Function at 0x180005c70
Capabilities:
Delete registry key
Initialize winsock library

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x740]
sub rsp, 0x840
mov rax, qword [0x180019018]
xor rax, rsp
mov qword [rbp + 0x730], rax
xor r15d, r15d
mov r14d, edx
mov dword [rsp + 0x30], r15d
mov rdi, rcx
mov rcx, qword [section..data]
lea r12, section..data
cmp rcx, r12
je 0x180005cdd
test byte [rcx + 0x1c], 1
je 0x180005cdd
mov rcx, qword [rcx + 0x10]
mov edx, 0xb1
mov r9, rdi
mov dword [rsp + 0x20], r14d
call fcn.1800092e4
mov ecx, 0x101
lea rdx, [rsp + 0x50]
call qword [sym.imp.WSOCK32.dll_WSAStartup]
nop dword [rax + rax]
lea r13, [0x1800153c0]
test eax, eax
je 0x180005d56
mov ebx, 0x4c6
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180005d29
test byte [rcx + 0x1c], 2
je 0x180005d29
mov edx, 0xb8
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
mov r8, r13
call fcn.180002598
mov eax, ebx
mov rcx, qword [rbp + 0x730]
xor rcx, rsp
call fcn.180001570
mov rbx, qword [rsp + 0x890]
add rsp, 0x840
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.180008d7c
test eax, eax
jns 0x180005da0
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180005d8a
test byte [rcx + 0x1c], 2
je 0x180005d8a
mov rcx, qword [rcx + 0x10]
mov edx, 0xb2
mov r9d, eax
mov r8, r13
call fcn.180009188
mov ebx, 0x4c6
call qword [sym.imp.WSOCK32.dll_WSACleanup]
nop dword [rax + rax]
jmp 0x180005d03
movzx eax, word [rdi]
cmp ax, 0x5c
jne 0x180005e27
cmp word [rdi + 2], ax
jne 0x180005db4
mov esi, r15d
jmp 0x180005dda
mov rbx, rdi
movzx ecx, ax
call qword [sym.imp.msvcrt.dll_towupper]
nop dword [rax + rax]
mov word [rbx], ax
lea rbx, [rbx + 2]
movzx eax, word [rbx]
test ax, ax
jne 0x180005db7
mov esi, 1
lea r9, [rbp + 0x310]
mov r8, rdi
mov edx, esi
mov ecx, r14d
call fcn.18000b238
mov ebx, eax
mov eax, dword [rsp + 0x30]
test ebx, ebx
je 0x180005e2f
test eax, eax
je 0x180005e2c
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180005d8f
test byte [rcx + 0x1c], 2
je 0x180005d8f
mov rcx, qword [rcx + 0x10]
mov edx, 0xb3
mov r9d, ebx
mov r8, r13
call fcn.180002598
jmp 0x180005d8f
mov rbx, rdi
jmp 0x180005dd0
mov ebx, r15d
test eax, eax
je 0x180005e76
mov rdx, rdi
mov ecx, esi
call fcn.18000be84
mov ebx, eax
test eax, eax
je 0x180005e76
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180006012
test byte [rcx + 0x1c], 2
je 0x180006012
mov rcx, qword [rcx + 0x10]
mov edx, 0xb4
mov r9d, eax
mov r8, r13
call fcn.180002598
jmp 0x180006012
test esi, esi
je 0x180005fe5
lea rax, [rbp + 0x520]
mov dword [rsp + 0x38], 0x2080000
lea rdx, [rbp + 0x310]
mov qword [rsp + 0x40], rax
mov rcx, rdi
mov word [rbp + 0x728], r15w
call fcn.1800090ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop dword [rax + rax]
lea rdx, [rbp + 0xf0]
call fcn.18000e254
test eax, eax
je 0x180005ef5
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180006012
test byte [rcx + 0x1c], 2
je 0x180006012
mov rcx, qword [rcx + 0x10]
mov edx, 0xb5
mov r8, r13
call fcn.18000256c
jmp 0x180006012
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
nop dword [rax + rax]
test eax, eax
je 0x180006012
movzx eax, word [rdi]
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov word [rsp + 0x30], ax
mov word [rsp + 0x32], r15w
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
test eax, eax
js 0x180005fd2
lea rdx, str.Network_
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
test eax, eax
js 0x180005fd2
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
test eax, eax
js 0x180005fd2
lea rdx, str.Mount
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
test eax, eax
js 0x180005fd2
mov rdx, qword [rsp + 0x40]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [rax + rax]
test eax, eax
je 0x180005fd2
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180005fd2
test byte [rcx + 0x1c], 2
je 0x180005fd2
mov rcx, qword [rcx + 0x10]
mov edx, 0xb6
mov r8, r13
call fcn.18000256c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
jmp 0x180006012
mov edx, esi
jmp 0x180005ff9
mov rdx, rdi
xor ecx, ecx
call fcn.18000be84
test eax, eax
jne 0x18000600f
xor edx, edx
lea r9, [rbp + 0x310]
mov r8, rdi
mov ecx, r14d
call fcn.18000b238
test eax, eax
je 0x180005fe9
mov ebx, r15d
call qword [sym.imp.WSOCK32.dll_WSACleanup]
nop dword [rax + rax]
test ebx, ebx
jne 0x180005d03
mov rcx, qword [section..data]
cmp rcx, r12
je 0x180005d29
test byte [rcx + 0x1c], 1
je 0x180005d29
mov edx, 0xb7
xor r9d, r9d
jmp 0x180005d1d