1
cmp qword [0x1800f7de0], 0
je 0x1800045c1
cmp qword [0x1800f7db0], 0
je 0x1800045c1
cmp qword [0x1800f7db8], 0
je 0x1800045c1
cmp qword [0x1800f7dc0], 0
je 0x1800045c1
test rax, rax
je 0x1800045c1
mov bl, 1
jmp 0x18000468f
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], r15
mov byte [rsp + 0x30], 0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.gif_work_failed
lea rcx, [rsp + 0x30]
call fcn.1800051c0
nop
lea rcx, [rsp + 0x30]
call fcn.180002cf0
nop
lea rcx, [rsp + 0x30]
call fcn.1800052f0
jmp 0x18000468d
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], 0
mov r8d, 6
lea rdx, str.nowork
lea rcx, [rbp - 0x80]
call fcn.1800051c0
nop
lea rcx, [rbp - 0x80]
call fcn.180002cf0
nop
mov rax, qword [rbp - 0x68]
cmp rax, 0x10
jb 0x18000468d
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, 0x1000
jb 0x180004688
test cl, 0x1f
je 0x18000465b
call fcn.180072ffc
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18000466a
call fcn.180072ffc
int3
sub rcx, rax
cmp rcx, 8
jae 0x180004679
call fcn.180072ffc
int3
cmp rcx, 0x27
jbe 0x180004685
call fcn.180072ffc
int3
mov rcx, rax
call fcn.18006baac
xor bl, bl
test rdi, rdi
je 0x18000469e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x1800046b8
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.1800094a0
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r15
mov word [rbp - 0x60], r15w
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x1800046e3
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.1800094a0
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r15
mov word [rbp - 0x40], r15w
lea rcx, [rbp - 8]
call fcn.1800052f0
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.18006c2f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret