Function at 0x5d6500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x693498
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x74e694]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb0], eax
call fcn.005df4c0
cmp dword [eax + 0x970], 6
jae 0x5d6641
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push 0x80
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00448c50
mov dword [ebp - 0x18], 0x74
mov ecx, 0x1d
mov dword [ebp - 0x14], 0x7f
mov esi, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 0x74], 0
mov dword [ebp - 0x28], eax
push dword [ebp - 0xb0]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x58]
push reloc.WS2_32.dll_bind
push eax
call fcn.005c4400
mov edx, dword [ebp - 0x44]
add esp, 0x10
cmp dword [eax + 0x10], 0
setne byte [ebp - 0xa1]
cmp edx, 0x10
jb 0x5d65f2
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d65e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d69eb
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], 0
cmp edx, 0x10
jb 0x5d69ca
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d6632
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d69eb
push edx
push ecx
call fcn.00663ac7
add esp, 8
jmp 0x5d69ca
push 0x7d0
push 0
mov byte [ebp - 0xa1], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0x3e8
call fcn.0066a672
add esp, 8
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push 0x60
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.00448c50
mov dword [ebp - 0x18], 0x56
mov ecx, 0x15
mov dword [ebp - 0x14], 0x5f
mov esi, str.SYSTEMCurrentControlSet_servicesSharedAccessParametersFirewallPolicyFirewallRules
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [eax + 0x56], 0
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.005c34c0
mov edx, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
cmp edx, 0x10
jb 0x5d670f
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d6705
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d69f0
push edx
push ecx
call fcn.00663ac7
add esp, 8
lea eax, [ebp - 0xbc]
push eax
push 0x20019
push 0
push dword [ebp - 0xac]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5d69b7
push 0x7d0
push eax
mov dword [ebp - 0xcc], 0x3e8
call fcn.0066a672
mov edi, eax
mov dword [ebp - 0xd0], edi
push dword [ebp - 0xb0]
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
call fcn.005caba0
add esp, 0x10
push 4
push 0x6a52d0
push 0
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.005a5ba0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x40], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x30], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.00448860
xor esi, esi
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb4]
push eax
push edi
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xb4], 0x3e8
push eax
push 0
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xac]
push esi
push dword [ebp - 0xbc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x5d6952
cmp dword [ebp - 0xc0], 1
jne 0x5d6959
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005c3530
add esp, 8
cmp dword [eax + 0x14], 0x10
mov ecx, eax
jb 0x5d6832
mov ecx, dword [eax]
mov dword [ebp - 0xc8], ecx
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
call fcn.00446f70
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
push 0x74f48c
lea eax, [ebp - 0xc8]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x88]
call fcn.00447660
lea ecx, [ebp - 0x88]
mov byte [ebp - 0xa2], al
call fcn.00447080
mov edx, dword [ebp - 0x8c]
mov byte [ebp - 4], 6
cmp edx, 0x10
jb 0x5d693f
mov ecx, dword [ebp - 0xa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d6935
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d69eb
push edx
push ecx
call fcn.00663ac7
add esp, 8
cmp byte [ebp - 0xa2], 0
je 0x5d6959
mov al, 1
mov byte [ebp - 0xa1], al
jmp 0x5d695f
cmp eax, 0x103
je 0x5d6968
mov al, byte [ebp - 0xa1]
inc esi
test al, al
je 0x5d67c2
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x5d6998
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x5d698e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x5d69f5
push edx
push ecx
call fcn.00663ac7
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
test edi, edi
je 0x5d69b7
push edi
call fcn.0066a657
add esp, 4
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x5d69ca
push eax
call fcn.0066a657
add esp, 4
mov al, byte [ebp - 0xa1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00663ada
mov esp, ebp
pop ebp
ret
call fcn.0066a5fb
call fcn.0066a5fb
call fcn.0066a5fb
int3