Function at 0x5d18b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c6b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x746694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
call fcn.005d9040
cmp dword [eax + 0x988], 6
jae 0x5d19f1
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push 0x80
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00448c50
mov dword [ebp - 0x18], 0x74
mov ecx, 0x1d
mov dword [ebp - 0x14], 0x7f
mov esi, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 0x74], 0
mov dword [ebp - 0x28], eax
push dword [ebp - 0xb0]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push reloc.WS2_32.dll_bind
push eax
call fcn.005bf860
mov edx, dword [ebp - 0x44]
add esp, 0x10
cmp dword [eax + 0x10], 0
setne byte [ebp - 0xa1]
cmp edx, 0x10
jb 0x5d19a2
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d1998
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d1d9b
push edx
push ecx
call fcn.0065d157
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x5d1d7a
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d19e2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d1d9b
push edx
push ecx
call fcn.0065d157
add esp, 8
jmp 0x5d1d7a
push 0x7d0
push 0
mov byte [ebp - 0xa1], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0x3e8
call fcn.00663d02
add esp, 8
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push 0x60
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00448c50
mov dword [ebp - 0x18], 0x56
mov ecx, 0x15
mov dword [ebp - 0x14], 0x5f
mov esi, str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyFirewallRules
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [eax + 0x56], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005be920
mov edx, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x5d1abf
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d1ab5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d1da0
push edx
push ecx
call fcn.0065d157
add esp, 8
lea eax, [ebp - 0xbc]
push eax
push 0x20019
push 0
push dword [ebp - 0xac]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5d1d67
push 0x7d0
push eax
mov dword [ebp - 0xcc], 0x3e8
call fcn.00663d02
mov edi, eax
mov dword [ebp - 0xd0], edi
push dword [ebp - 0xb0]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.005c60a0
add esp, 0x10
push 4
push str.__i_
push 0
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.005a5ba0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.00448860
xor esi, esi
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb4]
push eax
push edi
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xb4], 0x3e8
push eax
push 0
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xac]
push esi
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x5d1d02
cmp dword [ebp - 0xc0], 1
jne 0x5d1d09
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005be990
add esp, 8
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x5d1be2
mov ecx, dword [eax]
mov dword [ebp - 0xc8], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
call fcn.00446f70
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
push 0x74748c
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x88]
call fcn.00447660
lea ecx, [ebp - 0x88]
mov byte [ebp - 0xa2], al
call fcn.00447080
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 6
cmp edx, 0x10
jb 0x5d1cef
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d1ce5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d1d9b
push edx
push ecx
call fcn.0065d157
add esp, 8
cmp byte [ebp - 0xa2], 0
je 0x5d1d09
mov al, 1
mov byte [ebp - 0xa1], al
jmp 0x5d1d0f
cmp eax, 0x103
je 0x5d1d18
mov al, byte [ebp - 0xa1]
inc esi
test al, al
je 0x5d1b72
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x5d1d48
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d1d3e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d1da5
push edx
push ecx
call fcn.0065d157
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test edi, edi
je 0x5d1d67
push edi
call fcn.00663ce7
add esp, 4
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x5d1d7a
push eax
call fcn.00663ce7
add esp, 4
mov al, byte [ebp - 0xa1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0065d16a
mov esp, ebp
pop ebp
ret
call fcn.00663c8b
call fcn.00663c8b
call fcn.00663c8b
int3