Function at 0x140206350
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
xor edi, edi
mov dword [rsp + 0x50], 0x580053
mov ecx, edi
mov dword [rsp + 0x54], 0x570051
mov dword [rsp + 0x58], 0x480041
mov dword [rsp + 0x5c], 0x44005a
mov dword [rsp + 0x60], 0x7b007d
mov dword [rsp + 0x64], 0x6e0078
mov dword [rsp + 0x68], 0x790062
mov dword [rsp + 0x6c], 0x60004d
mov dword [rsp + 0x70], 0x65007e
mov dword [rsp + 0x74], 0x7c0060
mov dword [rsp + 0x78], 0x460078
mov dword [rsp + 0x7c], 0x630073
mov dword [rbp - 0x80], 0x5c0044
mov dword [rbp - 0x7c], 0x6e0074
mov dword [rbp - 0x78], 0x410071
mov dword [rbp - 0x74], 0x56005a
mov dword [rbp - 0x70], 0x710073
mov dword [rbp - 0x6c], 0x62006e
mov dword [rbp - 0x68], 0x7d
nop
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0x25
jb 0x140206400
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x198], r13
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x66], di
mov qword [rbp - 0x60], rdi
call fcn.14013edcc
cmp qword [rbp - 0x48], 8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rdi
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], edi
mov qword [rbp + 0xe0], rdi
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov r14, rdi
lea rcx, [rbp - 0x60]
test eax, eax
cmove r14, qword [rbp + 0xe0]
mov qword [rbp + 0xe0], r14
call fcn.14013ed68
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xe0]
call fcn.1401de5b0
mov r15, qword [rbp + 0x70]
mov ebx, 0x80000000
mov r12, qword [rbp + 0x78]
mov qword [rbp + 0x50], r15
cmp r15, r12
je 0x140206c29
xor eax, eax
mov dword [rsp + 0x50], 0x580053
mov word [rbp - 0x64], ax
mov ecx, edi
mov dword [rsp + 0x54], 0x570051
mov dword [rsp + 0x58], 0x480041
mov dword [rsp + 0x5c], 0x44005a
mov dword [rsp + 0x60], 0x7b007d
mov dword [rsp + 0x64], 0x6e0078
mov dword [rsp + 0x68], 0x790062
mov dword [rsp + 0x6c], 0x60004d
mov dword [rsp + 0x70], 0x65007e
mov dword [rsp + 0x74], 0x7c0060
mov dword [rsp + 0x78], 0x460078
mov dword [rsp + 0x7c], 0x630073
mov dword [rbp - 0x80], 0x5c0044
mov dword [rbp - 0x7c], 0x6e0074
mov dword [rbp - 0x78], 0x410071
mov dword [rbp - 0x74], 0x56005a
mov dword [rbp - 0x70], 0x710073
mov dword [rbp - 0x6c], 0x62006e
mov dword [rbp - 0x68], 0x79007d
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0x26
jb 0x140206570
lea rdx, [rsp + 0x50]
mov word [rbp - 0x64], di
lea rcx, [rbp + 0x20]
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 7
call fcn.14013edcc
cmp qword [r15 + 0x18], 8
mov rdx, r15
jb 0x1402065ae
mov rdx, qword [r15]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x1402065b5
lea rcx, [rbp + 0x20]
call fcn.14013ec14
cmp qword [rbp + 0x38], 8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rdi
lea rdx, [rbp + 0x20]
cmovae rdx, qword [rbp + 0x20]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], edi
mov qword [rbp + 0xe0], rdi
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rsi, rdi
lea rdx, [rbp + 0x58]
test eax, eax
lea rcx, [rbp + 0xe0]
cmove rsi, qword [rbp + 0xe0]
mov qword [rbp + 0xe0], rsi
call fcn.1401de5b0
mov rbx, qword [rbp + 0x58]
mov qword [rbp + 0xf8], rbx
cmp rbx, qword [rbp + 0x60]
je 0x140206ba0
nop dword [rax + rax]
cmp qword [rbp + 0x38], 8
lea r12, [rbp + 0x20]
mov r15, qword [rbp + 0x30]
cmovae r12, qword [rbp + 0x20]
mov qword [rbp], rdi
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rdi
cmp r15, 8
jae 0x14020668a
movups xmm0, xmmword [r12]
mov qword [rbp + 0x18], 7
movups xmmword [rbp], xmm0
jmp 0x140206725
movabs rax, 0x7ffffffffffffffe
mov rbx, r15
or rbx, 7
cmp rbx, rax
cmova rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x140206cb5
add rcx, rcx
cmp rcx, 0x1000
jb 0x1402066f4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140206cb5
mov rcx, rax
call fcn.1403caaf4
mov rcx, rax
test rax, rax
je 0x140206cc7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140206703
test rcx, rcx
je 0x140206700
call fcn.1403caaf4
jmp 0x140206703
mov rax, rdi
lea r8, [r15*2 + 2]
mov qword [rbp], rax
mov rdx, r12
mov rcx, rax
call fcn.1403cc5a0
mov qword [rbp + 0x18], rbx
mov rbx, qword [rbp + 0xf8]
mov qword [rbp + 0x10], r15
mov eax, edi
mov dword [rbp + 0xe8], 0x5c
nop word [rax + rax]
movsxd rcx, eax
xor word [rbp + rcx*2 + 0xe8], ax
inc eax
cmp eax, 1
jb 0x140206740
mov word [rbp + 0xea], di
lea rax, [rbp + 0xe8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140206770
lea rdx, [rbp + 0xe8]
lea rcx, [rbp]
call fcn.14013ec14
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x140206797
mov rdx, qword [rbx]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], di
jne 0x1402067a0
lea rcx, [rbp]
call fcn.14013ec14
xor eax, eax
mov dword [rbp - 0x60], 0x45005c
mov word [rbp - 0x3c], ax
mov ecx, edi
mov dword [rbp - 0x5c], 0x750067
mov dword [rbp - 0x58], 0x66006d
mov dword [rbp - 0x54], 0x270063
mov dword [rbp - 0x50], 0x680058
mov dword [rbp - 0x4c], 0x6a0078
mov dword [rbp - 0x48], 0x680061
mov dword [rbp - 0x44], 0x6a007a
mov dword [rbp - 0x40], 0x620062
nop word [rax + rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x60], cx
inc ecx
cmp ecx, 0x12
jb 0x140206800
mov word [rbp - 0x3c], di
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x140206820
lea rdx, [rbp - 0x60]
lea rcx, [rbp]
call fcn.14013ec14
cmp qword [rbp + 0x18], 8
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rdi
lea rdx, [rbp]
cmovae rdx, qword [rbp]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], edi
mov qword [rbp + 0x40], rdi
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rbx, rdi
mov dword [rbp - 0x38], 0x450045
test eax, eax
mov dword [rbp - 0x34], 0x47004b
mov ecx, edi
cmove rbx, qword [rbp + 0x40]
xor eax, eax
mov word [rbp - 0x30], ax
nop dword [rax + rax]
movsxd rax, ecx
xor word [rbp + rax*2 - 0x38], cx
inc ecx
cmp ecx, 4
jb 0x1402068a0
lea rdx, [rbp - 0x38]
mov word [rbp - 0x30], di
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 7
call fcn.14013edcc
cmp qword [rbp - 8], 8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x20]
cmovae r8, qword [rbp - 0x20]
mov rcx, rbx
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rbp + 0xe0], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdx + 8]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ecx, dword [rbp + 0xe0]
mov r13, rdi
mov qword [rbp + 0xf0], rdi
mov r12d, eax
mov r15d, ecx
test ecx, ecx
je 0x14020697b
cmp rcx, 0x1000
jb 0x140206955
add rcx, 0x27
cmp rcx, r15
jbe 0x140206cc1
call fcn.1403caaf4
test rax, rax
je 0x140206cbb
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x14020695d
call fcn.1403caaf4
mov r13, rax
lea rax, [r15 + r13]
mov r8, r15
xor edx, edx
mov qword [rbp + 0xf0], rax
mov rcx, r13
call fcn.1403ccc50
mov ecx, dword [rbp + 0xe0]
test r12d, r12d
jne 0x1402069b8
test ecx, ecx
je 0x1402069b8
cmp qword [rbp - 8], 8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x20]
cmovae r8, qword [rbp - 0x20]
lea r9d, [r12 + 8]
xor edx, edx
mov qword [rsp + 0x28], r13
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.advapi32.dll_RegGetValueW]
lea rcx, [rbp - 0x20]
call fcn.14013ed68
mov rdx, qword [rbp + 0xf0]
sub rdx, r13
mov qword [rbp + 0xf0], rdx
je 0x140206b0a
xorps xmm0, xmm0
mov qword [rbp - 0x10], rdi
mov ecx, 0x80
mov r12, rdi
movdqu xmmword [rbp - 0x20], xmm0
mov r15, qword [rbp - 0x18]
mov qword [rbp + 0x48], rcx
nop dword [rax]
nop dword [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov byte [rbp + 0xe0], al
cmp r15, r12
je 0x140206a20
mov byte [r15], al
inc r15
mov qword [rbp - 0x18], r15
jmp 0x140206a3f
lea r8, [rbp + 0xe0]
mov rdx, r15
lea rcx, [rbp - 0x20]
call fcn.14020fa70
mov rcx, qword [rbp + 0x48]
mov r12, qword [rbp - 0x10]
mov r15, qword [rbp - 0x18]
sub rcx, 1
mov qword [rbp + 0x48], rcx
jne 0x140206a00
xor eax, eax
mov dword [rbp - 0x2e], 0x450045
mov word [rbp - 0x26], ax
mov ecx, edi
mov dword [rbp - 0x2a], 0x47004b
nop
movsxd rax, ecx
xor word [rbp + rax*2 - 0x2e], cx
inc ecx
cmp ecx, 4
jb 0x140206a60
lea rdx, [rbp - 0x2e]
mov word [rbp - 0x26], di
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], 7
call fcn.14013edcc
sub r15d, dword [rbp - 0x20]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
mov r9d, 3
mov dword [rsp + 0x28], r15d
mov rcx, rbx
cmovae rdx, qword [rbp - 0x60]
xor r8d, r8d
mov r15, qword [rbp - 0x20]
mov qword [rsp + 0x20], r15
call qword [sym.imp.advapi32.dll_RegSetValueExW]
lea rcx, [rbp - 0x60]
call fcn.14013ed68
test r15, r15
je 0x140206b03
sub r12, r15
mov rax, r15
cmp r12, 0x1000
jb 0x140206af8
mov r15, qword [r15 - 8]
add r12, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140206cc7
mov rdx, r12
mov rcx, r15
call fcn.1403cad84
mov rdx, qword [rbp + 0xf0]
test r13, r13
je 0x140206b3c
cmp rdx, 0x1000
jb 0x140206b34
mov rcx, qword [r13 - 8]
add rdx, 0x27
sub r13, rcx
lea rax, [r13 - 8]
cmp rax, 0x1f
ja 0x140206cc7
mov r13, rcx
mov rcx, r13
call fcn.1403cad84
test rbx, rbx
je 0x140206b73
mov eax, 0x80000000
add rax, rbx
cmp rax, 5
jbe 0x140206b73
cmp rbx, 0xffffffff80000007
je 0x140206b73
cmp rbx, 0xffffffff80000060
je 0x140206b73
cmp rbx, 0xffffffff80000050
je 0x140206b73
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rcx, [rbp]
call fcn.14013ed68
mov rbx, qword [rbp + 0xf8]
add rbx, 0x20
mov qword [rbp + 0xf8], rbx
cmp rbx, qword [rbp + 0x60]
jne 0x140206650
mov r15, qword [rbp + 0x50]
mov r12, qword [rbp + 0x78]
mov ebx, 0x80000000
test rsi, rsi
je 0x140206bdb
lea rax, [rsi + rbx]
cmp rax, 5
jbe 0x140206bd8
cmp rsi, 0xffffffff80000007
je 0x140206bd8
cmp rsi, 0xffffffff80000060
je 0x140206bd8
cmp rsi, 0xffffffff80000050
je 0x140206bd8
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rsi, rdi
lea rcx, [rbp + 0x58]
call fcn.140194884
test rsi, rsi
je 0x140206c17
lea rax, [rsi + rbx]
cmp rax, 5
jbe 0x140206c17
cmp rsi, 0xffffffff80000007
je 0x140206c17
cmp rsi, 0xffffffff80000060
je 0x140206c17
cmp rsi, 0xffffffff80000050
je 0x140206c17
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rcx, [rbp + 0x20]
call fcn.14013ed68
add r15, 0x20
jmp 0x1402064be
test r14, r14
je 0x140206c5f
lea rax, [r14 + rbx]
cmp rax, 5
jbe 0x140206c5c
cmp r14, 0xffffffff80000007
je 0x140206c5c
cmp r14, 0xffffffff80000060
je 0x140206c5c
cmp r14, 0xffffffff80000050
je 0x140206c5c
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov r14, rdi
lea rcx, [rbp + 0x70]
call fcn.140194884
test r14, r14
je 0x140206c9b
lea rax, [r14 + rbx]
cmp rax, 5
jbe 0x140206c9b
cmp r14, 0xffffffff80000007
je 0x140206c9b
cmp r14, 0xffffffff80000060
je 0x140206c9b
cmp r14, 0xffffffff80000050
je 0x140206c9b
mov rcx, r14
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov r13, qword [rsp + 0x198]
add rsp, 0x1a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401391d8
int3
call fcn.1403d7020
int3
call fcn.1401391d8
int3
call fcn.1403d7020
int3