Function at 0x1800501e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rax, r9
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r8
mov r9, rdx
mov qword [rsp + 0x68], rdx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x40], r15d
mov rcx, rax
call fcn.180009bf0
mov rcx, r9
call fcn.180009bf0
mov rcx, r8
call fcn.180009bf0
lea rdx, str.Advapi32.dll
lea rcx, [rbp + 0x30]
call fcn.180005ef8
nop
call fcn.18005e290
mov rcx, rax
lea rdx, [rbp + 0x30]
call fcn.18005e330
mov rbx, rax
lea rcx, [rbp + 0x30]
call fcn.180005bf4
test rbx, rbx
je 0x180050c05
lea rdx, [0x1800d3030]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
mov qword [rsp + 0x48], rax
lea rdx, str.RegEnumValueW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, [0x1800d3058]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
test r14, r14
je 0x180050c05
test rdi, rdi
je 0x180050c05
test rax, rax
je 0x180050c05
mov qword [rbp - 0x60], r15
lea rdx, str.SOFTWARE_
lea rcx, [rbp - 0x38]
call fcn.180005ef8
nop
mov dword [rbp - 8], 0x650054
mov dword [rbp - 4], 0x63006e
mov dword [rbp], 0x6e0065
mov dword [rbp + 4], 0x74
mov dword [rbp + 8], 0x510051
mov dword [rbp + 0xc], 0x430050
mov dword [rbp + 0x10], 0x67004d
mov dword [rbp + 0x14], 0x72
lea rcx, [rbp - 8]
call fcn.180006330
mov r12, rax
lea rcx, [rbp - 0x38]
call fcn.180005c20
mov rdi, rax
mov r14, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
mov qword [rbp - 0x48], rax
mov rcx, rax
sub rcx, r14
cmp r12, rcx
ja 0x1800503a4
lea r15, [r14 + r12]
mov qword [rdi + 0x10], r15
mov rbx, rdi
cmp rax, 8
jb 0x18005037c
mov rbx, qword [rdi]
lea rcx, [rbx + r14*2]
mov r8, r12
lea rdx, [rbp - 8]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rcx, [rbx + r15*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
jmp 0x18005055d
lea rcx, [rbp - 0x38]
call fcn.180006d84
sub rax, r14
cmp rax, r12
jb 0x180050c35
lea r13, [r14 + r12]
lea rcx, [rbp - 0x38]
call fcn.180006d84
mov rbx, rax
lea rcx, [rbp - 0x38]
call fcn.180005c20
mov rcx, r13
or rcx, 7
mov qword [rbp - 0x18], rcx
cmp rcx, rbx
ja 0x18005040f
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x18005040f
lea rax, [rcx + rdx]
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.18000621c
mov rbx, qword [rax]
mov rax, rbx
add rax, 1
mov r8, 0xffffffffffffffff
cmovb rax, r8
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180050439
mov rdx, r8
jmp 0x180050442
cmp rdx, 0x1000
jb 0x18005046c
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180086a58
mov rcx, rax
test rax, rax
je 0x180050c3b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x18005047e
test rdx, rdx
je 0x18005047b
mov rcx, rdx
call fcn.180086a58
jmp 0x18005047e
mov rax, r15
mov qword [rbp - 0x50], rax
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], rbx
mov r15, qword [rbp - 0x50]
mov r8, r14
mov rcx, r15
cmp qword [rbp - 0x48], 8
jb 0x18005050b
mov rbx, qword [rdi]
mov rdx, rbx
call fcn.180006328
lea rcx, [r15 + r14*2]
mov r8, r12
lea rdx, [rbp - 8]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rcx, [r15 + r13*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
mov rax, qword [rbp - 0x48]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1800504fa
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x180050c41
mov rbx, rcx
mov rcx, rbx
call fcn.1800862a4
mov rax, qword [rbp - 0x50]
mov qword [rdi], rax
jmp 0x18005055d
mov rdx, rdi
call fcn.180006328
lea rcx, [r15 + r14*2]
mov r8, r12
lea rdx, [rbp - 8]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rcx, [r15 + r13*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
mov rcx, rdi
call fcn.180005c20
mov rdx, rax
mov ecx, 8
call fcn.180005d08
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.180005c20
mov rcx, qword [rax]
mov qword [rbx], rcx
lea rcx, [0x1800d2e24]
call fcn.180006330
mov r15, rax
mov r14, qword [rdi + 0x10]
mov r13, qword [rdi + 0x18]
mov rcx, r13
sub rcx, r14
cmp rax, rcx
ja 0x1800505be
lea r12, [r14 + rax]
mov qword [rdi + 0x10], r12
mov rbx, rdi
cmp r13, 8
jb 0x180050593
mov rbx, qword [rdi]
lea rcx, [rbx + r14*2]
mov r8, r15
lea rdx, [0x1800d2e24]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rcx, [rbx + r12*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
jmp 0x18005077f
lea rcx, [rbp - 0x38]
call fcn.180006d84
sub rax, r14
cmp rax, r15
jb 0x180050c47
lea r12, [r14 + r15]
lea rcx, [rbp - 0x38]
call fcn.180006d84
mov rbx, rax
lea rcx, [rbp - 0x38]
call fcn.180005c20
mov rcx, r12
or rcx, 7
mov qword [rbp - 0x40], rcx
cmp rcx, rbx
ja 0x180050629
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x180050629
lea rax, [rdx + rcx]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.18000621c
mov rbx, qword [rax]
mov rax, rbx
add rax, 1
mov r8, 0xffffffffffffffff
cmovb rax, r8
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x180050653
mov rdx, r8
jmp 0x18005065c
cmp rdx, 0x1000
jb 0x180050686
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180086a58
mov rcx, rax
test rax, rax
je 0x180050c4d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180050697
test rdx, rdx
je 0x180050695
mov rcx, rdx
call fcn.180086a58
jmp 0x180050697
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], rbx
mov r12, qword [rbp - 0x50]
mov r8, r14
mov rcx, r12
cmp r13, 8
jb 0x180050726
mov rbx, qword [rdi]
mov rdx, rbx
call fcn.180006328
lea rcx, [r12 + r14*2]
mov r8, r15
lea rdx, [0x1800d2e24]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rax, [r14 + r15]
lea rcx, [r12 + rax*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
lea rdx, [r13*2 + 2]
cmp rdx, 0x1000
jb 0x180050715
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x180050c53
mov rbx, rcx
mov rcx, rbx
call fcn.1800862a4
mov rax, qword [rbp - 0x50]
mov qword [rdi], rax
jmp 0x18005077f
mov rdx, rdi
call fcn.180006328
lea rcx, [r12 + r14*2]
mov r8, r15
lea rdx, [0x1800d2e24]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rax, [r14 + r15]
lea rcx, [r12 + rax*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
mov rcx, rdi
call fcn.180005c20
mov rdx, rax
mov ecx, 8
call fcn.180005d08
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.180005c20
mov rcx, qword [rax]
mov qword [rbx], rcx
lea rcx, [rbp + 8]
call fcn.180006330
mov r15, rax
mov r14, qword [rdi + 0x10]
mov r13, qword [rdi + 0x18]
mov rcx, r13
sub rcx, r14
cmp rax, rcx
ja 0x1800507d9
lea rbx, [r14 + rax]
mov qword [rdi + 0x10], rbx
cmp r13, 8
jb 0x1800507af
mov rdi, qword [rdi]
lea rcx, [rdi + r14*2]
mov r8, r15
lea rdx, [rbp + 8]
call fcn.180006328
xor r13d, r13d
mov word [rbp - 0x58], r13w
lea rcx, [rdi + rbx*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
jmp 0x180050998
lea rcx, [rbp - 0x38]
call fcn.180006d84
sub rax, r14
cmp rax, r15
jb 0x180050c59
lea r12, [r14 + r15]
lea rcx, [rbp - 0x38]
call fcn.180006d84
mov rbx, rax
lea rcx, [rbp - 0x38]
call fcn.180005c20
mov rcx, r12
or rcx, 7
mov qword [rbp - 0x40], rcx
cmp rcx, rbx
ja 0x180050844
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x180050844
lea rax, [rdx + rcx]
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.18000621c
mov rbx, qword [rax]
mov rax, rbx
add rax, 1
mov r8, 0xffffffffffffffff
cmovb rax, r8
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x18005086e
mov rdx, r8
jmp 0x180050877
cmp rdx, 0x1000
jb 0x1800508a1
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.180086a58
mov rcx, rax
test rax, rax
je 0x180050c5f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800508b2
test rdx, rdx
je 0x1800508b0
mov rcx, rdx
call fcn.180086a58
jmp 0x1800508b2
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], rbx
mov r12, qword [rbp - 0x50]
mov r8, r14
mov rcx, r12
cmp r13, 8
jb 0x180050941
mov rbx, qword [rdi]
mov rdx, rbx
call fcn.180006328
lea rcx, [r12 + r14*2]
mov r8, r15
lea rdx, [rbp + 8]
call fcn.180006328
xor eax, eax
mov word [rbp - 0x58], ax
lea rax, [r14 + r15]
lea rcx, [r12 + rax*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
lea rdx, [r13*2 + 2]
cmp rdx, 0x1000
jb 0x18005092d
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x180050c2f
mov rbx, rcx
mov rcx, rbx
call fcn.1800862a4
mov rax, qword [rbp - 0x50]
mov qword [rdi], rax
xor r13d, r13d
jmp 0x180050998
mov rdx, rdi
call fcn.180006328
lea rcx, [r12 + r14*2]
mov r8, r15
lea rdx, [rbp + 8]
call fcn.180006328
xor r13d, r13d
mov word [rbp - 0x58], r13w
lea rax, [r14 + r15]
lea rcx, [r12 + rax*2]
lea rdx, [rbp - 0x58]
call fcn.180005cc8
mov rcx, rdi
call fcn.180005c20
mov rdx, rax
lea ecx, [r13 + 8]
call fcn.180005d08
mov rbx, rax
lea rcx, [rbp - 0x50]
call fcn.180005c20
mov rcx, qword [rax]
mov qword [rbx], rcx
mov dword [rbp + 0x18], 0x750053
mov dword [rbp + 0x1c], 0x700070
mov dword [rbp + 0x20], 0x79006c
mov dword [rbp + 0x24], 0x440049
mov word [rbp + 0x28], r13w
mov dword [rbp - 0x18], 0x650056
mov dword [rbp - 0x14], 0x730072
mov dword [rbp - 0x10], 0x6f0069
mov dword [rbp - 0xc], 0x6e
mov dword [rbp + 0x30], 0x6e0049
mov dword [rbp + 0x34], 0x740073
mov dword [rbp + 0x38], 0x6c0061
mov dword [rbp + 0x3c], 0x54006c
mov dword [rbp + 0x40], 0x6d0069
mov dword [rbp + 0x44], 0x65
lea rcx, [rbp - 0x38]
call fcn.180005be4
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [rsp + 0x48]
test eax, eax
jne 0x180050bfc
mov ebx, r13d
mov dword [rbp - 0x58], r13d
mov dword [rbp - 0x50], 0x103
mov dword [rbp - 0x48], 0x103
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x160]
call fcn.18008a090
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x50]
call fcn.18008a090
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x160]
xor edx, edx
mov rcx, qword [rbp - 0x60]
mov rdi, qword [rsp + 0x50]
call rdi
test eax, eax
jne 0x180050bf0
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
nop dword [rax]
mov word [rbp + 0x366], r13w
cmp word [rbp + 0x160], 0
je 0x180050b99
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x160]
call fcn.180054c90
test al, al
je 0x180050b2d
cmp dword [rbp - 0x58], 4
jne 0x180050b99
mov word [rbp + 0x152], 0
mov edx, dword [rbp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180054a70
or esi, 1
mov dword [rsp + 0x40], esi
mov rdx, rax
mov rcx, r12
call fcn.180005e60
and esi, 0xfffffffe
mov dword [rsp + 0x40], esi
lea rcx, [rbp - 0x80]
call fcn.180005bf4
jmp 0x180050b99
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x160]
call fcn.180054c90
test al, al
je 0x180050b5e
cmp dword [rbp - 0x58], 1
jne 0x180050b99
mov word [rbp + 0x152], 0
lea rcx, [rbp + 0x50]
call fcn.180006330
mov rcx, r14
jmp 0x180050b8d
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x160]
call fcn.180054c90
test al, al
je 0x180050b99
cmp dword [rbp - 0x58], 1
jne 0x180050b99
mov word [rbp + 0x152], 0
lea rcx, [rbp + 0x50]
call fcn.180006330
mov rcx, r15
mov r8, rax
lea rdx, [rbp + 0x50]
call fcn.180006098
mov word [rbp + 0x160], r13w
mov dword [rbp - 0x50], 0x103
mov dword [rbp - 0x48], 0x103
mov dword [rbp - 0x58], r13d
inc ebx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x160]
mov edx, ebx
mov rcx, qword [rbp - 0x60]
call rdi
test eax, eax
je 0x180050ac0
mov rcx, qword [rbp - 0x60]
call qword [rsp + 0x70]
mov qword [rbp - 0x60], r13
lea rcx, [rbp - 0x38]
call fcn.180005bf4
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.180086280
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18008ccdc
nop
call fcn.180006d70
int3
call fcn.18008ccdc
int3
call fcn.18008ccdc
int3
call fcn.180006d70
int3
call fcn.18008ccdc
int3
call fcn.18008ccdc
int3
call fcn.180006d70
int3
call fcn.18008ccdc
int3