Function at 0x18008ce40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x5e8], rbx
mov rax, qword [0x1801b8080]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov r15, r8
mov qword [rsp + 0x58], r8
mov ebx, edx
mov r14, rcx
xor eax, eax
mov dword [rsp + 0x50], eax
movzx r9d, dx
imul r12d, r9d, 0x10001
mov dword [rbp - 0x10], 0x790053
mov dword [rbp - 0xc], 0x740073
mov dword [rbp - 8], 0x6d0065
mov dword [rbp - 4], 0x43005c
mov dword [rbp], 0x720075
mov dword [rbp + 4], 0x650072
mov dword [rbp + 8], 0x74006e
mov dword [rbp + 0xc], 0x6f0043
mov dword [rbp + 0x10], 0x74006e
mov dword [rbp + 0x14], 0x6f0072
mov dword [rbp + 0x18], 0x53006c
mov dword [rbp + 0x1c], 0x740065
mov dword [rbp + 0x20], 0x43005c
mov dword [rbp + 0x24], 0x6e006f
mov dword [rbp + 0x28], 0x720074
mov dword [rbp + 0x2c], 0x6c006f
mov dword [rbp + 0x30], 0x4b005c
mov dword [rbp + 0x34], 0x790065
mov dword [rbp + 0x38], 0x6f0062
mov dword [rbp + 0x3c], 0x720061
mov dword [rbp + 0x40], 0x200064
mov dword [rbp + 0x44], 0x61004c
mov dword [rbp + 0x48], 0x6f0079
mov dword [rbp + 0x4c], 0x740075
mov dword [rbp + 0x50], 0x73
xor esi, esi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], si
cmp edx, r12d
cmovne r9d, edx
lea r8, [rbp - 0x10]
lea rdx, str._s_08x
lea rcx, [rbp - 0x38]
call fcn.18009d690
mov rcx, qword [r14]
test rcx, rcx
je 0x18008d5c4
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rdx, [0x180168d88]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
test rsi, rsi
je 0x18008d5c2
test rdi, rdi
je 0x18008d5c2
test rax, rax
je 0x18008d5c2
xor eax, eax
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rdx, qword [rbp - 0x38]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call rsi
test eax, eax
jne 0x18008d5c2
test ebx, 0xffff0000
cmove ebx, r12d
mov dword [r15], ebx
xor esi, esi
mov dword [rbp - 0x7c], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call fcn.18010be50
mov dword [rbp - 0x80], 0x208
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Ime_File
mov rcx, qword [rsp + 0x78]
call rdi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], si
lea rax, [rbp + 0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], si
jne 0x18008d093
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x58]
call fcn.180004930
nop
mov r12, qword [rbp - 0x48]
test r12, r12
je 0x18008d3e1
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov r8d, 0xb
lea rdx, str.Shell32.dll
lea rcx, [rsp + 0x30]
call fcn.180004930
nop
call fcn.1800af850
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1800af8f0
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18008d15c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d645
call fcn.1800ecd20
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
test rdi, rdi
je 0x18008d1eb
lea rdx, [0x18016a730]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x18008d1eb
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x270]
call fcn.18010be50
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
call rdi
test eax, eax
jne 0x18008d1eb
lea rax, [rbp + 0x270]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18008d1d0
lea rdx, [rbp + 0x270]
lea rcx, [rbp - 0x78]
call fcn.180004930
mov edx, 0x10
lea rcx, [rbp - 0x78]
call fcn.1800a83f0
nop
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov dword [rsp + 0x50], 1
mov r14, qword [rbp - 0x68]
lea rdx, [r14 + r12]
lea rcx, [rsp + 0x30]
call fcn.18000d690
lea r9, [rbp - 0x78]
mov r15, qword [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r9, r15
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18008d287
lea rsi, [r14 + rcx]
mov qword [rsp + 0x40], rsi
lea rdi, [rsp + 0x30]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x30]
lea r8, [r14 + r14]
lea rcx, [rdi + rcx*2]
mov rdx, r9
call fcn.18010b9f0
xor eax, eax
mov word [rdi + rsi*2], ax
jmp 0x18008d29d
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.18000d4b0
mov r15, qword [rbp - 0x78]
lea r9, [rbp - 0x58]
mov r14, qword [rbp - 0x58]
mov r13, qword [rbp - 0x40]
cmp r13, 8
cmovae r9, r14
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp r12, rax
ja 0x18008d2f6
lea rsi, [r12 + rcx]
mov qword [rsp + 0x40], rsi
lea rdi, [rsp + 0x30]
cmp rdx, 8
cmovae rdi, qword [rsp + 0x30]
lea r8, [r12 + r12]
lea rcx, [rdi + rcx*2]
mov rdx, r9
call fcn.18010b9f0
xor eax, eax
mov word [rdi + rsi*2], ax
jmp 0x18008d310
mov qword [rsp + 0x20], r12
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.18000d4b0
mov r13, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov rcx, qword [rsp + 0x58]
add rcx, 8
lea rdx, [rsp + 0x30]
call fcn.18000ca50
mov eax, 1
and eax, 0xfffffffe
mov dword [rsp + 0x50], eax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18008d371
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d36c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d64b
call fcn.1800ecd20
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov rax, qword [rbp - 0x60]
cmp rax, 8
jb 0x18008d3c5
lea rdx, [rax*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x18008d3bd
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d651
mov rcx, r15
call fcn.1800ecd20
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x58]
jmp 0x18008d3e9
mov r13, qword [rbp - 0x40]
mov r14, qword [rbp - 0x58]
mov dword [rbp - 0x80], 0x208
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Layout_Display_Name
mov rcx, qword [rsp + 0x78]
call rdi
test eax, eax
jne 0x18008d51e
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
lea rax, [rbp + 0x60]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18008d440
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.180004930
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x30]
call fcn.18008d670
nop
lea rcx, [r15 + 0x28]
mov rdx, rax
call fcn.18000ca50
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18008d4b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d4b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d657
call fcn.1800ecd20
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x18008d50c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d65d
call fcn.1800ecd20
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
jmp 0x18008d56a
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Layout_Text
mov rcx, qword [rsp + 0x78]
call rdi
lea rax, [rbp + 0x60]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x18008d550
lea rcx, [r15 + 0x28]
mov r8, rbx
lea rdx, [rbp + 0x60]
call fcn.180004930
mov rcx, qword [rsp + 0x78]
call qword [rsp + 0x68]
mov bl, 1
cmp r13, 8
jb 0x18008d5b0
lea rdx, [r13*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x18008d5a8
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d663
mov rcx, r14
call fcn.1800ecd20
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], si
jmp 0x18008d5c6
xor esi, esi
xor bl, bl
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x18008d602
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008d5fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008d63f
call fcn.1800ecd20
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], si
movzx eax, bl
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1800eccc0
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x590
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
nop
call fcn.18010e7e4
int3