Function at 0x140002774
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140052a10]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rdi, r8
mov rbx, rcx
mov r14, qword [rbp + 0x410]
xor r15d, r15d
cmp edi, 0x3a9d
jne 0x1400028e8
mov dword [rbp + 0x218], 0x6f004c
mov dword [rbp + 0x21c], 0x640070
mov dword [rbp + 0x220], 0x620075
mov dword [rbp + 0x224], 0x360064
mov dword [rbp + 0x228], 0x34
cmp qword [rcx + 0x4d8], r15
jne 0x14000281e
lea rdx, [rbp + 0x218]
call fcn.140007870
mov qword [rbx + 0x4d8], rax
mov rcx, qword [rbx + 0x4d8]
test rcx, rcx
je 0x140003142
movdqa xmm0, xmmword [0x140048aa0]
movdqu xmmword [rbp + 0x1f8], xmm0
mov dword [rbp + 0x208], 0x74497465
mov dword [rbp + 0x20c], 0x6e776f44
mov byte [rbp + 0x210], r15b
lea rdx, [rbp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002887
call rax
test eax, eax
je 0x140002887
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbx + 0x464]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
movdqa xmm0, xmmword [0x140048b00]
movdqu xmmword [rbp + 0x1e0], xmm0
mov dword [rbp + 0x1f0], 0x44744974
mov dword [rbp + 0x1f4], 0x6e776f
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rbx + 0x4d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003142
call rax
test eax, eax
je 0x140003142
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbx + 0x468]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
cmp edi, 0x3aa0
jne 0x140002991
mov dword [rbp + 0x1e0], 0x650051
mov dword [rbp + 0x1e4], 0x6a0065
mov dword [rbp + 0x1e8], 0x640079
mov dword [rbp + 0x1ec], 0x6b0061
mov dword [rbp + 0x1f0], 0x340036
mov word [rbp + 0x1f4], r15w
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
call fcn.140007870
mov qword [rbx + 0x4e0], rax
test rax, rax
je 0x140003142
mov dword [rbp + 0x1d0], 0x65656c53
mov dword [rbp + 0x1d4], 0x6d695470
mov word [rbp + 0x1d8], 0x7265
mov byte [rbp + 0x1da], r15b
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003142
mov ecx, 1
call rax
cmp edi, 0x3aa1
jne 0x140002a27
mov dword [rbp + 0x218], 0x6f004c
mov dword [rbp + 0x21c], 0x640070
mov dword [rbp + 0x220], 0x620075
mov dword [rbp + 0x224], 0x360064
mov dword [rbp + 0x228], 0x34
lea rdx, [rbp + 0x218]
mov rcx, rbx
call fcn.140007870
mov qword [rbx + 0x4d8], rax
test rax, rax
je 0x140003142
mov dword [rbp + 0x1d0], 0x6f6c6e55
mov dword [rbp + 0x1d4], 0x6c536b63
mov dword [rbp + 0x1d8], 0x706565
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003142
call rax
cmp edi, 0x3aa2
jne 0x140003142
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.140008190
nop
movdqa xmm0, xmmword [0x140048bd0]
movdqu xmmword [rbp + 0x218], xmm0
mov word [rbp + 0x228], 0x65
lea rcx, [rbp + 0x218]
call fcn.140022090
mov r8, rax
lea rdx, [rbp + 0x218]
lea rcx, [rbp - 0x78]
call fcn.140009430
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp + 0xc0]
call fcn.1400221f0
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xc0]
call fcn.14000b218
nop
cmp qword [rbp + 0x160], r15
je 0x140002e74
mov qword [rsp + 0x60], 0xf
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x48], r15b
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xc0]
call fcn.14000f984
mov dword [rbp + 0x230], 0x6f0053
mov dword [rbp + 0x234], 0x740066
mov dword [rbp + 0x238], 0x610077
mov dword [rbp + 0x23c], 0x650072
mov dword [rbp + 0x240], 0x5c005c
mov dword [rbp + 0x244], 0x69004d
mov dword [rbp + 0x248], 0x720063
mov dword [rbp + 0x24c], 0x73006f
mov dword [rbp + 0x250], 0x66006f
mov dword [rbp + 0x254], 0x5c0074
mov dword [rbp + 0x258], 0x49005c
mov dword [rbp + 0x25c], 0x74006e
mov dword [rbp + 0x260], 0x720065
mov dword [rbp + 0x264], 0x65006e
mov dword [rbp + 0x268], 0x200074
mov dword [rbp + 0x26c], 0x780045
mov dword [rbp + 0x270], 0x6c0070
mov dword [rbp + 0x274], 0x72006f
mov dword [rbp + 0x278], 0x720065
mov dword [rbp + 0x27c], 0x5c005c
mov dword [rbp + 0x280], 0x650053
mov dword [rbp + 0x284], 0x720061
mov dword [rbp + 0x288], 0x680063
mov dword [rbp + 0x28c], 0x630053
mov dword [rbp + 0x290], 0x70006f
mov dword [rbp + 0x294], 0x730065
mov word [rbp + 0x298], r15w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x230]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002e4c
mov byte [rbp + 0x2a0], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2a1]
call fcn.1400221f0
mov dword [rsp + 0x40], 0x104
mov dword [rbp + 0x1f8], 0x61666544
mov dword [rbp + 0x1fc], 0x53746c75
mov dword [rbp + 0x200], 0x65706f63
mov byte [rbp + 0x204], r15b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140002e41
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r15
mov byte [rsp + 0x68], r15b
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x68]
call fcn.140009528
mov rdi, qword [rsp + 0x58]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
test r8, r8
jne 0x140002cf0
mov eax, r15d
jmp 0x140002cf5
call fcn.140021fb0
movsxd rcx, eax
mov eax, r15d
cmp rsi, rdi
setne al
or edx, 0xffffffff
cmp rsi, rdi
cmovb eax, edx
test rcx, rcx
cmovne eax, ecx
mov dword [rbp + 0x1e0], 0x6f004c
mov dword [rbp + 0x1e4], 0x640070
mov dword [rbp + 0x1e8], 0x620075
mov dword [rbp + 0x1ec], 0x360064
mov dword [rbp + 0x1f0], 0x34
lea rdx, [rbp + 0x1e0]
mov rcx, rbx
test eax, eax
je 0x140002dea
call fcn.140007870
mov qword [rbx + 0x4d8], rax
test rax, rax
je 0x140002e30
mov dword [rbp + 0x1d0], 0x6f6c6e55
mov dword [rbp + 0x1d4], 0x6c536b63
mov dword [rbp + 0x1d8], 0x706565
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002d9e
call rax
cmp qword [rbx + 0x4b0], r15
jne 0x140002db3
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
imul r8d, dword [rbx + 0x4f0], 0xea60
xor r9d, r9d
mov edx, 0x3aa1
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rbx + 0x4b0], rax
mov rdx, qword [rbx + 0x4b8]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x140002e30
call fcn.140007870
mov qword [rbx + 0x4d8], rax
test rax, rax
je 0x140002e30
mov dword [rbp + 0x1d0], 0x6b636f4c
mov dword [rbp + 0x1d4], 0x65656c53
mov word [rbp + 0x1d8], 0x70
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002e30
call rax
nop
cmp qword [rbp - 0x80], 0x10
jb 0x140002e41
mov rcx, qword [rsp + 0x68]
call fcn.140021758
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0xc0]
call fcn.14000b3b4
nop
cmp qword [rsp + 0x60], 0x10
jb 0x14000310b
mov rcx, qword [rsp + 0x48]
call fcn.140021758
jmp 0x14000310b
mov dword [rbp + 0x230], 0x6f0053
mov dword [rbp + 0x234], 0x740066
mov dword [rbp + 0x238], 0x610077
mov dword [rbp + 0x23c], 0x650072
mov dword [rbp + 0x240], 0x5c005c
mov dword [rbp + 0x244], 0x69004d
mov dword [rbp + 0x248], 0x720063
mov dword [rbp + 0x24c], 0x73006f
mov dword [rbp + 0x250], 0x66006f
mov dword [rbp + 0x254], 0x5c0074
mov dword [rbp + 0x258], 0x49005c
mov dword [rbp + 0x25c], 0x74006e
mov dword [rbp + 0x260], 0x720065
mov dword [rbp + 0x264], 0x65006e
mov dword [rbp + 0x268], 0x200074
mov dword [rbp + 0x26c], 0x780045
mov dword [rbp + 0x270], 0x6c0070
mov dword [rbp + 0x274], 0x72006f
mov dword [rbp + 0x278], 0x720065
mov dword [rbp + 0x27c], 0x5c005c
mov dword [rbp + 0x280], 0x650053
mov dword [rbp + 0x284], 0x720061
mov dword [rbp + 0x288], 0x680063
mov dword [rbp + 0x28c], 0x630053
mov dword [rbp + 0x290], 0x70006f
mov dword [rbp + 0x294], 0x730065
mov word [rbp + 0x298], r15w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x230]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000310b
mov byte [rbp + 0x2a0], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2a1]
call fcn.1400221f0
mov dword [rsp + 0x40], 0x104
mov dword [rbp + 0x1f8], 0x61666544
mov dword [rbp + 0x1fc], 0x53746c75
mov dword [rbp + 0x200], 0x65706f63
mov byte [rbp + 0x204], r15b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [rbp + 0x1f8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400030f7
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x50]
call fcn.1400221f0
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call fcn.14000be18
nop
cmp qword [rbp + 0x48], r15
je 0x1400030d8
mov r8d, dword [rsp + 0x40]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp - 0x50]
call fcn.140009c24
lea rdi, [rbp - 0x48]
cmp qword [rbp + 0x48], r15
jne 0x14000307c
mov rbx, r15
jmp 0x14000309c
lea rcx, [rbp - 0x48]
call fcn.14000d3d0
neg al
sbb rbx, rbx
and rbx, rdi
mov rcx, qword [rbp + 0x48]
call fcn.140023d80
test eax, eax
cmovne rbx, r15
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp - 0x48]
call fcn.14000d324
test rbx, rbx
jne 0x1400030d8
mov rax, qword [rbp - 0x50]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx - 0x50]
mov edx, dword [rcx + 0x10]
or edx, 2
mov eax, edx
or eax, 4
cmp qword [rcx + 0x48], r15
cmove edx, eax
xor r8d, r8d
call fcn.1400021d4
nop
lea rcx, [rbp + 0x58]
call fcn.14000bf38
lea rbx, vtable.std::ios_base.0
mov qword [rbp + 0x58], rbx
lea rcx, [rbp + 0x58]
call fcn.140021380
jmp 0x1400030fe
lea rbx, vtable.std::ios_base.0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003112
lea rbx, vtable.std::ios_base.0
lea rcx, [rbp + 0x170]
call fcn.14000b33c
mov qword [rbp + 0x170], rbx
lea rcx, [rbp + 0x170]
call fcn.140021380
nop
cmp qword [rbp - 0x60], 0x10
jb 0x140003142
mov rcx, qword [rbp - 0x78]
call fcn.140021758
mov dword [r14], 1
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140021770
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret