Function at 0x14006a980
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x150], rbx
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rdx
mov rdi, rcx
lea rdx, str.RegOpenKeyExW
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x40], rax
lea rdx, str.RegEnumKeyExW
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rsi, rsi
je 0x14006af80
test rbx, rbx
je 0x14006af80
test rax, rax
je 0x14006af80
xor sil, sil
mov rcx, rdi
call fcn.14006d560
mov r12d, eax
mov eax, 0x804
test r12d, r12d
cmove r12d, eax
movzx ecx, r12w
mov dword [r15 + 0x48], ecx
call fcn.14006d930
test al, al
je 0x14006ab9b
mov dword [rbp - 0x39], 0x6f0053
mov dword [rbp - 0x35], 0x740066
mov dword [rbp - 0x31], 0x610077
mov dword [rbp - 0x2d], 0x650072
mov dword [rbp - 0x29], 0x4d005c
mov dword [rbp - 0x25], 0x630069
mov dword [rbp - 0x21], 0x6f0072
mov dword [rbp - 0x1d], 0x6f0073
mov dword [rbp - 0x19], 0x740066
mov dword [rbp - 0x15], 0x43005c
mov dword [rbp - 0x11], 0x460054
mov dword [rbp - 0xd], 0x41005c
mov dword [rbp - 9], 0x730073
mov dword [rbp - 5], 0x6d0065
mov dword [rbp - 1], 0x6c0062
mov dword [rbp + 3], 0x650069
mov dword [rbp + 7], 0x73
xor r14d, r14d
lea rcx, [rbp - 0x59]
call fcn.140001fec
nop
lea rax, str.34745C63_B2F0_4784_8B67_5E12C8701A31
mov qword [rsp + 0x20], rax
mov r9d, dword [r15 + 0x48]
lea r8, [rbp - 0x39]
lea rdx, str._s0x_08x_s
lea rcx, [rbp - 0x59]
call fcn.1400069c0
mov qword [rbp - 0x61], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x38], r14
lea rcx, [rbp - 0x59]
call fcn.140001c60
mov rbx, rax
mov edx, 0x20019
lea rcx, [rsp + 0x38]
call fcn.14008aaf0
mov rcx, rax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
call qword [rsp + 0x40]
test eax, eax
jne 0x14006ab76
lea rdx, str.Default
lea rcx, [rsp + 0x58]
call fcn.140001c78
nop
mov rdx, qword [rbp - 0x61]
test rdx, rdx
je 0x14006ab62
mov r9, r15
lea r8, [rsp + 0x58]
mov rcx, rdi
call fcn.14006e470
nop
lea rcx, [rsp + 0x58]
call fcn.140001c70
mov rcx, qword [rbp - 0x61]
call r13
mov sil, 1
cmp qword [rsp + 0x38], 0
je 0x14006ab89
lea rcx, [rsp + 0x38]
call fcn.14008ac30
nop
lea rcx, [rbp - 0x59]
call fcn.140001c70
movzx eax, sil
jmp 0x14006af82
lea rcx, str.00000000_0000_0000_0000_000000000000
call fcn.140001de4
mov rsi, rax
lea rcx, [r15 + 0x50]
call fcn.140001ca0
mov rdi, rax
mov r13, qword [rax + 0x18]
cmp rsi, r13
ja 0x14006abfd
mov rbx, rax
cmp r13, 8
jb 0x14006abcb
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
xor r14d, r14d
mov word [rsp + 0x30], r14w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x14006ad78
lea rcx, [r15 + 0x50]
call fcn.140001f74
cmp rsi, rax
ja 0x14006afaf
lea rcx, [r15 + 0x50]
call fcn.140001f74
mov rbx, rax
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x38], rcx
cmp rcx, rax
ja 0x14006ac65
lea rcx, [r15 + 0x50]
call fcn.140001ca0
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006ac65
lea rax, [rcx + rdx]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
xor r14d, r14d
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006ac8b
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006ac9b
cmp rdx, 0x1000
jb 0x14006acc5
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006afb5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006acd7
test rdx, rdx
je 0x14006acd4
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006acd7
mov rax, r14
mov qword [rbp - 0x61], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rbp - 0x61]
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r14w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
cmp r13, 8
jb 0x14006ad51
lea rdx, [r13*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14006ad43
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006afbb
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rbp - 0x61]
mov qword [rdi], rax
jmp 0x14006ad78
lea rcx, [rbp - 0x61]
call fcn.140001ca0
mov rbx, rax
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rcx, qword [rbx]
mov qword [rax], rcx
lea rcx, str.00000000_0000_0000_0000_000000000000
call fcn.140001de4
mov rsi, rax
lea rcx, [r15 + 0x70]
call fcn.140001ca0
mov rdi, rax
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
cmp rsi, rax
ja 0x14006addc
mov rbx, rdi
cmp rax, 8
jb 0x14006adad
mov rbx, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r14w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x14006af59
lea rcx, [r15 + 0x70]
call fcn.140001f74
cmp rsi, rax
ja 0x14006afc1
lea rcx, [r15 + 0x70]
call fcn.140001f74
mov rbx, rax
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x38], rcx
cmp rcx, rax
ja 0x14006ae44
lea rcx, [r15 + 0x70]
call fcn.140001ca0
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006ae44
lea rax, [rcx + rdx]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006ae67
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006ae77
cmp rdx, 0x1000
jb 0x14006aea1
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006afc7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006aeb3
test rdx, rdx
je 0x14006aeb0
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006aeb3
mov rax, r14
mov qword [rbp - 0x61], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rbp - 0x61]
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r14w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14006af32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14006af24
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006afa9
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rbp - 0x61]
mov qword [rdi], rax
jmp 0x14006af59
lea rcx, [rbp - 0x61]
call fcn.140001ca0
mov rbx, rax
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rcx, qword [rbx]
mov qword [rax], rcx
mov eax, dword [r15 + 0x48]
cmp r12d, eax
jne 0x14006af74
imul eax, eax, 0x10001
mov dword [r15], eax
mov sil, 1
movzx eax, sil
jmp 0x14006af82
mov dword [r15], r12d
mov sil, 1
movzx eax, sil
jmp 0x14006af82
xor al, al
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400a08a0
mov rbx, qword [rsp + 0x150]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a4d80
int3
call fcn.140001f60
int3
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3
call fcn.140001f60
int3
call fcn.1400a4d80
int3