Function at 0x180010988
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x180076008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rcx
mov word [rsp + 0x7a], 0x5446
lea rcx, [rsp + 0x70]
mov word [rbp - 0x80], 0x5c
mov r15d, r9d
mov word [rsp + 0x7d], 0x5241
mov r14d, r8d
mov word [rsp + 0x78], 0x4f53
mov rsi, rdx
mov byte [rsp + 0x7f], 0x45
mov byte [rsp + 0x7c], 0x57
call fcn.180011828
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.1800116d4
lea rcx, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
movsxd rbx, eax
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010a4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
mov rdx, qword [rsp + 0x70]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010a6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
test rbx, rbx
jne 0x180010bdb
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x104
call fcn.180018280
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.18000fc80
test eax, eax
jne 0x180010bd0
cmp dword [rsp + 0x48], eax
jbe 0x180010bd0
call fcn.18000f754
mov rcx, rax
test rax, rax
je 0x180010c2c
mov rax, qword [rax]
call qword [rax + 0x18]
mov r8, rdi
lea rdx, [0x18006b5f4]
add rax, 0x18
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.180012134
call fcn.18000f754
mov rcx, rax
test rax, rax
je 0x180010c37
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, [rbp - 0x70]
lea rdx, [0x18006a6ec]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.180012134
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
je 0x180010b93
cmp dword [rbx - 0x10], 0
jl 0x180010b93
mov rcx, rbx
call fcn.18003ba78
test rax, rax
je 0x180010b93
cmp eax, ebx
js 0x180010b93
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010b6b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
mov rdx, qword [rsp + 0x40]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010b8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
mov eax, 1
jmp 0x180010c0b
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010baf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
mov rdx, qword [rsp + 0x40]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010bd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + SHUnlockShared]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x120]
mov r9d, r15d
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov eax, dword [rbp + 0x118]
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov eax, dword [rbp + 0x110]
mov dword [rsp + 0x20], eax
call qword [0x1800a26d8]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.180013480
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.180010394
int3
mov ecx, 0x80004005
call fcn.180010394
int3