Function at 0x14006c860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x430], rbx
mov rax, qword [0x14011c018]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov r13, r9
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14006cf4d
lea rdx, str.RegOpenKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.RegEnumKeyExW
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x68], rax
lea rdx, str.RegCloseKey
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x70], rax
test rbx, rbx
je 0x14006cf4d
test r15, r15
je 0x14006cf4d
test rax, rax
je 0x14006cf4d
mov dword [rbp + 0x80], 0x6f0053
mov dword [rbp + 0x84], 0x740066
mov dword [rbp + 0x88], 0x610077
mov dword [rbp + 0x8c], 0x650072
mov dword [rbp + 0x90], 0x4d005c
mov dword [rbp + 0x94], 0x630069
mov dword [rbp + 0x98], 0x6f0072
mov dword [rbp + 0x9c], 0x6f0073
mov dword [rbp + 0xa0], 0x740066
mov dword [rbp + 0xa4], 0x43005c
mov dword [rbp + 0xa8], 0x460054
mov dword [rbp + 0xac], 0x54005c
mov dword [rbp + 0xb0], 0x500049
xor esi, esi
mov word [rbp + 0xb4], si
lea rcx, [rbp + 0x60]
call fcn.140001fec
nop
mov rcx, r12
call fcn.140001c60
mov r9, rax
mov dword [rsp + 0x20], 0x804
lea r8, [rbp + 0x80]
lea rdx, str._s_sLanguageProfile0x_08x
lea rcx, [rbp + 0x60]
call fcn.1400069c0
mov qword [rbp - 0x40], rsi
lea rcx, [rbp + 0x60]
call fcn.140001c60
mov rdx, rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call rbx
test eax, eax
jne 0x14006cf44
mov r15d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xc0]
call fcn.1400a2390
mov dword [rbp - 0x38], 0x104
xor edx, edx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x38]
lea r8, [rbp + 0xc0]
mov rcx, qword [rbp - 0x40]
call qword [rsp + 0x68]
test eax, eax
jne 0x14006cf3c
lea rcx, [rbp - 0x30]
call fcn.140042d40
nop
lea rcx, [rbp + 0x20]
call fcn.140001fec
nop
lea rcx, [rbp + 0x40]
call fcn.140001fec
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x60]
call fcn.140001c78
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
mov r8, r12
mov edx, 0x804
mov rcx, rdi
call fcn.14006cfa0
movzx ebx, al
lea rcx, [rbp - 0x60]
call fcn.140001c70
test bl, bl
je 0x14006cf08
mov dword [rbp + 0x18], 0x804
mov dword [rbp - 0x30], esi
mov rcx, r12
call fcn.140001ca0
lea rcx, [rbp + 0x20]
cmp rcx, rax
je 0x14006ccb4
mov rcx, r12
call fcn.140001ca0
mov r15, rax
cmp qword [rax + 0x18], 8
jb 0x14006cae6
mov r15, qword [rax]
mov rsi, qword [rax + 0x10]
lea rcx, [rbp + 0x20]
call fcn.140001ca0
mov rdi, rax
mov r14, qword [rax + 0x18]
cmp rsi, r14
ja 0x14006cb37
mov rbx, rax
cmp r14, 8
jb 0x14006cb0b
mov rbx, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
jmp 0x14006ccaf
lea rcx, [rbp + 0x20]
call fcn.140001f74
cmp rsi, rax
ja 0x14006cf89
lea rcx, [rbp + 0x20]
call fcn.140001f74
mov rbx, rax
lea rcx, [rbp + 0x20]
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rsp + 0x78], rcx
cmp rcx, rbx
ja 0x14006cb9f
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14006cb9f
lea rax, [rcx + rdx]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140001d84
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006cbc2
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006cbd2
cmp rdx, 0x1000
jb 0x14006cbfc
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006cf7d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006cc0d
test rdx, rdx
je 0x14006cc0b
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006cc0d
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x50]
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rbx + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
cmp r14, 8
jb 0x14006cc87
mov rcx, qword [rdi]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x14006cc78
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006cf83
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x50]
mov qword [rdi], rax
jmp 0x14006ccaf
mov rcx, rdi
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov r15d, dword [rsp + 0x48]
lea rcx, [rbp + 0xc0]
call fcn.140001de4
mov rsi, rax
lea rcx, [rbp + 0x40]
call fcn.140001ca0
mov rbx, rax
mov r14, qword [rax + 0x18]
cmp rsi, r14
ja 0x14006cd14
mov rdi, rax
cmp r14, 8
jb 0x14006cce4
mov rdi, qword [rax]
mov qword [rax + 0x10], rsi
mov r8, rsi
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rdi + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
jmp 0x14006ce8c
lea rcx, [rbp + 0x40]
call fcn.140001f74
cmp rsi, rax
ja 0x14006cf77
lea rcx, [rbp + 0x40]
call fcn.140001f74
mov rdi, rax
lea rcx, [rbp + 0x40]
call fcn.140001ca0
mov rcx, rsi
or rcx, 7
mov qword [rbp - 0x78], rcx
cmp rcx, rdi
ja 0x14006cd78
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rdi
sub rax, rcx
cmp rdx, rax
ja 0x14006cd78
lea rax, [rdx + rcx]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x78]
call fcn.140001d84
mov rdi, qword [rax]
lea rax, [rdi + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14006cd9b
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14006cdab
cmp rdx, 0x1000
jb 0x14006cdd5
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.1400a08c4
mov rcx, rax
test rax, rax
je 0x14006cf8f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14006cde6
test rdx, rdx
je 0x14006cde4
mov rcx, rdx
call fcn.1400a08c4
jmp 0x14006cde6
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x58]
mov r8, rsi
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call fcn.140001ddc
xor eax, eax
mov word [rsp + 0x40], ax
lea rcx, [rdi + rsi*2]
lea rdx, [rsp + 0x40]
call fcn.140001dd4
cmp r14, 8
jb 0x14006ce64
mov rcx, qword [rbx]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x14006ce55
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14006cf95
mov rcx, r8
call fcn.1400a0900
mov rax, qword [rsp + 0x58]
mov qword [rbx], rax
jmp 0x14006ce8c
mov rcx, rbx
call fcn.140001ca0
mov rdx, rax
mov ecx, 8
call fcn.140001bf0
mov rbx, rax
lea rcx, [rsp + 0x58]
call fcn.140001ca0
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rdx, qword [r13 + 8]
cmp qword [r13 + 0x10], rdx
je 0x14006cef5
mov ecx, 0x90
call fcn.140001bf0
mov rbx, rax
mov qword [rsp + 0x48], rax
mov ecx, dword [rbp - 0x30]
mov dword [rax], ecx
lea rcx, [rax + 8]
lea rdx, [rbp - 0x28]
call fcn.140002e64
nop
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 8]
call fcn.140002e64
nop
mov eax, dword [rbp + 0x18]
mov dword [rbx + 0x48], eax
lea rcx, [rbx + 0x50]
lea rdx, [rbp + 0x20]
call fcn.140002e64
nop
lea rcx, [rbx + 0x70]
lea rdx, [rbp + 0x40]
call fcn.140002e64
nop
add qword [r13 + 8], 0x90
jmp 0x14006cf01
lea r8, [rbp - 0x30]
mov rcx, r13
call fcn.14006f370
xor esi, esi
mov rdi, qword [rsp + 0x60]
inc r15d
mov dword [rsp + 0x48], r15d
mov dword [rbp - 0x38], 0x104
lea rcx, [rbp + 0x40]
call fcn.140001c70
nop
lea rcx, [rbp + 0x20]
call fcn.140001c70
nop
lea rcx, [rbp - 0x30]
call fcn.140042d80
mov edx, r15d
jmp 0x14006ca23
mov rcx, qword [rbp - 0x40]
call qword [rbp - 0x70]
nop
lea rcx, [rbp + 0x60]
call fcn.140001c70
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1400a08a0
mov rbx, qword [rsp + 0x430]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001f60
nop
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3
call fcn.140001f60
int3
call fcn.1400a4d80
int3
call fcn.1400a4d80
int3