Function at 0x1800538f0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create thread
Get file attributes
Get file size
Query or enumerate registry value
Read file via mapping

Disassembly:
push rbx
mov eax, 0x1950
call fcn.18006f400
sub rsp, rax
mov rax, qword [0x1800a7b78]
xor rax, rsp
mov qword [rsp + 0x1930], rax
mov rbx, rcx
call fcn.180053740
cmp qword [0x1800a9550], 0
jne 0x180053930
call fcn.18001fec0
test al, al
je 0x180053bc6
lea rax, [rsp + 0x40]
mov byte [rbx + 0x2c], 1
mov rcx, qword [0x1800a9550]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1110]
lea rdx, str.AppDataIDMFolder
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x410
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18005397b
mov eax, 1
jmp 0x180053bc8
lea rcx, [rsp + 0x1110]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180053971
lea r9, [rsp + 0x1110]
lea r8, str._sidmfc.dat
lea rcx, [rsp + 0x1520]
mov edx, 0x208
mov qword [rsp + 0x1970], rsi
mov qword [rsp + 0x1940], r13
call fcn.180058fc0
xor r13d, r13d
lea rcx, [rsp + 0x1520]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000080
mov byte [rsp + 0x10f0], 0x42
mov dword [rsp + 0x20], 3
mov byte [rsp + 0x10f1], 0x67
mov byte [rsp + 0x10f2], 0xe2
mov byte [rsp + 0x10f3], 0x6c
mov byte [rsp + 0x10f4], 0x2d
mov byte [rsp + 0x10f5], 0x60
mov byte [rsp + 0x10f6], 0x31
mov byte [rsp + 0x10f7], 0x9d
mov byte [rsp + 0x10f8], 0xdd
mov byte [rsp + 0x10f9], 0xbb
mov byte [rsp + 0x10fa], 0x4b
mov byte [rsp + 0x10fb], 0x82
mov byte [rsp + 0x10fc], 0x76
mov byte [rsp + 0x10fd], 0x6d
mov byte [rsp + 0x10fe], 0xb5
mov byte [rsp + 0x10ff], 0xdf
mov byte [rsp + 0x1100], 0x35
mov byte [rsp + 0x1101], 0xac
mov byte [rsp + 0x1102], 0x7b
mov byte [rsp + 0x1103], 9
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180053b88
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x1968], rbp
mov qword [rsp + 0x1948], r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r8d, [r13 + 2]
mov r12d, eax
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
je 0x180053b6f
lea edx, [r13 + 4]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x1978], rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180053b5e
lea ecx, [r12 + 1]
call fcn.180058e74
mov qword [rbx + 0x838], rax
test rax, rax
je 0x180053b55
lea rdx, [rsp + 0x10f0]
lea rcx, [rsp + 0x50]
call fcn.180054620
mov r9, qword [rbx + 0x838]
lea rcx, [rsp + 0x50]
mov r8d, r12d
mov rdx, rdi
call fcn.1800546d0
mov rax, qword [rbx + 0x838]
mov byte [r12 + rax], r13b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x1978]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x1948]
mov rbp, qword [rsp + 0x1968]
mov rsi, qword [rsp + 0x1970]
cmp dword [0x1800ab098], r13d
jne 0x180053bbe
lea rax, [0x1800ab098]
lea r8, [0x180053810]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, qword [rsp + 0x1940]
xor eax, eax
mov rcx, qword [rsp + 0x1930]
xor rcx, rsp
call fcn.1800590c0
add rsp, 0x1950
pop rbx
ret