Function at 0x14006a280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x420], rbx
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r15, rdx
mov r13, rcx
lea rdx, str.RegOpenKeyExW
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.RegEnumKeyExW
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rsp + 0x58], rax
lea rdx, str.RegCloseKey
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x80], rax
test rbx, rbx
je 0x14006a92a
test rsi, rsi
je 0x14006a92a
test rax, rax
je 0x14006a92a
mov dword [rbp + 0x40], 0x790053
mov dword [rbp + 0x44], 0x740073
mov dword [rbp + 0x48], 0x6d0065
mov dword [rbp + 0x4c], 0x43005c
mov dword [rbp + 0x50], 0x720075
mov dword [rbp + 0x54], 0x650072
mov dword [rbp + 0x58], 0x74006e
mov dword [rbp + 0x5c], 0x6f0043
mov dword [rbp + 0x60], 0x74006e
mov dword [rbp + 0x64], 0x6f0072
mov dword [rbp + 0x68], 0x53006c
mov dword [rbp + 0x6c], 0x740065
mov dword [rbp + 0x70], 0x43005c
mov dword [rbp + 0x74], 0x6e006f
mov dword [rbp + 0x78], 0x720074
mov dword [rbp + 0x7c], 0x6c006f
mov dword [rbp + 0x80], 0x4b005c
mov dword [rbp + 0x84], 0x790065
mov dword [rbp + 0x88], 0x6f0062
mov dword [rbp + 0x8c], 0x720061
mov dword [rbp + 0x90], 0x200064
mov dword [rbp + 0x94], 0x61004c
mov dword [rbp + 0x98], 0x6f0079
mov dword [rbp + 0x9c], 0x740075
mov dword [rbp + 0xa0], 0x73
xor r14d, r14d
mov qword [rbp - 0x68], r14
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, 0xffffffff80000002
call rbx
test eax, eax
jne 0x14006a92a
mov r12d, r14d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xb0]
call fcn.1400a2390
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x60], 0x104
lea r9, [rbp - 0x60]
lea r8, [rbp + 0xb0]
mov rcx, qword [rbp - 0x68]
call rsi
test eax, eax
jne 0x14006a923
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0xb0]
call fcn.1400a95e8
mov ebx, eax
movzx edi, ax
cmp edi, 0x804
jne 0x14006a918
lea rcx, [rbp - 0x50]
call fcn.140042d40
nop
lea rcx, [rbp]
call fcn.140001fec
nop
lea rcx, [rbp + 0x20]
call fcn.140001fec
nop
test ebx, ebx
je 0x14006a8fb
lea r8, [rbp - 0x50]
mov edx, ebx
mov rcx, r13
call fcn.14006afd0
test al, al
je 0x14006a8fb
mov dword [rbp - 8], edi
lea rcx, str.00000000_0000_0000_0000_000000000000
call fcn.140001de4
mov rsi, rax
lea rcx, [rbp]
call fcn.140001ca0
mov rdi, rax
mov r14, qword [rax + 0x18]
cmp rsi, r14
ja 0x14006a525
mov rbx, rax
cmp r14, 8
jb 0x14006a4f5
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
jmp 0x14006a6a1
lea rcx, [rbp]
call fcn.140001f74
cmp rsi, rax
ja 0x14006a954
lea rcx, [rbp]
call fcn.140001f74
mov rbx, rax
lea rcx, [rbp]
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x68], rcx
cmp rcx, rbx
ja 0x14006a58d
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006a58d
lea rax, [rdx + rcx]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006a5b0
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006a5c0
cmp rdx, 0x1000
jb 0x14006a5ea
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006a95a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006a5fb
test rdx, rdx
je 0x14006a5f9
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006a5fb
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x48]
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rbx
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
cmp r14, 8
jb 0x14006a679
mov rcx, qword [rdi]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x14006a66a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006a960
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
jmp 0x14006a6a1
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x48]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
lea rcx, str.00000000_0000_0000_0000_000000000000
call fcn.140001de4
mov rsi, rax
lea rcx, [rbp + 0x20]
call fcn.140001ca0
mov rbx, rax
mov r14, qword [rax + 0x18]
cmp rsi, r14
ja 0x14006a703
mov rdi, rax
cmp r14, 8
jb 0x14006a6d1
mov rdi, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rdi
call fcn.140001ddc
xor r14d, r14d
mov word [rsp + 0x40], r14w
lea rcx, [rdi + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
jmp 0x14006a882
lea rcx, [rbp + 0x20]
call fcn.140001f74
cmp rsi, rax
ja 0x14006a972
lea rcx, [rbp + 0x20]
call fcn.140001f74
mov rdi, rax
lea rcx, [rbp + 0x20]
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x78], rcx
cmp rcx, rdi
ja 0x14006a76b
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp rdx, rax
ja 0x14006a76b
lea rax, [rdx + rcx]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140001d84
mov rdi, qword [rax]
lea rax, [rdi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006a78e
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006a79e
cmp rdx, 0x1000
jb 0x14006a7c8
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006a966
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006a7d9
test rdx, rdx
je 0x14006a7d7
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006a7d9
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x50]
mov r8, rsi
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, rdi
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rdi + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
cmp r14, 8
jb 0x14006a857
mov rcx, qword [rbx]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x14006a848
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006a96c
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x50]
mov qword [rbx], rax
jmp 0x14006a87f
mov rcx, rbx
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
xor r14d, r14d
mov rdx, qword [r15 + 8]
cmp qword [r15 + 0x10], rdx
je 0x14006a8ea
mov ecx, 0x90
call fcn.140001bf0
mov rbx, rax
mov qword [rbp - 0x70], rax
mov ecx, dword [rbp - 0x50]
mov dword [rax], ecx
lea rcx, [rax + 8]
lea rdx, [rbp - 0x48]
call fcn.140002e64
nop
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x28]
call fcn.140002e64
nop
mov eax, dword [rbp - 8]
mov dword [rbx + 0x48], eax
lea rcx, [rbx + 0x50]
lea rdx, [rbp]
call fcn.140002e64
nop
lea rcx, [rbx + 0x70]
lea rdx, [rbp + 0x20]
call fcn.140002e64
nop
add qword [r15 + 8], 0x90
jmp 0x14006a8f6
lea r8, [rbp - 0x50]
mov rcx, r15
call fcn.14006f370
mov rsi, qword [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.140001c70
nop
lea rcx, [rbp]
call fcn.140001c70
nop
lea rcx, [rbp - 0x50]
call fcn.140042d80
inc r12d
mov edx, r12d
jmp 0x14006a42f
mov rcx, qword [rbp - 0x68]
call qword [rbp - 0x80]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.1400a08a0
mov rbx, qword [rsp + 0x420]
add rsp, 0x3d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001f60
nop
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3
call fcn.140001f60
int3