Function at 0x18001dc60
Capabilities:
Encode data using base64
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x180070310]
xor rax, rsp
mov qword [rbp + 0x230], rax
lea eax, [rcx + 0x9b4]
mov qword [rbp - 0x48], rdx
mov r10, rdx
mov qword [rbp - 0x50], r8
xor edx, edx
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x58], edx
mov r13d, ecx
mov ebx, edx
cmp ecx, eax
jae 0x18001e5d8
movzx eax, byte [rsp + 0x50]
lea r14d, [rdx + 0x61]
movzx r12d, byte [rsp + 0x50]
lea r15d, [rdx + 8]
mov ecx, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x60]
mov dword [rsp + 0x54], eax
lea r11, [0x180000000]
movabs r9, 0x7fffffffffffffff
mov edi, 0x65
cmp r13d, 0x352
ja 0x18001de4e
je 0x18001de3c
cmp r13d, 0x12a
ja 0x18001ddcc
je 0x18001ddac
mov eax, r13d
sub eax, 0x2b
je 0x18001dd9c
sub eax, 0x75
je 0x18001dd71
sub eax, 0x15
je 0x18001dd3f
cmp eax, 0x10
je 0x18001e59c
mov eax, dword [rsp + 0x54]
jmp 0x18001e3fe
mov r9d, dword [rbp - 0x80]
mov ecx, dword [r8 + 8]
mov rdx, qword [r8]
and ecx, r9d
mov eax, dword [rsp + 0x54]
shl rdx, cl
mov ecx, r9d
sub ecx, dword [r10]
and ecx, r9d
shr rdx, 1
shr rdx, cl
mov ecx, dword [rsp + 0x5c]
mov qword [rsp + 0x70], rdx
jmp 0x18001e3fe
mov eax, 0x67
mov dword [rbp + 0x20a], 0x740065
mov word [rbp + 0x208], ax
mov eax, 0x53
mov word [rbp + 0x20e], ax
mov eax, dword [rsp + 0x54]
jmp 0x18001e3fe
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x80], 0x3f
jmp 0x18001e3fe
mov dword [rbp + 0x210], 0x6c0065
mov word [rbp + 0x214], di
mov dword [rbp + 0x216], 0x740063
jmp 0x18001e3fe
mov eax, r13d
sub eax, 0x13f
je 0x18001e5d8
sub eax, 0x75
je 0x18001de2b
sub eax, 0x8a
je 0x18001de0e
cmp eax, 0x8a
mov eax, dword [rsp + 0x54]
jne 0x18001e3fe
mov dword [rbp + 0x224], 0x580073
mov dword [rbp + 0x228], 0x6c006d
jmp 0x18001e3fe
mov eax, dword [rsp + 0x54]
mov dword [rbp + 0x21c], 0x6c0062
mov dword [rbp + 0x220], 0x410065
jmp 0x18001e3fe
mov eax, dword [rsp + 0x54]
mov word [rbp + 0x21a], r14w
jmp 0x18001e3fe
mov al, 1
mov word [rbp + 0x22c], dx
mov dword [rsp + 0x54], eax
jmp 0x18001e3fe
cmp r13d, 0x604
ja 0x18001e482
je 0x18001e431
cmp r13d, 0x3dc
je 0x18001e426
cmp r13d, 0x466
je 0x18001e41d
cmp r13d, 0x4f0
je 0x18001deb9
cmp r13d, 0x57a
jne 0x18001e3fe
mov dword [rbp - 0x70], edx
lea rcx, [rbp - 0x10]
xorps xmm0, xmm0
xor edx, edx
mov r8d, 0x200
movups xmmword [rbp - 0x20], xmm0
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
jmp 0x18001e3fe
cmp qword [r8 + 0x10], 0x35
mov dword [rsp + 0x60], 4
jb 0x18001e3fa
mov r15d, edx
nop
cmp r15d, 0xc
ja case.default.0x18001dee8
mov eax, r15d
mov ecx, dword [r11 + rax*4 + 0x1e620]
add rcx, r11
jmp rcx
mov dword [rbp + 0x1fa], 0x65736e6f
mov byte [rbp + 0x1fe], 0
jmp case.default.0x18001dee8
mov byte [rbp + 0x205], 0
jmp case.default.0x18001dee8
mov esi, 0xb
mov byte [rsp + 0x50], 1
cmp qword [r8 + 0x10], rsi
mov r14, r8
mov qword [rbp - 0x28], 0xf
cmovb rsi, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
mov byte [rbp - 0x40], 0
jb 0x18001df38
mov r14, qword [r8]
cmp rsi, 0xf
ja 0x18001df5b
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x40], 0
jmp 0x18001dfef
cmp rsi, r9
ja 0x18001e619
mov rdi, rsi
or rdi, 0xf
cmp rdi, r9
jbe 0x18001df75
mov rdi, r9
jmp 0x18001df82
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001dfbb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001e613
mov rcx, rax
call fcn.180063980
test rax, rax
je 0x18001e5cc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001dfcd
test rcx, rcx
je 0x18001dfca
call fcn.180063980
mov rbx, rax
jmp 0x18001dfcd
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
mov qword [rbp - 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x40], rbx
mov ebx, dword [rsp + 0x58]
or ebx, 1
lea rcx, [0x180070268]
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x58], ebx
call fcn.18001c880
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18001e042
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e03d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e5cc
call fcn.1800639bc
xor edx, edx
jmp case.default.0x18001dee8
cmp dword [rbp - 0x74], 0
mov ecx, edx
movzx eax, byte [rsp + 0x50]
cmove ecx, eax
mov byte [rsp + 0x50], cl
cmp cl, 0
je case.default.0x18001dee8
mov eax, dword [rsp + 0x78]
lea rcx, [rbp + 0x1f0]
mov r8d, dword [rsp + 0x7c]
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegSetUSValueA]
xor edx, edx
jmp case.default.0x18001dee8
mov eax, 0x7073
mov word [rbp + 0x1f8], ax
jmp case.default.0x18001dee8
mov rax, qword [r8 + 0x10]
mov dword [rbp - 0x78], edx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
cmp rax, 0x11
jb 0x18001e60d
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
cmp qword [r8 + 0x18], 0x10
mov rax, r8
jb 0x18001e0dd
mov rax, qword [r8]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18001e104
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi - 0x40], 0
jmp 0x18001e198
cmp rsi, r9
ja 0x18001e619
mov rdi, rsi
or rdi, 0xf
cmp rdi, r9
jbe 0x18001e11e
mov rdi, r9
jmp 0x18001e12b
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001e164
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001e613
mov rcx, rax
call fcn.180063980
test rax, rax
je 0x18001e5cc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001e176
test rcx, rcx
je 0x18001e173
call fcn.180063980
mov rbx, rax
jmp 0x18001e176
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
mov qword [rbp - 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp - 0x40], rbx
mov ebx, dword [rsp + 0x58]
or ebx, 2
lea rdx, [rbp - 0x40]
lea rcx, [0x180070248]
mov dword [rsp + 0x58], ebx
call fcn.18001c880
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x18001e1eb
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e1e6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e5cc
call fcn.1800639bc
xor edx, edx
mov dword [rbp - 0x7c], edx
jmp case.default.0x18001dee8
mov eax, dword [rbp - 0x7c]
lea r8, [rsp + 0x7c]
mov dword [rsp + 0x38], eax
lea rcx, [rbp + 0x1f0]
mov eax, dword [rbp - 0x78]
xor r9d, r9d
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHRegGetUSValueA
mov dword [rbp - 0x74], eax
call qword [sym.imp.dbghelp.dll_ImagehlpApiVersion]
xor edx, edx
jmp case.default.0x18001dee8
mov dword [rsp + 0x78], edx
jmp case.default.0x18001dee8
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x7c], edx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
cmp rax, 0xb
jb 0x18001e60d
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
cmp qword [r8 + 0x18], 0x10
mov rax, r8
jb 0x18001e27c
mov rax, qword [r8]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18001e2ad
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memmove
or ebx, 4
mov byte [rbp + rsi - 0x40], 0
lea rcx, [0x180070288]
jmp 0x18001dff9
cmp rsi, r9
ja 0x18001e619
mov rdi, rsi
or rdi, 0xf
cmp rdi, r9
jbe 0x18001e2c7
mov rdi, r9
jmp 0x18001e2d4
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18001e30d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18001e613
mov rcx, rax
call fcn.180063980
test rax, rax
je 0x18001e5cc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18001e31f
test rcx, rcx
je 0x18001e31c
call fcn.180063980
mov rbx, rax
jmp 0x18001e31f
mov rbx, rdx
mov r8, rsi
mov qword [rbp - 0x30], rsi
mov rdx, r14
mov qword [rbp - 0x28], rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rcx, [0x180070288]
mov qword [rbp - 0x40], rbx
mov ebx, dword [rsp + 0x58]
or ebx, 4
jmp 0x18001dff9
movzx eax, word [0x180069309]
lea rdx, [0x180069350]
mov word [rbp + 0x1f0], ax
lea rcx, [rbp + 0x1f3]
movzx eax, byte [0x18006930b]
mov r8d, 5
mov byte [rbp + 0x1f2], al
mov byte [rbp + 0x1f3], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor edx, edx
jmp case.default.0x18001dee8
mov eax, dword [0x180069371]
mov dword [rbp + 0x1fe], eax
movzx eax, byte [0x180069375]
mov byte [rbp + 0x202], al
mov eax, 0x2928
mov word [rbp + 0x203], ax
jmp case.default.0x18001dee8
mov byte [rbp + 0x1f8], 0
mov r8, qword [rbp - 0x50]
lea r11, [0x180000000]
inc r15d
movabs r9, 0x7fffffffffffffff
lea eax, [r15 + 0x102]
cmp eax, 0x10f
jb 0x18001ded0
mov eax, dword [rsp + 0x54]
mov r14d, 0x61
mov ecx, dword [rsp + 0x5c]
lea r15d, [r14 - 0x59]
mov esi, dword [rsp + 0x60]
add r13d, 0x8a
cmp r13d, ecx
jae 0x18001e5d8
mov r8, qword [rbp - 0x50]
xor edx, edx
mov r10, qword [rbp - 0x48]
jmp 0x18001dcdf
mov dword [rbp - 0x6c], 1
jmp 0x18001e3fe
mov qword [rbp - 0x68], rdx
mov word [rbp - 0x66], r15w
jmp 0x18001e3fe
mov r9d, dword [rbp - 0x70]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x208]
lea rax, [rbp - 0x20]
mov r8d, esi
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
mov edx, dword [rbp - 0x6c]
call qword [sym.imp.ADVAPI32.dll_GetInheritanceSourceW]
mov ecx, dword [rsp + 0x5c]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
jmp 0x18001e3fe
cmp r13d, 0x68e
je 0x18001e588
cmp r13d, 0x718
je 0x18001e4aa
cmp r13d, 0x7a2
je 0x18001e5d8
jmp 0x18001e3fe
test al, al
je 0x18001e57a
mov edi, 0x3d
mov eax, edi
sub eax, 0x3a
je 0x18001e4fc
sub eax, 1
je 0x18001e4e3
sub eax, 1
je 0x18001e4da
cmp eax, 1
jne 0x18001e567
movzx r12d, al
jmp 0x18001e567
mov qword [rbp - 0x60], rdx
jmp 0x18001e567
lea r9, [rbp - 0x60]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
test eax, eax
je 0x18001e565
xor r12b, r12b
jmp 0x18001e565
test r12b, r12b
je 0x18001e553
mov ebx, 0x11a
mov eax, ebx
sub eax, 0x11a
je 0x18001e532
cmp eax, 0x1f
jne 0x18001e543
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x18001e522
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18001e543
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001e543
mov qword [rbp - 0x58], rdx
lea r8, [rbp - 0x58]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
add ebx, 0x1f
mov edx, 0
cmp ebx, 0x158
jb 0x18001e506
mov edx, 0x20
lea rcx, [rbp - 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_FreeInheritedFromArray]
xor edx, edx
dec edi
cmp edi, 0x39
ja 0x18001e4b7
mov ebx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x5c]
mov byte [rsp + 0x70], 0
jmp 0x18001e3fe
cmp dword [rsp + 0x68], 0
movzx eax, al
cmovne eax, edx
mov dword [rsp + 0x54], eax
jmp 0x18001e3fe
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x30], rax
mov r9, r8
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdx
xor ecx, ecx
xor edx, edx
call fcn.180040cb0
mov dword [rsp + 0x70], eax
jmp 0x18001e5d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov byte [rsp + 0x70], 1
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.1800643d0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800616c0
int3
call fcn.180061540
int3
call fcn.180061680
int3