Function at 0x18002e7c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xed0]
sub rsp, 0xfd0
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1028], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0xec0], rax
mov r12d, r8d
mov r14, rdx
mov r13, rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp + 0x18], 7
xor edi, edi
mov qword [rbp + 0x10], rdi
mov word [rbp], di
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rdi
mov word [rbp - 0x20], di
mov r15d, edi
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xcc0]
call fcn.180037440
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0xac0]
call fcn.180037440
mov dword [rbp - 0x28], 0xff
mov dword [rbp - 0x30], 0xff
mov dword [rbp - 0x2c], 7
cmp qword [r14 + 0x18], 8
jb 0x18002e877
mov rsi, qword [r14]
jmp 0x18002e87a
mov rsi, r14
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0xa50], 0x1090160
mov dword [rbp + 0xa54], 0x10a017a
mov dword [rbp + 0xa58], 0x1070166
mov dword [rbp + 0xa5c], 0x130017e
mov dword [rbp + 0xa60], 0x13c0151
mov dword [rbp + 0xa64], 0x1590159
mov r8d, reloc.WS2_32.dll_inet_addr
mov ecx, r8d
nop word [rax + rax]
movzx eax, word [rbp + rcx*2 + 0xa4e]
xor word [rbp + rcx*2 + 0xa50], ax
dec rcx
test rcx, rcx
jg 0x18002e8f0
mov eax, 0x124
xor word [rbp + 0xa50], ax
mov dword [rbp + 0xa80], 0x3073301a
mov dword [rbp + 0xa84], 0x30703000
mov dword [rbp + 0xa88], 0x307d301c
mov dword [rbp + 0xa8c], 0x30523004
mov dword [rbp + 0xa90], 0x30453037
mov dword [rbp + 0xa94], 0x305f3036
mov dword [rbp + 0xa98], 0x305e3030
mov r10d, 0x305e
mov word [rbp + 0xa9c], r10w
mov r9d, recv
lea rdx, [rbp + 0xa9a]
nop word [rax + rax]
movzx ecx, word [rdx]
xor word [rdx + 2], cx
movzx eax, word [rdx - 2]
xor ax, cx
mov word [rdx], ax
sub r9, 2
lea rdx, [rdx - 4]
test r9, r9
jg 0x18002e980
xor word [rbp + 0xa80], r10w
mov dword [rbp + 0xab0], WSAStartup
mov dword [rbp + 0xaac], 0x650068
mov dword [rbp + 0xaa8], 0x730069
mov dword [rbp + 0xaa4], 0x6c0062
mov dword [rbp + 0xaa0], 0x750050
mov dword [rbp + 0xa68], 0x493b4955
mov dword [rbp + 0xa6c], 0x493c4948
mov dword [rbp + 0xa70], 0x4931495d
mov dword [rbp + 0xa74], 0x4919495d
mov dword [rbp + 0xa78], 0x490c4978
mov dword [rbp + 0xa7c], 0x49694969
movzx eax, word [rbp + r8*2 + 0xa66]
xor word [rbp + r8*2 + 0xa68], ax
dec r8
test r8, r8
jg 0x18002ea14
mov eax, 0x491c
xor word [rbp + 0xa68], ax
test ebx, ebx
jne 0x18002f294
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x28]
lea r8, [rbp + 0xcc0]
xor edx, edx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movabs rdi, 0x7fffffffffffffff
cmp eax, 0x103
je 0x18002f11c
inc r15d
cmp word [rbp + 0xcc0], 0
jne 0x18002ea96
mov r8, rbx
jmp 0x18002eaac
lea rax, [rbp + 0xcc0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18002eaa1
lea rdx, [rbp + 0xcc0]
lea rcx, [rbp]
call fcn.180005ff0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x20]
call fcn.180037440
mov word [rbp + 0x228], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x22a]
call fcn.180037440
mov word [rbp + 0x430], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x432]
call fcn.180037440
mov word [rbp + 0x638], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x63a]
call fcn.180037440
mov word [rbp + 0x844], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x846]
call fcn.180037440
cmp qword [rbp + 0x10], 0
jbe 0x18002f055
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rsi], 0
jne 0x18002eb62
mov r8, rbx
jmp 0x18002eb7b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x18002eb70
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.180005ff0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.18002f440
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.18002f490
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x18002ec2f
mov rcx, qword [rbp - 8]
cmp rcx, 8
jb 0x18002ec10
lea rax, [rcx + 1]
mov rcx, qword [rbp - 0x20]
cmp rax, rdi
ja 0x18002f09e
add rax, rax
cmp rax, 0x1000
jb 0x18002ec0b
test cl, 0x1f
jne 0x18002f098
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002f092
sub rcx, rax
cmp rcx, 8
jb 0x18002f08c
cmp rcx, 0x27
ja 0x18002f086
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 8], 7
xor eax, eax
mov qword [rbp - 0x10], rax
mov word [rbp - 0x20], ax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.18000c100
nop
mov rax, qword [rsp + 0x78]
cmp rax, 8
jb 0x18002ec8b
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, rdi
ja 0x18002f0bc
add rax, rax
cmp rax, 0x1000
jb 0x18002ec86
test cl, 0x1f
jne 0x18002f0b6
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002f0b0
sub rcx, rax
cmp rcx, 8
jb 0x18002f0aa
cmp rcx, 0x27
ja 0x18002f0a4
mov rcx, rax
call fcn.180033ed0
mov qword [rsp + 0x78], 7
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov word [rsp + 0x60], bx
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x18002ecfa
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, rdi
ja 0x18002f0da
add rax, rax
cmp rax, 0x1000
jb 0x18002ecf5
test cl, 0x1f
jne 0x18002f0d4
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002f0ce
sub rcx, rax
cmp rcx, 8
jb 0x18002f0c8
cmp rcx, 0x27
ja 0x18002f0c2
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rbx
mov word [rbp - 0x80], bx
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x18002ed66
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, rdi
ja 0x18002f0f8
add rax, rax
cmp rax, 0x1000
jb 0x18002ed61
test cl, 0x1f
jne 0x18002f0f2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002f0ec
sub rcx, rax
cmp rcx, 8
jb 0x18002f0e6
cmp rcx, 0x27
ja 0x18002f0e0
mov rcx, rax
call fcn.180033ed0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18002f03a
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xac0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, [rbp + 0xa50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp + 0x228]
call fcn.18003c120
mov dword [rbp - 0x30], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0xac0]
call fcn.180037440
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xac0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, [rbp + 0xa80]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp + 0x844]
call fcn.18003c120
mov dword [rbp - 0x30], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0xac0]
call fcn.180037440
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xac0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, [rbp + 0xaa0]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp + 0x430]
call fcn.18003c120
mov dword [rbp - 0x30], 0xff
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xac0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2c]
xor r8d, r8d
lea rdx, [rbp + 0xa68]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp + 0x638]
call fcn.18003c120
mov dword [rbp - 0x30], 0xff
lea rax, [rbp + 0x228]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18002ef00
test r8, r8
je 0x18002f03a
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rbp + 0x228], 0
cmove r8, rbx
lea rdx, [rbp + 0x228]
lea rcx, [rsp + 0x40]
call fcn.180005ff0
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x58]
mov rcx, r13
call fcn.18002f780
mov rdx, qword [rbp - 0x58]
add rdx, 0x40
lea rax, [rbp + 0x20]
mov ecx, socket
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x18002ef70
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov rcx, qword [rax + 0x20]
mov qword [rdx + 0x20], rcx
mov ecx, dword [rax + 0x28]
mov dword [rdx + 0x28], ecx
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x18002f03a
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, rdi
ja 0x18002f116
add rax, rax
cmp rax, 0x1000
jb 0x18002f035
test cl, 0x1f
jne 0x18002f110
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18002f10a
sub rcx, rax
cmp rcx, 8
jb 0x18002f104
cmp rcx, 0x27
ja 0x18002f0fe
mov rcx, rax
call fcn.180033ed0
mov dword [rbp - 0x28], 0xff
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp + 0xcc0]
call fcn.180037440
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x28]
lea r8, [rbp + 0xcc0]
mov edx, r15d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x18002ea79
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
nop
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x18002f18c
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, rdi
jbe 0x18002f143
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f187
test byte [rbp - 0x20], 0x1f
je 0x18002f15a
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f169
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f178
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f184
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rbx
mov word [rbp - 0x20], bx
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x18002f201
inc rax
mov rcx, qword [rbp]
cmp rax, rdi
jbe 0x18002f1b8
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f1fc
test byte [rbp], 0x1f
je 0x18002f1cf
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f1de
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f1ed
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f1f9
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rbx
mov word [rbp], bx
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x18002f274
inc rax
mov rcx, qword [r14]
cmp rax, rdi
jbe 0x18002f22c
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f26f
test cl, 0x1f
je 0x18002f242
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f251
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f260
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f26c
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
cmp qword [r14 + 0x18], 8
jb 0x18002f28a
mov r14, qword [r14]
mov eax, 1
jmp 0x18002f405
movabs rdi, 0x7fffffffffffffff
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x18002f303
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, rdi
jbe 0x18002f2ba
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f2fe
test byte [rbp - 0x20], 0x1f
je 0x18002f2d1
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f2e0
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f2ef
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f2fb
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp - 8], 7
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov word [rbp - 0x20], bx
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x18002f37a
inc rax
mov rcx, qword [rbp]
cmp rax, rdi
jbe 0x18002f331
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f375
test byte [rbp], 0x1f
je 0x18002f348
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f357
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f366
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f372
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], rbx
mov word [rbp], bx
mov rax, qword [r14 + 0x18]
cmp rax, 8
jb 0x18002f3ed
inc rax
mov rcx, qword [r14]
cmp rax, rdi
jbe 0x18002f3a5
call fcn.18003835c
int3
add rax, rax
cmp rax, 0x1000
jb 0x18002f3e8
test cl, 0x1f
je 0x18002f3bb
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002f3ca
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002f3d9
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002f3e5
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rbx
cmp qword [r14 + 0x18], 8
jb 0x18002f403
mov r14, qword [r14]
xor eax, eax
mov word [r14], bx
mov rcx, qword [rbp + 0xec0]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x1028]
add rsp, 0xfd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret