Function at 0x14005c320
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], 0
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x39], 0
mov dword [rbp - 0x41], 0x40
mov dword [rbp - 0x3d], 1
movdqa xmm1, xmmword [0x1400d07c0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x1400d0b90]
movdqu xmmword [rbp - 0x79], xmm2
mov cl, listen
mov dl, 0xb
movzx r8d, dl
mov r9b, Ordinal_30
mov r11b, reloc.WS2_32.dll_socket
mov bl, reloc.WS2_32.dll_listen
mov dil, 0x2f
movzx esi, r9b
movzx r14d, dl
mov r15b, 0xa
mov r12b, reloc.WS2_32.dll_recv
mov r13b, reloc.WLDAP32.dll_Ordinal_22
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r10b
xor byte [rsp + 0x33], r10b
xor byte [rsp + 0x34], r10b
xor byte [rsp + 0x35], r10b
xor byte [rsp + 0x36], r10b
xor byte [rsp + 0x37], r10b
xor byte [rsp + 0x38], r10b
xor byte [rbp - 0x80], r10b
xor byte [rbp - 0x7f], r10b
xor byte [rbp - 0x7e], r10b
xor byte [rbp - 0x7d], r10b
xor byte [rbp - 0x7c], r10b
xor byte [rbp - 0x7b], r10b
xor byte [rbp - 0x7a], r10b
movd eax, xmm2
xor al, r10b
mov byte [rbp - 0x79], al
xor byte [rbp - 0x78], r10b
xor byte [rbp - 0x77], r10b
xor byte [rbp - 0x76], r10b
xor byte [rbp - 0x75], r10b
xor byte [rbp - 0x74], r10b
xor byte [rbp - 0x73], r10b
xor byte [rbp - 0x72], r10b
xor byte [rbp - 0x71], r10b
xor byte [rbp - 0x70], r10b
xor byte [rbp - 0x6f], r10b
xor byte [rbp - 0x6e], r10b
xor byte [rbp - 0x6d], r10b
xor byte [rbp - 0x6c], r10b
xor byte [rbp - 0x6b], r10b
xor byte [rbp - 0x6a], r10b
xor cl, r10b
mov byte [rbp - 0x69], cl
xor dl, r10b
mov byte [rbp - 0x68], dl
xor r8b, r10b
mov byte [rbp - 0x67], r8b
xor r9b, r10b
mov byte [rbp - 0x66], r9b
xor r11b, r10b
mov byte [rbp - 0x65], r11b
xor bl, r10b
mov byte [rbp - 0x64], bl
xor dil, r10b
mov byte [rbp - 0x63], dil
xor sil, r10b
mov byte [rbp - 0x62], sil
xor r14b, r10b
mov byte [rbp - 0x61], r14b
xor r15b, r10b
mov byte [rbp - 0x60], r15b
xor r12b, r10b
mov byte [rbp - 0x5f], r12b
xor r13b, r10b
mov byte [rbp - 0x5e], r13b
mov al, reloc.WS2_32.dll_socket
xor al, r10b
mov byte [rbp - 0x5d], al
mov byte [rbp - 0x5c], 0
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0x31]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
mov byte [rbp - 0x59], Ordinal_26
mov cl, 0x49
mov dl, 0x6b
mov r8b, 0x76
mov r9b, 0x7d
mov r10b, 0x6c
mov r11b, 0x7a
mov bl, 0x6d
mov dil, 0x57
mov sil, 0x78
mov r14b, reloc.WS2_32.dll_WSACleanup
mov r15b, 0x7c
xor eax, eax
xor cl, 0x19
mov byte [rbp - 0x58], cl
xor dl, 0x19
mov byte [rbp - 0x57], dl
xor r8b, 0x19
mov byte [rbp - 0x56], r8b
xor r9b, 0x19
mov byte [rbp - 0x55], r9b
xor r10b, 0x19
mov byte [rbp - 0x54], r10b
xor r11b, 0x19
mov byte [rbp - 0x53], r11b
xor bl, 0x19
mov byte [rbp - 0x52], bl
xor dil, 0x19
mov byte [rbp - 0x51], dil
xor sil, 0x19
mov byte [rbp - 0x50], sil
xor r14b, 0x19
mov byte [rbp - 0x4f], r14b
xor r15b, 0x19
mov byte [rbp - 0x4e], r15b
mov byte [rbp - 0x4d], al
lea rax, [rbp - 0x41]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x3d]
xor r8d, r8d
lea rdx, [rbp - 0x58]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test r12d, r12d
jne 0x14005c5d8
test eax, eax
jne 0x14005c5d8
lea rax, [rbp - 0x19]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005c590
mov rax, qword [rbp - 0x21]
cmp rbx, rax
ja 0x14005c5c8
lea rdi, [rbp - 0x39]
cmp rax, 0x10
cmovae rdi, qword [rbp - 0x39]
mov qword [rbp - 0x29], rbx
mov r8, rbx
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.1400b9b2c
mov byte [rdi + rbx], 0
jmp 0x14005c5d8
lea r9, [rbp - 0x19]
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140007180
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [0x1401d5178]
lea rcx, [rdi + 0x298]
lea rax, [rbp - 0x39]
cmp rcx, rax
je 0x14005c647
mov rbx, qword [rbp - 0x29]
lea r9, [rbp - 0x39]
cmp qword [rbp - 0x21], 0x10
cmovae r9, qword [rbp - 0x39]
mov rax, qword [rcx + 0x18]
cmp rbx, rax
ja 0x14005c638
mov rsi, rcx
cmp rax, 0x10
jb 0x14005c620
mov rsi, qword [rcx]
mov qword [rcx + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.1400b9b2c
mov byte [rsi + rbx], 0
jmp 0x14005c647
mov rdx, rbx
call fcn.140007180
mov rdi, qword [0x1401d5178]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 9], xmm1
movups xmmword [rbp + 7], xmm1
movups xmmword [rbp + 0x17], xmm1
xor eax, eax
mov dword [rbp - 0x41], eax
mov dword [rbp - 0x3d], eax
mov qword [rbp - 0x49], rax
cmp qword [rdi + 0x2a8], 1
seta al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400b8870
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret