Function at 0x180027d60
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x618
mov rax, qword [0x1800842c0]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x44], 1
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x200]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x400
lea rax, [rsp + 0x180]
mov rdi, rax
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
lea rcx, [rsp + 0xe0]
call fcn.180021610
nop
mov byte [rsp + 0xb0], 0x53
mov byte [rsp + 0xb1], 0x4f
mov byte [rsp + 0xb2], 0x46
mov byte [rsp + 0xb3], 0x54
mov byte [rsp + 0xb4], 0x57
mov byte [rsp + 0xb5], 0x41
mov byte [rsp + 0xb6], 0x52
mov byte [rsp + 0xb7], 0x45
mov byte [rsp + 0xb8], 0x5c
mov byte [rsp + 0xb9], 0x4d
mov byte [rsp + 0xba], 0x69
mov byte [rsp + 0xbb], 0x63
mov byte [rsp + 0xbc], 0x72
mov byte [rsp + 0xbd], 0x6f
mov byte [rsp + 0xbe], 0x73
mov byte [rsp + 0xbf], 0x6f
mov byte [rsp + 0xc0], 0x66
mov byte [rsp + 0xc1], 0x74
mov byte [rsp + 0xc2], 0x5c
mov byte [rsp + 0xc3], 0x57
mov byte [rsp + 0xc4], 0x69
mov byte [rsp + 0xc5], 0x6e
mov byte [rsp + 0xc6], 0x64
mov byte [rsp + 0xc7], 0x6f
mov byte [rsp + 0xc8], 0x77
mov byte [rsp + 0xc9], 0x73
mov byte [rsp + 0xca], 0x20
mov byte [rsp + 0xcb], 0x4e
mov byte [rsp + 0xcc], 0x54
mov byte [rsp + 0xcd], 0x5c
mov byte [rsp + 0xce], 0x43
mov byte [rsp + 0xcf], 0x75
mov byte [rsp + 0xd0], 0x72
mov byte [rsp + 0xd1], 0x72
mov byte [rsp + 0xd2], 0x65
mov byte [rsp + 0xd3], 0x6e
mov byte [rsp + 0xd4], 0x74
mov byte [rsp + 0xd5], 0x56
mov byte [rsp + 0xd6], 0x65
mov byte [rsp + 0xd7], 0x72
mov byte [rsp + 0xd8], 0x73
mov byte [rsp + 0xd9], 0x69
mov byte [rsp + 0xda], 0x6f
mov byte [rsp + 0xdb], 0x6e
lea rax, [rsp + 0xdc]
mov r8, rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.180004ea0
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x38]
call fcn.180002740
mov r8, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x78]
call fcn.180004f90
nop
lea rcx, [rsp + 0x100]
call fcn.1800099e0
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x100]
call fcn.18003d170
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.180004780
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x180027fe6
mov dword [rsp + 0x3c], 1
jmp 0x180027fee
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x30], al
lea rcx, [rsp + 0x120]
call fcn.180004630
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1800281d2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x180077b90]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800281d2
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xe0]
call fcn.1800299a0
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.CurrentBuild
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180028137
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea r8, [0x180077bb0]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x140]
call fcn.180011a70
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x630]
call fcn.180011b40
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x140]
call fcn.180004630
nop
lea rcx, [rsp + 0x100]
call fcn.180010c60
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0xe0]
call fcn.180004630
nop
mov rax, qword [rsp + 0x630]
jmp 0x18002821f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea r8, [0x180077bb4]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x160]
call fcn.180011a70
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x630]
call fcn.180011b40
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x160]
call fcn.180004630
nop
lea rcx, [rsp + 0x100]
call fcn.180010c60
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0xe0]
call fcn.180004630
nop
mov rax, qword [rsp + 0x630]
jmp 0x18002821f
lea rdx, [0x1800778ab]
mov rcx, qword [rsp + 0x630]
call fcn.1800160c0
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x100]
call fcn.180010c60
nop
lea rcx, [rsp + 0x78]
call fcn.180003930
nop
lea rcx, [rsp + 0xe0]
call fcn.180004630
mov rax, qword [rsp + 0x630]
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1800412e0
add rsp, 0x618
pop rdi
pop rsi
ret