Function at 0x14005d780
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov qword [rax - 0x70], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x60], esi
mov dword [rax + 0x18], esi
mov dword [rax + 0x20], esi
mov qword [rsp + 0x50], rsi
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARESiemensSWSCommonDataHistory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005d867
mov rax, qword [0x140122018]
lea rdx, str.Found_an_old_history_in_the_registry_
mov rcx, qword [rax + 0x1a8]
call fcn.14004c390
mov rcx, rbx
call fcn.14005d390
mov rcx, rbx
call fcn.14005de40
mov qword [rsp + 0xf8], rsi
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARESiemensSWSCommonData
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdx, str.History
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARESiemensSWSCommonDataFavorites
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14005d8be
mov dword [rsp + 0x68], 0xa
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x68]
call fcn.1400bb178
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x108]
xor r8d, r8d
lea rdx, str.Favorites
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14005d907
mov dword [rsp + 0x64], reloc.OLEAUT32.dll_SafeArrayLock
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x64]
call fcn.1400bb178
cmp dword [rsp + 0x108], 3
je 0x14005d92a
mov dword [rsp + 0x70], reloc.WS2_32.dll_setsockopt
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x70]
call fcn.1400bb178
mov edi, dword [rsp + 0x60]
mov ecx, edi
call qword [sym.imp.MSVCR110.dll_malloc]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x14005d945
call sub.mfc110u.dll_Ordinal_2292
mov dword [rsp + 0x100], edi
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Favorites
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14005d993
mov dword [rsp + 0x6c], reloc.WS2_32.dll_shutdown
lea rdx, [0x14011cbb0]
lea rcx, [rsp + 0x6c]
call fcn.1400bb178
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x80]
call fcn.1400abf20
nop
mov r8d, dword [rsp + 0x100]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.1400acc00
mov dword [rsp + 0xa8], esi
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.14005cfe0
lea rcx, [rsp + 0x80]
call fcn.1400acc60
mov rcx, rax
call qword [sym.imp.MSVCR110.dll_free]
mov dword [rsp + 0xf8], esi
lea rcx, [rsp + 0x80]
call fcn.1400abfb0
nop
jmp 0x14005da13
jmp 0x14005da1d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
mov eax, dword [rsp + 0xf8]
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret