Function at 0x14006cfa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x258]
sub rsp, 0x358
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x38], r9
mov rsi, r8
mov r13d, edx
mov rbx, rcx
mov r14, qword [rbp + 0x2c0]
mov rcx, r8
call fcn.14006d4f0
test al, al
je 0x14006d4b1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006d4b1
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.RegQueryValueExW
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.RegCloseKey
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [rsp + 0x40], rax
test r12, r12
je 0x14006d4b1
test r15, r15
je 0x14006d4b1
test rax, rax
je 0x14006d4b1
mov dword [rbp - 0x10], 0x6f0053
mov dword [rbp - 0xc], 0x740066
mov dword [rbp - 8], 0x610077
mov dword [rbp - 4], 0x650072
mov dword [rbp], 0x4d005c
mov dword [rbp + 4], 0x630069
mov dword [rbp + 8], 0x6f0072
mov dword [rbp + 0xc], 0x6f0073
mov dword [rbp + 0x10], 0x740066
mov dword [rbp + 0x14], 0x43005c
mov dword [rbp + 0x18], 0x460054
mov dword [rbp + 0x1c], 0x54005c
mov dword [rbp + 0x20], 0x500049
xor eax, eax
mov word [rbp + 0x24], ax
lea rcx, [rbp - 0x30]
call fcn.140001fec
nop
mov rcx, qword [rsp + 0x38]
call fcn.140001c60
mov rbx, rax
mov rcx, rsi
call fcn.140001c60
mov r9, rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r13d
lea r8, [rbp - 0x10]
lea rdx, str._s_sLanguageProfile0x_08x_s
lea rcx, [rbp - 0x30]
call fcn.1400069c0
xor esi, esi
mov qword [rbp - 0x60], rsi
lea rcx, [rbp - 0x30]
call fcn.140001c60
mov rdx, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call r12
test eax, eax
jne 0x14006d17c
mov dword [rbp - 0x54], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x30]
call fcn.1400a2390
mov dword [rbp - 0x58], 0x208
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.IconFile
mov rcx, qword [rbp - 0x60]
call r15
test eax, eax
je 0x14006d18f
mov rcx, qword [rbp - 0x60]
call rdi
xor bl, bl
lea rcx, [rbp - 0x30]
call fcn.140001c70
movzx eax, bl
jmp 0x14006d4b3
lea rcx, [rbp - 0x50]
call fcn.140001fec
nop
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001c78
nop
xor r8d, r8d
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.14006b8d0
movzx ebx, al
lea rcx, [rsp + 0x58]
call fcn.140001c70
test bl, bl
je 0x14006d1d7
lea rcx, [r14 + 8]
lea rdx, [rbp - 0x50]
call fcn.140002168
mov dword [rbp - 0x58], 0x208
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.Display_Description
mov rcx, qword [rbp - 0x60]
call r15
test eax, eax
jne 0x14006d24d
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140001c78
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.14006b520
nop
lea rcx, [r14 + 0x28]
mov rdx, rax
call fcn.140002dcc
nop
lea rcx, [rbp - 0x80]
call fcn.140001c70
nop
lea rcx, [rsp + 0x58]
call fcn.140001c70
jmp 0x14006d452
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rbp - 0x60]
call r15
lea rcx, [rbp + 0x30]
call fcn.140001de4
mov rsi, rax
lea rcx, [r14 + 0x28]
call fcn.140001ca0
mov rdi, rax
mov r13, qword [rax + 0x18]
cmp rsi, r13
ja 0x14006d2d0
mov rbx, rax
cmp r13, 8
jb 0x14006d2a1
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.140001ddc
xor r12d, r12d
mov word [rsp + 0x30], r12w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
jmp 0x14006d44b
lea rcx, [r14 + 0x28]
call fcn.140001f74
cmp rsi, rax
ja 0x14006d4dc
lea rcx, [r14 + 0x28]
call fcn.140001f74
mov rbx, rax
lea rcx, [r14 + 0x28]
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x50], rcx
cmp rcx, rbx
ja 0x14006d338
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006d338
lea rax, [rcx + rdx]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
mov r8, 0xffffffffffffffff
cmp rax, rcx
jbe 0x14006d35b
mov rdx, r8
jmp 0x14006d364
cmp rdx, 0x1000
jb 0x14006d391
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, r8
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006d4e2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r12d, r12d
jmp 0x14006d3a9
test rdx, rdx
je 0x14006d3a3
mov rcx, rdx
call fcn.1400a08c4
xor r12d, r12d
jmp 0x14006d3a9
xor r12d, r12d
mov eax, r12d
mov qword [rsp + 0x38], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x38]
mov r8, rsi
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.140001ddc
mov word [rsp + 0x30], r12w
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x30]
call fcn.140001dd4
cmp r13, 8
jb 0x14006d423
mov rcx, qword [rdi]
lea rdx, [r13*2 + 2]
cmp rdx, 0x1000
jb 0x14006d414
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006d4d6
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
jmp 0x14006d44b
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rdi, qword [rsp + 0x40]
xor esi, esi
mov dword [rbp - 0x58], 0x208
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.SubstituteLayout
mov rcx, qword [rbp - 0x60]
call r15
test eax, eax
jne 0x14006d498
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0x30]
call fcn.1400a95e8
mov dword [r14], eax
jmp 0x14006d49b
mov dword [r14], esi
mov rcx, qword [rbp - 0x60]
call rdi
mov bl, 1
lea rcx, [rbp - 0x50]
call fcn.140001c70
jmp 0x14006d17e
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.1400a08a0
add rsp, 0x358
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400a4d80
nop
call fcn.140001f60
int3
call fcn.1400a4d80
int3