Function at 0x18006d280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x480], rbx
mov rax, qword [0x18015c950]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r14, r9
mov rsi, r8
mov r15, rdx
xor edx, edx
mov rcx, r9
call fcn.1800037d0
xor edx, edx
mov rcx, r15
call fcn.1800037d0
xor edx, edx
mov rcx, rsi
call fcn.1800037d0
lea rdx, str.Advapi32.dll
lea rcx, [rbp - 0x18]
call fcn.180002af0
nop
call fcn.180034920
mov rcx, rax
lea rdx, [rbp - 0x18]
call fcn.1800349d0
mov rbx, rax
lea rcx, [rbp - 0x18]
call fcn.180002be0
test rbx, rbx
je 0x18006d634
lea rdx, [0x18010b5e8]
mov rcx, rbx
call qword [0x1800fc1f8]
mov r13, rax
lea rdx, str.RegEnumValueW
mov rcx, rbx
call qword [0x1800fc1f8]
mov rdi, rax
lea rdx, [0x18010b620]
mov rcx, rbx
call qword [0x1800fc1f8]
mov r12, rax
test r13, r13
je 0x18006d634
test rdi, rdi
je 0x18006d634
test rax, rax
je 0x18006d634
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea rdx, str.SOFTWARE_
lea rcx, [rbp - 0x80]
call fcn.180002af0
nop
mov dword [rbp - 0x50], 0x650054
mov dword [rbp - 0x4c], 0x63006e
mov dword [rbp - 0x48], 0x6e0065
mov dword [rbp - 0x44], 0x74
mov dword [rbp - 0x60], 0x510051
mov dword [rbp - 0x5c], 0x430050
mov dword [rbp - 0x58], 0x67004d
mov dword [rbp - 0x54], 0x72
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.180004e80
lea rdx, [0x180108c40]
lea rcx, [rbp - 0x80]
call fcn.180004e80
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.180004e80
mov dword [rbp - 0x30], 0x750053
mov dword [rbp - 0x2c], 0x700070
mov dword [rbp - 0x28], 0x79006c
mov dword [rbp - 0x24], 0x440049
xor r11d, r11d
mov word [rbp - 0x20], r11w
mov dword [rbp - 0x40], 0x650056
mov dword [rbp - 0x3c], 0x730072
mov dword [rbp - 0x38], 0x6f0069
mov dword [rbp - 0x34], 0x6e
mov dword [rbp - 0x18], 0x6e0049
mov dword [rbp - 0x14], 0x740073
mov dword [rbp - 0x10], 0x6c0061
mov dword [rbp - 0xc], 0x54006c
mov dword [rbp - 8], 0x6d0069
mov dword [rbp - 4], 0x65
lea rcx, [rbp - 0x80]
call fcn.180003190
mov rdx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call r13
test eax, eax
jne 0x18006d62b
xor r13d, r13d
mov ebx, r13d
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x74], 0x103
mov dword [rsp + 0x78], 0x103
mov word [rbp + 0x120], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x122]
call fcn.1800b7620
mov byte [rbp + 0x10], bl
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x11]
call fcn.1800b7620
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x74]
lea r8, [rbp + 0x120]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call rdi
test eax, eax
jne 0x18006d61e
nop
mov word [rbp + 0x326], r13w
cmp word [rbp + 0x120], 0
je 0x18006d5c0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x120]
call fcn.18001dfd0
test al, al
je 0x18006d570
cmp dword [rsp + 0x70], 4
jne 0x18006d5c0
mov word [rbp + 0x112], 0
mov edx, dword [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.18001e5e0
nop
mov rdx, rax
mov rcx, r15
call fcn.180004c40
nop
lea rcx, [rsp + 0x48]
call fcn.180002be0
jmp 0x18006d5c0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x120]
call fcn.18001dfb0
test al, al
je 0x18006d590
cmp dword [rsp + 0x70], 1
jne 0x18006d5c0
mov rcx, rsi
jmp 0x18006d5ae
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x120]
call fcn.18001dfb0
test al, al
je 0x18006d5c0
cmp dword [rsp + 0x70], 1
jne 0x18006d5c0
mov rcx, r14
mov word [rbp + 0x112], 0
lea rdx, [rbp + 0x10]
call fcn.180004dd0
mov word [rbp + 0x120], r13w
mov dword [rsp + 0x74], 0x103
mov dword [rsp + 0x78], 0x103
mov dword [rsp + 0x70], r13d
inc ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x74]
lea r8, [rbp + 0x120]
mov edx, ebx
mov rcx, qword [rsp + 0x68]
call rdi
test eax, eax
je 0x18006d510
mov rcx, qword [rsp + 0x68]
call r12
mov qword [rsp + 0x68], r13
lea rcx, [rbp - 0x80]
call fcn.180002be0
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.1800b2920
mov rbx, qword [rsp + 0x480]
add rsp, 0x440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret