Function at 0x14008e36c
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rdi, rdx
xor r12d, r12d
mov dword [rbp - 0x21], r12d
mov dword [rbp - 0x5c], 0x6e657272
mov word [rbp - 0x74], 0x5241
mov dword [rbp - 0x4a], 0x6c6c6174
mov word [rbp - 0x4c], 0x736e
mov dword [rbp - 0x64], 0x776f646e
mov word [rbp - 0x6b], 0x6f73
mov dword [rbp - 0x60], 0x75435c73
mov word [rbp - 0x71], 0x4d5c
mov dword [rbp - 0x79], 0x54464f53
mov dword [rbp - 0x53], 0x5c6e6f69
mov word [rbp - 0x4f], 0x6e55
mov word [rbp - 0x6e], 0x7263
mov word [rbp - 0x58], 0x5674
mov word [rbp - 0x66], 0x6957
mov byte [rbp - 0x72], 0x45
mov byte [rbp - 0x4d], 0x69
mov word [rbp - 0x55], 0x7372
mov byte [rbp - 0x6f], 0x69
mov word [rbp - 0x69], 0x7466
mov byte [rbp - 0x46], r12b
mov byte [rbp - 0x67], 0x5c
mov byte [rbp - 0x6c], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x56], 0x65
mov byte [rbp - 0x75], 0x57
mov word [rbp - 0x7e], 0x6974
mov word [rbp - 0x7b], WSASetLastError
mov dword [rsp + 0x30], 0x74736e49
mov dword [rsp + 0x34], 0x4c6c6c61
mov word [rbp - 0x80], 0x6163
mov byte [rsp + 0x38], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x7c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x11], 0x200
mov dword [rbp - 0xd], 0x100
call fcn.140010fb4
mov rcx, rax
test rax, rax
jne 0x14008e477
mov ecx, 0x80004005
call fcn.140010d40
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rdi], rax
mov dword [rbp - 0x21], 1
mov rsi, r12
or r13d, 0xffffffff
mov qword [rbp - 0x19], r12
mov r9d, dword [rbp + rsi*4 - 0x11]
or r9d, 0x20019
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x79]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14d, eax
call fcn.140010fb4
test rax, rax
je 0x14008e9b3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x41], rbx
mov r15d, r12d
lea rdx, str.Mozilla_Firefox
lea rcx, [rbp - 0x31]
call fcn.1400109fc
nop
test r14d, r14d
jne 0x14008e65e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov r14d, 0x104
sub eax, r14d
or eax, ecx
jge 0x14008e526
mov edx, r14d
lea rcx, [rbp - 0x41]
call fcn.140010c2c
mov rbx, qword [rbp - 0x41]
mov r9d, r14d
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov r14d, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400606d8
test eax, eax
js 0x14008e6cc
cmp eax, dword [rbx - 0xc]
jg 0x14008e6cc
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test r14d, r14d
jne 0x14008e65e
mov rax, qword [rbp - 0x31]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x41]
call fcn.140008220
mov rdx, qword [rbp - 0x31]
test rdx, rdx
je 0x14008e6c1
mov rcx, qword [rax]
call fcn.140060af8
test eax, eax
sete bl
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e5c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x14008e5cd
mov rbx, qword [rbp - 0x41]
jmp 0x14008e4fe
mov dword [rbp + 0x77], 1
mov edx, 0x104
mov dword [rbp + 0x67], edx
mov rax, qword [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x14008e5f8
mov rcx, rdi
call fcn.140010c2c
mov rax, qword [rdi]
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rsp + 0x30]
mov rbx, qword [rbp - 0x41]
mov rdx, rbx
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov r14d, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14008e633
mov eax, r12d
jmp 0x14008e640
movsxd rdx, dword [rcx - 0xc]
call fcn.1400606d8
test eax, eax
js 0x14008e6b6
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14008e6b6
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test r14d, r14d
jne 0x14008e4fe
mov rax, qword [rdi]
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x14008e6d7
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e688
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e6a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, 2
jge 0x14008e70d
jmp 0x14008e492
mov ecx, 0x80070057
call fcn.140010d40
int3
mov ecx, 0x80004005
call fcn.140010d40
int3
mov ecx, 0x80070057
call fcn.140010d40
nop
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e6ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e70d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, r12
mov qword [rbp - 9], r12
mov r9d, dword [rbp + rsi*4 - 0x11]
or r9d, 0x20019
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x79]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14d, eax
call fcn.140010fb4
test rax, rax
je 0x14008e9a8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
mov r15d, r12d
lea rdx, str.Mozilla_Firefox
lea rcx, [rbp - 0x29]
call fcn.1400109fc
nop
test r14d, r14d
jne 0x14008e8dc
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov r14d, 0x104
sub eax, r14d
or eax, ecx
jge 0x14008e7a4
mov edx, r14d
lea rcx, [rbp - 0x39]
call fcn.140010c2c
mov rbx, qword [rbp - 0x39]
mov r9d, r14d
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov r14d, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400606d8
test eax, eax
js 0x14008e94a
cmp eax, dword [rbx - 0xc]
jg 0x14008e94a
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test r14d, r14d
jne 0x14008e8dc
mov rax, qword [rbp - 0x29]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.140008220
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x14008e93f
mov rcx, qword [rax]
call fcn.140060af8
test eax, eax
sete bl
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e83e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x14008e84b
mov rbx, qword [rbp - 0x39]
jmp 0x14008e77c
mov dword [rbp - 0x1d], 1
mov edx, 0x104
mov dword [rbp + 0x7f], edx
mov rax, qword [rdi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, ecx
jge 0x14008e876
mov rcx, rdi
call fcn.140010c2c
mov rax, qword [rdi]
lea rcx, [rbp + 0x7f]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x1d]
lea r8, [rsp + 0x30]
mov rbx, qword [rbp - 0x39]
mov rdx, rbx
mov rcx, qword [rbp - 9]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov r14d, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14008e8b1
mov eax, r12d
jmp 0x14008e8be
movsxd rdx, dword [rcx - 0xc]
call fcn.1400606d8
test eax, eax
js 0x14008e934
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14008e934
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test r14d, r14d
jne 0x14008e77c
mov rax, qword [rdi]
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x14008e955
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e906
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e926
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, 2
jge 0x14008e98b
jmp 0x14008e710
mov ecx, 0x80070057
call fcn.140010d40
int3
mov ecx, 0x80004005
call fcn.140010d40
int3
mov ecx, 0x80070057
call fcn.140010d40
nop
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e96b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14008e98b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
cmp dword [rax - 0x10], r12d
je 0x14008e9a3
lea rdx, str._firefox.exe
mov rcx, rdi
call fcn.140010514
mov rax, rdi
jmp 0x14008e9be
mov ecx, 0x80004005
call fcn.140010d40
int3
mov ecx, 0x80004005
call fcn.140010d40
nop
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret