Function at 0x140115b70
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x14016a100]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, rcx
mov qword [rbp - 0x41], rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
mov dword [rbp + 0x14], 0x6e657272
mov word [rbp - 4], 0x5241
mov dword [rbp + 0x26], 0x6c6c6174
mov word [rbp + 0x24], 0x736e
mov dword [rbp + 0xc], 0x776f646e
mov word [rbp + 5], 0x6f73
mov dword [rbp + 0x10], 0x75435c73
mov word [rbp - 1], 0x4d5c
mov dword [rbp - 9], 0x54464f53
mov dword [rbp + 0x1d], 0x5c6e6f69
mov word [rbp + 0x21], 0x6e55
mov word [rbp + 2], 0x7263
mov word [rbp + 0x18], 0x5674
mov word [rbp + 0xa], 0x6957
mov byte [rbp - 2], 0x45
mov byte [rbp + 0x23], 0x69
mov word [rbp + 0x1b], 0x7372
mov byte [rbp + 1], 0x69
mov word [rbp + 7], 0x7466
mov byte [rbp + 0x2a], r12b
mov byte [rbp + 9], 0x5c
mov byte [rbp + 4], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp + 0x1a], 0x65
mov byte [rbp - 5], 0x57
mov word [rbp - 0x2e], 0x6974
mov word [rbp - 0x2b], WSASetLastError
mov dword [rbp - 0x39], 0x74736e49
mov dword [rbp - 0x35], 0x4c6c6c61
mov word [rbp - 0x30], 0x6163
mov byte [rbp - 0x31], reloc.WS2_32.dll_WSAGetLastError
mov byte [rbp - 0x2c], reloc.WS2_32.dll_WSAGetLastError
mov dword [rbp - 0x11], 0x65726946
mov dword [rbp - 0xd], 0x786f66
mov word [rbp - 0x14], 0x616c
mov dword [rbp - 0x19], 0x697a6f4d
mov byte [rbp - 0x12], reloc.WLDAP32.dll_Ordinal_32
mov byte [rbp - 0x15], WSAGetLastError
lea rdx, [rbp - 0x19]
lea rcx, [rsp + 0x40]
call fcn.140014840
nop
mov dword [rbp - 0x61], 0x200
mov dword [rbp - 0x5d], 0x100
call fcn.140013c54
mov rcx, rax
test rax, rax
je 0x14011618c
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x48], 1
mov r14d, r12d
or r13d, 0xffffffff
mov qword [rbp - 0x69], r12
mov r9d, dword [rbp + r14*4 - 0x61]
or r9d, 0x20019
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 9]
mov rcx, 0xffffffff80000002
call fcn.1400f8f20
mov esi, eax
call fcn.140013c54
test rax, rax
je 0x140116181
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r15d, r12d
test esi, esi
jne 0x140115e8c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov esi, 0x104
sub eax, esi
or eax, ecx
jge 0x140115d48
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140014364
mov rbx, qword [rsp + 0x30]
mov r9d, esi
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400b2380
test eax, eax
js 0x1401161ad
cmp eax, dword [rbx - 0xc]
jg 0x1401161ad
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test esi, esi
jne 0x140115e8c
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rsp + 0x30]
call fcn.14000ec6c
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1401161a2
mov rcx, qword [rax]
call fcn.1400b276c
test eax, eax
sete bl
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140115de3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x140115df1
mov rbx, qword [rsp + 0x30]
jmp 0x140115d21
mov dword [rbp - 0x79], 1
mov r8d, 0x104
mov dword [rbp - 0x7d], r8d
mov rax, qword [rdi]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r8d
or ecx, edx
jge 0x140115e22
mov edx, r8d
mov rcx, rdi
call fcn.140014364
mov rax, qword [rdi]
lea rcx, [rbp - 0x7d]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x79]
lea r8, [rbp - 0x39]
mov rbx, qword [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rbp - 0x69]
call fcn.1400f77d0
mov esi, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140115e5b
mov eax, r12d
jmp 0x140115e6c
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b2380
test eax, eax
js 0x140116197
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x140116197
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test esi, esi
jne 0x140115d21
mov rax, qword [rdi]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x140115ebf
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140115eb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc r14
cmp r14, 2
jge 0x140115ed4
jmp 0x140115ccb
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140115ed4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, r12
mov qword [rbp - 0x59], r12
mov r9d, dword [rbp + rsi*4 - 0x61]
or r9d, 0x20019
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 9]
mov rcx, 0xffffffff80000001
call fcn.1400f8f20
mov r14d, eax
call fcn.140013c54
test rax, rax
je 0x140116176
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov r15d, r12d
test r14d, r14d
jne 0x1401160a1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov r14d, 0x104
sub eax, r14d
or eax, ecx
jge 0x140115f59
mov edx, r14d
lea rcx, [rsp + 0x38]
call fcn.140014364
mov rbx, qword [rsp + 0x38]
mov r9d, r14d
mov r8, rbx
mov edx, r15d
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov r14d, eax
inc r15d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400b2380
test eax, eax
js 0x1401161ce
cmp eax, dword [rbx - 0xc]
jg 0x1401161ce
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], r12b
test r14d, r14d
jne 0x1401160a1
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
xor r8d, r8d
lea rdx, [rbp - 0x49]
lea rcx, [rsp + 0x38]
call fcn.14000ec6c
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1401161c3
mov rcx, qword [rax]
call fcn.1400b276c
test eax, eax
sete bl
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140115ff6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test bl, bl
jne 0x140116004
mov rbx, qword [rsp + 0x38]
jmp 0x140115f2f
mov dword [rbp - 0x71], 1
mov r8d, 0x104
mov dword [rbp - 0x75], r8d
mov rax, qword [rdi]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r8d
or ecx, edx
jge 0x140116035
mov edx, r8d
mov rcx, rdi
call fcn.140014364
mov rax, qword [rdi]
lea rcx, [rbp - 0x75]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
lea r8, [rbp - 0x39]
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov rcx, qword [rbp - 0x59]
call fcn.1400f77d0
mov r14d, eax
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14011606f
mov eax, r12d
jmp 0x140116080
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b2380
test eax, eax
js 0x1401161b8
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x1401161b8
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rdi]
mov byte [rcx + rax], r12b
test r14d, r14d
jne 0x140115f2f
mov rax, qword [rdi]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], r12d
mov eax, r13d
jne 0x1401160d4
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401160c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rsi
cmp rsi, 2
jge 0x1401160e9
jmp 0x140115ed7
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1401160e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
cmp dword [rax - 0x10], r12d
je 0x140116124
mov word [rbp - 0x29], 0x665c
mov word [rbp - 0x26], 0x6572
mov word [rbp - 0x23], 0x786f
mov dword [rbp - 0x20], 0x657865
mov byte [rbp - 0x21], reloc.WLDAP32.dll_Ordinal_46
mov byte [rbp - 0x24], 0x66
mov byte [rbp - 0x27], 0x69
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.14001381c
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, r13d
lock xadd dword [rdx + 0x10], ecx
add ecx, r13d
test ecx, ecx
jg 0x140116146
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140085010
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140014608
int3
mov ecx, 0x80004005
call fcn.140014608
int3
mov ecx, 0x80004005
call fcn.140014608
nop
mov ecx, 0x80070057
call fcn.140014608
int3
mov ecx, 0x80004005
call fcn.140014608
int3
mov ecx, 0x80070057
call fcn.140014608
nop
mov ecx, 0x80070057
call fcn.140014608
int3
mov ecx, 0x80004005
call fcn.140014608
int3
mov ecx, 0x80070057
call fcn.140014608
int3