Function at 0x140085874
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov qword [rbp + 0x10], 0xfffffffffffffffe
xor r14d, r14d
test cl, cl
je 0x140085a67
call fcn.140010fb4
mov rcx, rax
test rax, rax
jne 0x1400858b5
mov ecx, 0x80004005
call fcn.140010d40
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 8], rbx
mov esi, 1
mov dword [rbp + 0x178], esi
mov edi, 0x104
mov dword [rbp + 0x170], edi
mov dword [rsp + 0x6a], 0x6e616d6d
mov word [rsp + 0x61], 0x5c6c
mov dword [rsp + 0x64], 0x5c6e6570
mov word [rsp + 0x6e], 0x64
mov dword [rsp + 0x58], 0x70747468
mov dword [rsp + 0x5d], 0x6c656873
mov word [rsp + 0x68], 0x6f63
mov byte [rsp + 0x63], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x5c], 0x5c
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140085935
mov edx, edi
lea rcx, [rbp - 8]
call fcn.140010c2c
mov rbx, qword [rbp - 8]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x178]
lea r8, [0x1400bcee3]
lea rdx, [rsp + 0x58]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400606d8
test eax, eax
js 0x140085a5c
cmp eax, dword [rbx - 0xc]
jg 0x140085a5c
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r14b
lea rcx, [rbp - 8]
call fcn.1400085c8
mov dword [rsp + 0x30], 0x45524946
mov byte [rsp + 0x34], r14b
mov rbx, qword [rbp - 8]
cmp dword [rbx - 0x10], r14d
jl 0x1400859c9
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x1400859c9
cmp eax, ebx
js 0x1400859c9
mov esi, 2
jmp 0x140085a2c
mov dword [rsp + 0x42], 0x454d4f52
mov byte [rsp + 0x46], r14b
mov word [rsp + 0x40], 0x4843
cmp dword [rbx - 0x10], r14d
jl 0x1400859f9
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x1400859f9
cmp eax, ebx
jns 0x140085a2c
mov word [rbp + 0x161], 0x45
mov byte [rbp + 0x160], Ordinal_79
cmp dword [rbx - 0x10], r14d
jl 0x140085a50
lea rdx, [rbp + 0x160]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x140085a50
cmp eax, ebx
js 0x140085a50
mov esi, 3
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140085a49
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, esi
jmp 0x140085e0c
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
jmp 0x140085de7
mov ecx, 0x80070057
call fcn.140010d40
nop
call fcn.140010fb4
mov rcx, rax
test rax, rax
jne 0x140085a7f
mov ecx, 0x80004005
call fcn.140010d40
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x10], rbx
mov esi, 1
mov dword [rbp + 4], esi
mov edi, 0x104
mov dword [rbp], edi
mov dword [rbp - 0x1a], 0x6f684372
mov dword [rbp - 0x4e], 0x6e69575c
mov word [rbp - 0x53], 0x736f
mov word [rbp - 0x31], 0x6c72
mov word [rbp - 0x42], 0x6c6c
mov word [rbp - 0x60], 0x6f53
mov word [rbp - 0x56], 0x6369
mov dword [rbp - 0x4a], 0x73776f64
mov dword [rbp - 0x5d], 0x72617774
mov dword [rbp - 0x36], 0x5c736e6f
mov word [rbp - 0x3e], 0x7373
mov word [rbp - 0x45], 0x6853
mov dword [rbp - 0x16], 0x656369
mov dword [rbp - 0x2f], 0x6f737341
mov dword [rbp - 0x22], 0x70747468
mov dword [rbp - 0x2b], 0x74616963
mov dword [rbp - 0x27], 0x736e6f69
mov word [rbp - 0x3b], 0x6963
mov byte [rbp - 0x54], WSACleanup
mov word [rbp - 0x51], 0x666f
mov word [rbp - 0x38], 0x6974
mov word [rbp - 0x40], 0x415c
mov word [rbp - 0x59], 0x5c65
mov dword [rbp - 0x1e], 0x6573555c
mov byte [rbp - 0x4f], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x3c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x46], 0x5c
mov byte [rbp - 0x32], 0x55
mov byte [rbp - 0x43], 0x65
mov byte [rbp - 0x5e], 0x66
mov byte [rbp - 0x23], 0x5c
mov byte [rbp - 0x39], 0x61
mov byte [rbp - 0x57], Ordinal_79
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14004e050
lea rcx, [rbp + 0x20]
call fcn.14008a89c
call fcn.140010fb4
mov rcx, rax
test rax, rax
jne 0x140085b89
mov ecx, 0x80004005
call fcn.140010d40
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp + 8], rax
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x20]
lea rdx, [0x1400bd11c]
lea rcx, [rbp + 8]
call fcn.14000da78
mov word [rsp + 0x4b], 0x6967
mov word [rsp + 0x48], 0x7250
mov word [rsp + 0x4d], 0x64
mov byte [rsp + 0x4a], reloc.WS2_32.dll_WSAGetLastError
mov ecx, esi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140085be6
mov edx, edi
lea rcx, [rbp - 0x10]
call fcn.140010c2c
mov rbx, qword [rbp - 0x10]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 4]
lea r8, [rsp + 0x48]
mov rdi, qword [rbp + 8]
mov rdx, rdi
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400606d8
test eax, eax
js 0x140085e01
cmp eax, dword [rbx - 0xc]
jg 0x140085e01
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r14b
lea rcx, [rbp - 0x10]
call fcn.1400085c8
mov word [rsp + 0x38], 0x4946
mov word [rsp + 0x3b], 0x45
mov byte [rsp + 0x3a], 0x52
mov rbx, qword [rbp - 0x10]
cmp dword [rbx - 0x10], r14d
jl 0x140085c7d
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x140085c7d
cmp eax, ebx
js 0x140085c7d
mov esi, 2
jmp 0x140085d7b
mov word [rsp + 0x55], 0x45
mov dword [rsp + 0x50], 0x4f524843
mov byte [rsp + 0x54], Ordinal_79
cmp dword [rbx - 0x10], r14d
jl 0x140085cb1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x140085cb1
cmp eax, ebx
jns 0x140085d7b
mov word [rbp + 0x169], 0x45
mov byte [rbp + 0x168], Ordinal_79
cmp dword [rbx - 0x10], r14d
jl 0x140085ce9
lea rdx, [rbp + 0x168]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x140085ce9
cmp eax, ebx
js 0x140085ce9
mov esi, 3
jmp 0x140085d7b
mov word [rbp - 0x7b], 0x4630
mov dword [rbp - 0x75], 0x50414550
mov word [rbp - 0x6e], 0x5638
mov word [rsp + 0x7a], 0x454d
mov word [rsp + 0x70], 0x5041
mov word [rbp - 0x78], 0x4151
mov word [rbp - 0x7e], 0x334e
mov dword [rsp + 0x75], 0x56454630
mov dword [rsp + 0x7d], 0x36535950
mov byte [rbp - 0x76], gethostname
mov byte [rbp - 0x79], 0x42
mov word [rsp + 0x73], 0x5158
mov word [rbp - 0x71], 0x4b59
mov byte [rbp - 0x7c], 0x45
mov byte [rsp + 0x79], 0x5a
mov byte [rsp + 0x7c], reloc.WLDAP32.dll_Ordinal_50
mov byte [rbp - 0x6f], 0x52
mov byte [rbp - 0x6c], r14b
mov byte [rbp - 0x7f], reloc.WLDAP32.dll_Ordinal_50
mov byte [rsp + 0x72], 0x50
cmp dword [rbx - 0x10], r14d
jl 0x140085dc1
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140060390
test rax, rax
je 0x140085dc1
cmp eax, ebx
js 0x140085dc1
mov esi, 4
lea rdx, [rdi - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140085d99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x140085a49
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
jmp 0x140085a49
lea rdx, [rdi - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140085ddf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140085dfd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x140085e0c
mov ecx, 0x80070057
call fcn.140010d40
nop
add rsp, 0x230
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret