Function at 0x140002024
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3010]
mov eax, 0x3110
call fcn.140134690
sub rsp, rax
mov r13b, r8b
mov bl, dl
mov r15, rcx
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x2010]
call fcn.140137f50
mov r12, 0xffffffff80000002
test r13b, r13b
je 0x140002084
mov r12, 0xffffffff80000003
lea rcx, [rbp + 0x2010]
call fcn.140001db4
mov edi, 0x69
mov dword [rbp - 0x46], 0x690073
mov dword [rbp - 0x6e], 0x5c0074
lea esi, [rdi - 0xd]
mov dword [rbp - 0x50], 0x74006e
lea r9d, [rdi + 3]
mov dword [rbp - 0x2c], r9d
mov dword [rbp - 0x76], 0x73006f
mov dword [rbp - 0x66], 0x64006e
mov dword [rsp + 0x72], 0x46004f
mov dword [rbp - 0x36], 0x73006e
mov dword [rbp - 0x5e], 0x5c0073
mov dword [rbp - 0x7c], 0x630069
mov dword [rbp - 0x3c], 0x6e0055
mov dword [rbp - 0x62], 0x77006f
mov dword [rsp + 0x78], 0x410057
mov dword [rbp - 0x32], 0x610074
lea eax, [rdi - 0x16]
mov word [rsp + 0x70], ax
mov dword [rbp - 0x6a], 0x690057
mov dword [rbp - 0x54], 0x650072
mov dword [rbp - 0x5a], 0x750043
mov dword [rbp - 0x80], 0x4d005c
mov dword [rbp - 0x42], 0x6e006f
lea ecx, [rdi + 9]
mov word [rbp - 0x56], cx
lea eax, [rdi - 0x15]
mov word [rsp + 0x76], ax
mov word [rbp - 0x2e], r9w
mov dword [rbp - 0x4c], 0x650056
mov word [rbp - 0x78], cx
mov dword [rsp + 0x7c], 0x450052
mov word [rbp - 0x48], cx
mov word [rbp - 0x38], di
mov dword [rbp - 0x72], 0x66006f
mov word [rbp - 0x3e], si
mov edi, 0x1000
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x1010]
call fcn.140137f50
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x10]
call fcn.140137f50
mov dword [rbp + 0x3060], 0x800
neg bl
sbb ebx, ebx
and ebx, 0xfffffe00
add ebx, 0x20219
mov dword [rbp - 0x20], ebx
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.1400064d0
nop
xor edi, edi
test r13b, r13b
je 0x1400021c9
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x2010]
lea rdx, [0x140443848]
lea rcx, [rbp - 0x18]
call fcn.140008c18
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400021f2
mov sil, dil
jmp 0x140002677
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x3060]
lea r8, [rbp + 0x1010]
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, 1
mov r14d, esi
test eax, eax
jne 0x14000266b
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x10]
call fcn.140137f50
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x1010]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400064d0
nop
test r13b, r13b
je 0x140002292
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x2010]
lea rdx, [0x140443848]
lea rcx, [rsp + 0x60]
call fcn.140008c18
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000231c
mov dword [rbp + 0x3060], 0x800
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x3060]
lea r8, [rbp + 0x1010]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
add r14d, esi
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14000265f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
jmp 0x14000265f
mov eax, 4
mov dword [rbp + 0x3068], eax
mov dword [rsp + 0x50], edi
mov dword [rbp + 0x3058], eax
lea rax, [rbp + 0x3058]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3068]
xor r8d, r8d
lea rdx, str.SystemComponent
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], edi
jne 0x1400025f6
lea rdx, [0x1406bd052]
lea rcx, [rsp + 0x40]
call fcn.14000644c
nop
lea rdx, [0x1406bd052]
lea rcx, [rsp + 0x48]
call fcn.14000644c
nop
mov dword [rbp + 0x3068], esi
mov dword [rbp + 0x3058], 0x1000
mov rax, qword [rsp + 0x40]
mov edx, esi
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x800
or ecx, edx
jge 0x1400023cc
mov edx, 0x800
lea rcx, [rsp + 0x40]
call fcn.14000816c
mov rax, qword [rsp + 0x40]
lea rcx, [rbp + 0x3058]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3068]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
movsxd rdx, dword [rcx - 0xc]
call fcn.140173a1c
test eax, eax
js 0x1400026b4
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx - 0xc]
jg 0x1400026b4
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x40]
mov word [rax + rcx*2], di
test ebx, ebx
jne 0x1400025b4
mov rax, qword [r15]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14000249f
lea rcx, [rbx + 0x10]
lea rdx, [rbp - 0x10]
call fcn.140001d64
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x1400026bf
mov rcx, qword [rsp + 0x40]
call fcn.1401776c4
test eax, eax
sete dil
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002489
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dil, dil
jne 0x1400025b2
mov rbx, qword [rbx]
cmp rbx, qword [r15]
mov edi, 0
jne 0x140002441
mov dword [rbp + 0x3058], 0x1000
mov rax, qword [rsp + 0x48]
mov edx, esi
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x800
or ecx, edx
jge 0x1400024d4
mov edx, 0x800
lea rcx, [rsp + 0x48]
call fcn.14000816c
mov rax, qword [rsp + 0x48]
lea rcx, [rbp + 0x3058]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3068]
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x48]
movsxd rdx, dword [rcx - 0xc]
call fcn.140173a1c
test eax, eax
js 0x1400026b4
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx - 0xc]
jg 0x1400026b4
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x48]
mov word [rax + rcx*2], di
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [0x1406bd050]
lea rcx, [rbp - 8]
call fcn.1400064d0
nop
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400064d0
nop
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.1400064d0
nop
mov rbx, qword [r15]
lea r9, [rbp - 8]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.14000a994
mov rdx, qword [r15 + 8]
movabs rcx, 0x666666666666665
sub rcx, rdx
cmp rcx, rsi
jb 0x1400026ca
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
lea rcx, [rbp - 8]
call fcn.140002c1c
xor edi, edi
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400025d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400025f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x3060], 0x800
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x3060]
lea r8, [rbp + 0x1010]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
add r14d, esi
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000265f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test ebx, ebx
jne 0x14000266b
mov ebx, dword [rbp - 0x20]
jmp 0x140002231
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140002696
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov al, sil
mov rbx, qword [rsp + 0x3150]
add rsp, 0x3110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
lea rcx, str.list_T__too_long
call fcn.140101700
int3