Function at 0x18001089c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x180076008]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rdi, rcx
mov word [rsp + 0x7a], 0x5446
lea rcx, [rsp + 0x70]
mov word [rbp - 0x80], 0x5c
mov r15d, r9d
mov word [rsp + 0x7d], 0x5241
mov r14d, r8d
mov word [rsp + 0x78], 0x4f53
mov rsi, rdx
mov byte [rsp + 0x7f], 0x45
mov byte [rsp + 0x7c], 0x57
call fcn.18001172c
mov r8, rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.1800115d8
lea rcx, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
movsxd rbx, eax
or r13d, 0xffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x18001095f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x70]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010980
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test rbx, rbx
jne 0x180010aef
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x104
call fcn.180018180
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
call fcn.18000fc30
test eax, eax
jne 0x180010ae4
cmp dword [rsp + 0x48], eax
jbe 0x180010ae4
call fcn.18000f704
mov rcx, rax
test rax, rax
je 0x180010b40
mov rax, qword [rax]
call qword [rax + 0x18]
mov r8, rdi
lea rdx, [0x18006b5b4]
add rax, 0x18
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.180012038
call fcn.18000f704
mov rcx, rax
test rax, rax
je 0x180010b4b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
lea r8, [rbp - 0x70]
lea rdx, [0x18006a6ac]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.180012038
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
je 0x180010aa7
cmp dword [rbx - 0x10], 0
jl 0x180010aa7
mov rcx, rbx
call fcn.18003b978
test rax, rax
je 0x180010aa7
cmp eax, ebx
js 0x180010aa7
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010a7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010aa0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 1
jmp 0x180010b1f
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010ac3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, r13d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x180010ae4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x120]
mov r9d, r15d
mov dword [rsp + 0x30], eax
mov r8d, r14d
mov eax, dword [rbp + 0x118]
mov rdx, rsi
mov dword [rsp + 0x28], eax
mov rcx, rdi
mov eax, dword [rbp + 0x110]
mov dword [rsp + 0x20], eax
call qword [0x1800a26c0]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1800133b0
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1800102a8
int3
mov ecx, 0x80004005
call fcn.1800102a8
int3