Function at 0x1401012f0
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x1401da800]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
lea rsi, [0x14022e5e0]
mov eax, dword [rcx + rax]
cmp dword [0x14022e600], eax
jle 0x140101ced
lea rcx, [0x14022e600]
call fcn.1401989d0
cmp dword [0x14022e600], 0xffffffff
jne 0x140101ced
mov dword [rbp - 0x29], 0x77717853
mov dword [rbp - 0x25], 0x445a6861
mov dword [rbp - 0x21], 0x6e787b7d
mov dword [rbp - 0x1d], 0x604d7962
mov dword [rbp - 0x19], 0x7c60657e
mov dword [rbp - 0x15], 0x63734678
mov dword [rbp - 0x11], 0x697f4a44
mov dword [rbp - 0xd], 0x7a7d746a
mov word [rbp - 9], 0x7d53
mov byte [rbp - 7], Ordinal_35
xorps xmm0, xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
mov rdi, 0xffffffffffffffff
movabs r12, 0xf2b3f41b1ba70780
movabs r13, 0xf265388015ec5580
mov r14, qword [0x14022e4a0]
mov r15, qword [0x14022e4a8]
movzx r8d, byte [rbp - 0x39]
nop dword [rax]
mov rax, r15
mov r9, r14
nop word [rax + rax]
xor ebx, ebx
movabs rdx, 0x91a70b9fc45d4980
cmp rbx, 0x43
jae 0x140101ca0
movzx r11d, byte [rbp + rbx - 0x29]
movzx r10d, r11b
cmp rax, rbx
ja 0x140101c97
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14010143b
add rdx, rbx
mov rcx, rdx
and rcx, r11
imul r8, rcx, 0xfffffffffffffffe
add r8, rdx
add r8, r11
add r8b, 0x80
jmp 0x140101474
je 0x140101c29
inc rcx
cmp rax, rcx
je 0x140101ba5
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140101b6f
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140101b2b
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140101aff
movzx r10d, r11b
nop dword [rax + rax]
cmp r9, rbx
ja 0x140101c8e
lea rcx, [r9 + 0x64]
cmp rax, rcx
jae 0x1401014ae
lea r8, [rbx + r12]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x80
add r8b, dl
jmp 0x1401014e0
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140101aac
inc rcx
cmp rax, rcx
je 0x140101aa0
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140101a91
nop dword [rax]
nop dword [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x14010180e
nop dword [rax]
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x1401018d9
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x140101a43
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1401018af
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x14010188f
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x1401017f7
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x140101a02
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x14010186f
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1401019e2
lea rdx, [r9 + 0x64]
cmp rax, rdx
je 0x140101841
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x1401014f0
mov rax, rdx
lea r9, [rdx + 0x61]
lea rcx, [r9 + 0x3e8]
cmp rdx, rcx
jb 0x140101c74
lea rcx, [r9 + 5]
cmp rdx, rcx
jb 0x140101c5a
lea rcx, [r9 + 9]
cmp rdx, rcx
jb 0x1401016ef
lea rcx, [r9 + 0x20]
cmp rdx, rcx
jb 0x1401016d0
lea rcx, [r9 + 0x42]
cmp rdx, rcx
jb 0x1401016a8
lea rcx, [r9 + 0x200]
cmp rdx, rcx
jb 0x14010177c
lea rcx, [r9 + 0x1000]
cmp rdx, rcx
jb 0x1401017af
lea rcx, [r9 + 0x41]
cmp rdx, rcx
jb 0x140101745
lea rdx, [r9 + 0x10]
cmp rax, rdx
jb 0x140101720
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x1401014f0
mov rax, rdx
lea r9, [rdx + 0x80]
lea rcx, [r9 + 0x40]
cmp rdx, rcx
ja 0x140101841
lea rcx, [r9 + 0x2a]
cmp rdx, rcx
ja 0x1401019e2
lea rcx, [r9 + 3]
cmp rdx, rcx
ja 0x14010186f
lea rcx, [r9 + 6]
cmp rdx, rcx
ja 0x140101a02
lea rcx, [r9 + 0xa]
cmp rdx, rcx
ja 0x1401017f7
lea rcx, [r9 + 0x28]
cmp rdx, rcx
ja 0x14010188f
lea rcx, [r9 + 0x64]
cmp rdx, rcx
ja 0x1401018af
lea rcx, [r9 + 0x3e8]
cmp rdx, rcx
ja 0x140101a43
lea rdx, [r9 + 5]
cmp rax, rdx
ja 0x1401018d9
lea rcx, [r9 + 9]
cmp rax, rcx
ja 0x1401014f0
mov rax, rdx
lea r9, [rdx + 0x20]
jmp 0x1401014f0
movabs r8, 0x15b34fbf9ea6e880
add r8, rbx
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x80
add r8b, dl
jmp 0x1401014e0
lea r8, [rbx + r13]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x80
add r8b, dl
jmp 0x140101480
movabs r8, 0xcf1721408d31c280
add r8, rbx
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add dl, 0x80
add r8b, dl
movabs rdx, 0x91a70b9fc45d4980
jmp 0x140101410
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
mov byte [rbp + rbx - 0x29], r8b
inc rbx
jmp 0x1401013f2
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
cmp r9, 0x20
jb 0x140101738
movzx ecx, r11b
and cl, bl
add cl, cl
movzx edx, r11b
sub dl, cl
add dl, bl
lea r8d, [rdx + rdx]
jmp 0x140101ad1
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
lea rcx, [r9 + rax]
cmp rcx, 0x61
je 0x140101a7d
lea rdx, [r9 + 2]
cmp rax, rdx
jbe 0x1401018f0
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
cmp rax, 0x80
jae 0x140101a63
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jbe 0x1401019cd
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x14010175d
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x140101b8d
lea rcx, [r9 + 4]
cmp rax, rcx
jae 0x140101838
movabs rdx, 0x91a70b9fc45d4980
add rdx, rbx
movzx ecx, r11b
and cl, dl
add cl, cl
sub r10b, cl
lea r8d, [rdx + r10]
jmp 0x140101790
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140101866
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x1401013f2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140101886
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x140101bca
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1401018a6
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x140101b50
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x1401018cc
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
dec rbx
inc rbx
jmp 0x1401013f2
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140101794
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x140101ad1
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14010191b
movzx r10d, bl
lea edx, [r10 + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
jmp 0x140101ad5
inc rcx
cmp rax, rcx
jne 0x140101949
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
inc r9
dec rbx
inc rbx
jmp 0x1401013f2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140101975
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
dec rbx
inc rbx
jmp 0x1401013f2
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1401019ab
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x80
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x1401013f2
cmp rax, rdx
jne 0x1401017c7
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
jmp 0x140101c43
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140101841
inc rcx
cmp rax, rcx
jne 0x1401019f9
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
jmp 0x140101bf6
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140101a29
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x1401013f2
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14010188f
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14010175d
movzx edx, bl
and dl, r11b
add dl, dl
movzx r8d, bl
sub r8b, dl
add r8b, r11b
inc r9
dec rbx
inc rbx
jmp 0x1401013f2
movzx ecx, bl
and cl, r11b
add cl, cl
movzx r8d, bl
sub r8b, cl
add r8b, r11b
add r8b, r11b
jmp 0x140101b50
movzx ecx, bl
and cl, r11b
add cl, cl
movzx r8d, bl
sub r8b, cl
jmp 0x140101bca
movabs rdx, 0x7fec51193e915380
jmp 0x140101b35
movabs rcx, 0x3950229a2d1c2d80
jmp 0x140101b09
movabs rdx, 0x16020b5aa4619a80
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
add r8b, 0x80
add r8b, dl
movzx r11d, r10b
movzx r10d, bl
add r10b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x80
add r10b, r11b
mov byte [rbp + rbx - 0x29], r10b
inc r9
dec rbx
inc rbx
jmp 0x1401013f2
movabs rcx, 0xac17c59c0a31e180
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
add r8b, 0x80
inc r9
dec rbx
inc rbx
jmp 0x1401013f2
movabs rdx, 0x657b971cf8bcbb80
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
add r8b, 0x80
movzx r11d, r10b
add r8b, dl
lea edx, [rbx + 0x80]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, 0x80
add dl, r11b
add dl, r8b
mov byte [rbp + rbx - 0x29], dl
jmp 0x140101b8d
movabs rcx, 0x422d7fdd70022880
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
add r8b, 0x80
add rax, r9
movzx ecx, r8b
mov rdx, rdi
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x1401013f2
movabs rdx, 0xfb91515e5e8d0280
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
add r8b, 0x80
add r8b, dl
movzx r11d, r10b
movzx r10d, bl
add r10b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x80
add r10b, r11b
movzx ecx, r10b
mov byte [rbp + rbx - 0x29], cl
inc r9
add rcx, r9
sub rbx, rcx
movzx edx, bl
and dl, r11b
add dl, dl
movzx ecx, bl
sub cl, dl
add cl, r11b
mov byte [rbp + rbx - 0x29], cl
inc rax
mov rcx, rdi
sub rcx, rax
add rbx, rcx
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x1401013f2
movabs rcx, 0xb4f522df4d17dc80
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
add r8b, 0x80
movzx ecx, byte [rbp + rbx - 0x29]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x1401013f2
add bl, 0x80
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r8d, [r11 + rbx]
add r8b, 0x80
jmp 0x1401013e6
add bl, 0x80
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r8d, [r11 + rbx]
add r8b, 0x80
jmp 0x1401013dd
lea rdx, [rbp + 0x16d61d7]
jmp 0x140101ca4
lea rdx, [rbp + 0x8aab57]
jmp 0x140101ca4
lea rdx, [rbp - 0x29]
xorps xmm0, xmm0
movups xmmword [0x14022e5e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [0x14022e5f0], xmm1
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140101cc0
mov r8, rdi
mov rcx, rsi
call fcn.140004460
lea rcx, [0x14019f470]
call fcn.140198c70
nop
lea rcx, [0x14022e600]
call fcn.140198964
cmp qword [0x14022e5f8], 0xf
cmova rsi, qword [0x14022e5e0]
lea r8, [rbp + 0x27]
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rdx, [0x140228280]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x140228280]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x140101d48
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140101d48
mov al, 1
jmp 0x140101d4a
xor al, al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140198890
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret