Function at 0x140095304
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x37], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov word [rbp - 8], 0x6572
mov dword [rbp + 0x29], 0x742e7377
mov dword [rbp + 0x1c], 0x6568735c
mov dword [rbp + 0x10], 0x616d6d6f
mov dword [rbp + 0x16], 0x726f7453
mov dword [rbp - 0x1b], 0x666f736f
mov dword [rbp - 0x15], 0x6e69575c
mov dword [rbp - 4], 0x73726556
mov dword [rbp - 0x1f], 0x7263694d
mov word [rbp - 0x11], 0x6f64
mov word [rbp + 0x35], WSASetLastError
mov word [rbp + 0x32], 0x7072
mov dword [rbp + 0x22], 0x69575c5c
mov dword [rbp + 0x2d], 0x626b7361
mov dword [rbp - 0x27], 0x41575446
mov word [rbp], 0x6f69
mov dword [rbp + 3], 0x78455c5c
mov dword [rbp - 0x23], 0x5c5c4552
mov word [rbp - 0xb], 0x7543
mov word [rbp + 0x20], 0x6c6c
mov dword [rbp + 8], 0x65726f6c
mov dword [rbp + 0xc], 0x435c5c72
mov byte [rbp + 2], WSASetLastError
mov word [rbp + 0x14], 0x646e
mov word [rbp + 0x1a], 0x5c65
mov word [rbp - 0xe], 0x5c73
mov byte [rbp - 9], WSACleanup
mov word [rbp - 6], 0x746e
mov word [rbp + 0x27], 0x6f64
mov byte [rbp + 0x31], 0x61
mov word [rbp - 0x17], 0x5c74
mov byte [rbp - 0xc], 0x5c
mov byte [rbp + 0x34], 0x69
mov byte [rbp - 0xf], 0x77
mov byte [rbp + 0x26], WSASetLastError
mov word [rbp - 0x29], 0x4f53
mov byte [rbp + 7], reloc.WS2_32.dll_WSASetLastError
mov word [rbp - 0x34], WSACleanup
mov word [rbp - 0x49], 0x7845
mov word [rbp - 0x46], 0x6f6c
mov word [rbp - 0x3f], 0x6d6d
mov dword [rbp - 0x43], 0x6f437265
mov word [rbp - 0x39], 0x6e61
mov word [rbp - 0x3c], 0x646e
mov byte [rbp - 0x3d], 0x61
mov word [rbp - 0x37], 0x6c64
mov byte [rbp - 0x35], 0x65
mov byte [rbp - 0x44], WSACleanup
mov byte [rbp - 0x3a], 0x48
mov byte [rbp - 0x47], reloc.WS2_32.dll_WSASetLastError
call fcn.140010fb4
mov rcx, rax
test rax, rax
jne 0x14009545f
mov ecx, 0x80004005
call fcn.140010d40
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x77], rbx
mov edi, 1
mov dword [rbp + 0x6f], edi
mov edx, 0x104
mov dword [rbp + 0x67], edx
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140095498
lea rcx, [rbp + 0x77]
call fcn.140010c2c
mov rbx, qword [rbp + 0x77]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x6f]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x29]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400606d8
test eax, eax
js 0x140095531
cmp eax, dword [rbx - 0xc]
jg 0x140095531
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
test esi, esi
jne 0x14009550e
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, edi
lea r8, [rbp - 0x49]
lea rdx, str.SOFTWAREClasses_shell:
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
je 0x140095511
xor dil, dil
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x14009552c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov al, dil
jmp 0x14009553c
mov ecx, 0x80070057
call fcn.140010d40
nop
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret