Function at 0x14000ffd0
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14016d408]
xor rax, rsp
invalid
mov qword [rbp + 0x3b0], rax
mov r14, rcx
mov qword [rbp - 0x48], rcx
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], r13b
mov dword [rbp - 0x48], 0x3e8
mov byte [rsp + 0x40], 0x56
mov byte [rsp + 0x41], 0x7c
mov byte [rsp + 0x42], 0x76
mov byte [rsp + 0x43], 0x77
mov byte [rsp + 0x44], 0x68
mov byte [rsp + 0x45], reloc.WS2_32.dll_WSASetLastError
mov byte [rsp + 0x46], 0x50
mov byte [rsp + 0x47], 0x64
mov byte [rsp + 0x48], WSAStartup
mov byte [rsp + 0x49], 0x78
mov byte [rsp + 0x4a], 0x69
mov byte [rsp + 0x4b], 0x64
mov byte [rsp + 0x4c], 0x66
mov byte [rsp + 0x4d], 0x77
mov byte [rsp + 0x4e], 0x78
mov byte [rsp + 0x4f], 0x75
mov byte [rsp + 0x50], 0x68
mov byte [rsp + 0x51], 0x75
mov byte [rsp + 0x52], r13b
movzx eax, byte [rsp + 0x40]
mov ecx, r13d
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x40]
sub al, 3
mov byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x12
jb 0x1400100a0
mov byte [rsp + 0x58], 0x59
mov byte [rsp + 0x59], 0x5f
mov byte [rsp + 0x5a], 0x59
mov byte [rsp + 0x5b], 0x5a
mov byte [rsp + 0x5c], 0x4b
mov byte [rsp + 0x5d], 0x53
mov byte [rsp + 0x5e], 0x62
mov byte [rsp + 0x5f], 0x49
mov byte [rsp + 0x60], 0x7b
mov byte [rsp + 0x61], 0x78
mov byte [rsp + 0x62], 0x78
mov byte [rsp + 0x63], WSAGetLastError
mov byte [rsp + 0x64], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x65], 0x7a
mov byte [rsp + 0x66], 0x49
mov byte [rsp + 0x67], 0x75
and al, 0x67
jne 0x1400100cb
and al, 0x68
je 0x1400100d0
and al, 0x69
jp 0x1400100d5
and al, 0x6a
js 0x1400100da
and al, 0x6b
jne 0x1400100df
and al, 0x6c
jb 0x1400100e4
and al, 0x6d
pop rcx
mov byte [rsp + 0x6e], WSAGetLastError
mov byte [rsp + 0x6f], 0x7a
mov byte [rsp + 0x70], 0x62
mov byte [rsp + 0x71], 0x49
mov byte [rsp + 0x72], 0x75
mov byte [rsp + 0x73], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x74], 0x7a
mov byte [rsp + 0x75], 0x78
mov byte [rsp + 0x76], 0x75
mov byte [rsp + 0x77], WSAStartup
mov byte [rsp + 0x78], 0x62
mov byte [rsp + 0x79], 0x59
mov byte [rsp + 0x7a], 0x7f
mov byte [rsp + 0x7b], 0x79
mov byte [rsp + 0x7c], 0x7a
mov byte [rsp + 0x7d], WSAGetLastError
mov byte [rsp + 0x7e], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x7f], 0x4f
mov byte [rbp - 0x80], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x7f], WSAGetLastError
mov byte [rbp - 0x7e], 0x75
mov byte [rbp - 0x7d], 0x78
mov byte [rbp - 0x7c], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x7b], 0x67
mov byte [rbp - 0x7a], 0x7a
mov byte [rbp - 0x79], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x78], 0x75
mov byte [rbp - 0x77], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x76], 0
movzx eax, byte [rsp + 0x58]
mov rcx, r13
movzx eax, byte [rsp + rcx + 0x58]
sub al, 6
mov byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 0x32
jb 0x1400101b0
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov r9d, 0xffff
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov r12d, eax
lea rax, [rbp - 0x40]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010210
mov esi, r13d
test rbx, rbx
je 0x140010259
mov rax, r13
nop dword [rax]
nop dword [rax + rax]
lea r15, [rbp - 0x40]
add r15, rax
movsx ecx, byte [r15]
call fcn.1400ed560
test eax, eax
je 0x140010250
movsx ecx, byte [r15]
call fcn.1400ed73c
mov byte [r15], al
inc esi
mov eax, esi
cmp rax, rbx
jb 0x140010230
lea rax, [rbp - 0x40]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140010260
mov rax, qword [rbp - 0x50]
cmp rdi, rax
ja 0x140010298
lea rbx, [rbp - 0x68]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x68]
mov qword [rbp - 0x58], rdi
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1400e2ff0
mov byte [rbx + rdi], 0
jmp 0x1400102a8
lea r9, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.14000ac90
test r12d, r12d
jne 0x1400102c0
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [r14 + 0x10], xmm1
jmp 0x140010319
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], r13
xor r8d, r8d
lea rdx, [0x140152033]
mov rcx, r14
call fcn.140007bd0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140010319
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001034c
call fcn.1400e117c
mov rax, r14
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400e0e00
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400e82e4
int3