Function at 0x14006afd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x3d8], rbx
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r14, r8
mov edi, edx
mov r15, rcx
movzx ebx, dx
imul r13d, ebx, 0x10001
mov dword [rbp - 0x10], 0x790053
mov dword [rbp - 0xc], 0x740073
mov dword [rbp - 8], 0x6d0065
mov dword [rbp - 4], 0x43005c
mov dword [rbp], 0x720075
mov dword [rbp + 4], 0x650072
mov dword [rbp + 8], 0x74006e
mov dword [rbp + 0xc], 0x6f0043
mov dword [rbp + 0x10], 0x74006e
mov dword [rbp + 0x14], 0x6f0072
mov dword [rbp + 0x18], 0x53006c
mov dword [rbp + 0x1c], 0x740065
mov dword [rbp + 0x20], 0x43005c
mov dword [rbp + 0x24], 0x6e006f
mov dword [rbp + 0x28], 0x720074
mov dword [rbp + 0x2c], 0x6c006f
mov dword [rbp + 0x30], 0x4b005c
mov dword [rbp + 0x34], 0x790065
mov dword [rbp + 0x38], 0x6f0062
mov dword [rbp + 0x3c], 0x720061
mov dword [rbp + 0x40], 0x200064
mov dword [rbp + 0x44], 0x61004c
mov dword [rbp + 0x48], 0x6f0079
mov dword [rbp + 0x4c], 0x740075
mov dword [rbp + 0x50], 0x73
lea rcx, [rbp - 0x38]
call fcn.140001fec
nop
cmp edi, r13d
cmovne ebx, edi
mov r9d, ebx
lea r8, [rbp - 0x10]
lea rdx, str._s_08x
lea rcx, [rbp - 0x38]
call fcn.1400069c0
mov rcx, qword [r15]
test rcx, rcx
je 0x14006b4cb
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.RegCloseKey
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rsi, rsi
je 0x14006b4cb
test rbx, rbx
je 0x14006b4cb
test rax, rax
je 0x14006b4cb
mov qword [rsp + 0x78], 0
lea rcx, [rbp - 0x38]
call fcn.140001c60
mov rdx, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call rsi
test eax, eax
jne 0x14006b4cb
test edi, 0xffff0000
cmove edi, r13d
mov dword [r14], edi
xor r13d, r13d
mov dword [rbp - 0x7c], r13d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call fcn.1400a2390
mov dword [rbp - 0x80], 0x208
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Ime_File
mov rcx, qword [rsp + 0x78]
call rbx
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x58]
call fcn.140001c78
nop
lea rcx, [rbp - 0x58]
call fcn.140001ca0
cmp qword [rax + 0x10], r13
jbe 0x14006b24f
lea rcx, [rbp - 0x78]
call fcn.140001fec
nop
lea rdx, [rbp - 0x78]
call fcn.14006c300
lea edx, [r13 + 0x10]
lea rcx, [rbp - 0x78]
call fcn.140003660
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call fcn.140003060
nop
lea rcx, [r14 + 8]
mov rdx, rax
call fcn.140002dcc
nop
lea rcx, [rsp + 0x58]
call fcn.140001c70
nop
lea rcx, [rbp - 0x78]
call fcn.140001c70
mov dword [rbp - 0x80], 0x208
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Layout_Display_Name
mov rcx, qword [rsp + 0x78]
call rbx
test eax, eax
jne 0x14006b2c4
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.140001c78
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x58]
call fcn.14006b520
nop
lea rcx, [r14 + 0x28]
mov rdx, rax
call fcn.140002dcc
nop
lea rcx, [rsp + 0x58]
call fcn.140001c70
nop
lea rcx, [rbp - 0x78]
call fcn.140001c70
jmp 0x14006b4b6
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, str.Layout_Text
mov rcx, qword [rsp + 0x78]
call rbx
add r14, 0x28
lea rcx, [rbp + 0x60]
call fcn.140001de4
mov rsi, rax
mov rcx, r14
call fcn.140001ca0
mov rdi, rax
mov r15, qword [rax + 0x18]
cmp rsi, r15
ja 0x14006b347
mov rbx, rax
cmp r15, 8
jb 0x14006b31b
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x14006b4b6
mov rcx, r14
call fcn.140001f74
cmp rsi, rax
ja 0x14006b509
mov rcx, r14
call fcn.140001f74
mov rbx, rax
mov rcx, r14
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x48], rcx
cmp rcx, rbx
ja 0x14006b3ac
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006b3ac
lea rax, [rcx + rdx]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x14006b3cf
mov rdx, r8
jmp 0x14006b3d8
cmp rdx, 0x1000
jb 0x14006b402
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006b50f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006b414
test rdx, rdx
je 0x14006b411
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006b414
mov rax, r13
mov qword [rsp + 0x38], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x38]
mov r8, rsi
lea rdx, [rbp + 0x60]
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r13w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
cmp r15, 8
jb 0x14006b48e
mov rcx, qword [rdi]
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
jb 0x14006b47f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006b503
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x14006b4b6
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rcx, qword [rsp + 0x78]
call r12
mov bl, 1
lea rcx, [rbp - 0x58]
call fcn.140001c70
jmp 0x14006b4cd
xor bl, bl
lea rcx, [rbp - 0x38]
call fcn.140001c70
movzx eax, bl
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.1400a08a0
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a4d80
nop
call fcn.140001f60
int3
call fcn.1400a4d80
int3