Function at 0x14005bce0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x1400f1080]
xor rax, rsp
mov qword [rbp + 0x80], rax
movdqa xmm1, xmmword [0x1400dfd60]
mov r8b, listen
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov dl, 0xa
xor r13d, r13d
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x52], cl
xor r8b, cl
xor byte [rsp + 0x53], cl
xor r9d, r9d
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm0
mov byte [rsp + 0x60], dl
lea rdx, [rsp + 0x51]
mov byte [rsp + 0x61], r8b
xor r8d, r8d
xor al, cl
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x51], al
mov rcx, 0xffffffff80000001
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14005c44f
cmp dword [rsp + 0x78], 2
jne 0x14005c444
mov qword [rsp + 0x1c0], rbx
mov al, 7
xor al, 0x73
mov qword [rsp + 0x1c8], rsi
mov byte [rsp + 0x51], al
mov cl, reloc.WLDAP32.dll_Ordinal_26
xor cl, 0x73
mov qword [rsp + 0x1d0], rdi
mov dl, reloc.WLDAP32.dll_Ordinal_30
mov qword [rsp + 0x1a0], r12
xor dl, 0x73
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r8b, reloc.WLDAP32.dll_Ordinal_22
xor r8b, 0x73
mov byte [rsp + 0x53], dl
mov r9b, 1
mov byte [rsp + 0x54], r8b
xor r9b, 0x73
mov qword [rsp + 0x198], r14
lea rax, [0x1400f110c]
mov byte [rsp + 0x55], r9b
xor r10d, r10d
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov qword [rsp + 0x190], r15
xor r8d, r8d
mov dword [rsp + 0x70], 4
lea rdx, [rsp + 0x51]
mov byte [rsp + 0x50], reloc.WS2_32.dll_WSAStartup
mov byte [rsp + 0x56], r10b
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14005be7e
mov dword [0x1400f110c], 0x3f800000
mov al, 0x7e
mov dword [rsp + 0x70], 4
xor al, 0x1d
mov byte [rsp + 0x50], Ordinal_33
mov byte [rsp + 0x51], al
mov cl, WSAStartup
xor cl, 0x1d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dl, reloc.WS2_32.dll_WSAStartup
xor dl, 0x1d
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
mov r8b, 0x7b
mov byte [rsp + 0x53], dl
xor r8b, 0x1d
mov qword [rsp + 0x20], rax
mov r9b, reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x54], r8b
xor r9b, 0x1d
lea rdx, [rsp + 0x51]
mov r10b, 0x7a
mov byte [rsp + 0x55], r9b
mov r11b, WSASetLastError
xor r10b, 0x1d
xor r11b, 0x1d
mov byte [rsp + 0x56], r10b
xor ebx, ebx
mov byte [rsp + 0x57], r11b
xor r9d, r9d
mov byte [rsp + 0x58], bl
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005bf12
cmp dword [rsp + 0x74], ebx
setne al
jmp 0x14005bf14
xor al, al
mov byte [0x1400f1ee4], al
mov cl, Ordinal_26
movzx ebx, cl
mov dword [rsp + 0x70], 4
mov r10b, Ordinal_33
mov byte [rsp + 0x50], 0x7c
movzx edi, r10b
mov byte [rsp + 0x5b], r13b
xor cl, 0x7c
mov al, reloc.WS2_32.dll_recvfrom
xor al, 0x7c
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
mov dl, reloc.WS2_32.dll_select
mov byte [rsp + 0x51], al
xor dl, 0x7c
mov r8b, 9
mov byte [rsp + 0x53], dl
xor r8b, 0x7c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x51]
mov r9b, reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x54], r8b
xor r9b, 0x7c
lea rax, [rsp + 0x74]
mov r11b, reloc.WS2_32.dll_sendto
mov byte [rsp + 0x55], r9b
xor r10b, 0x7c
mov qword [rsp + 0x20], rax
xor r11b, 0x7c
mov byte [rsp + 0x56], r10b
mov sil, reloc.WS2_32.dll_socket
mov byte [rsp + 0x57], r11b
xor bl, 0x7c
xor dil, 0x7c
xor sil, 0x7c
mov byte [rsp + 0x58], bl
xor r9d, r9d
mov byte [rsp + 0x59], dil
xor r8d, r8d
mov byte [rsp + 0x5a], sil
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005bfd1
cmp dword [rsp + 0x74], r13d
setne al
jmp 0x14005bfd3
xor al, al
mov byte [reloc.WS2_32.dll_accept], al
mov r9b, 8
movzx r14d, r9b
mov dword [rsp + 0x70], 4
mov al, 1
mov byte [rsp + 0x50], 0x63
movzx r11d, al
mov byte [rsp + 0x5c], r13b
xor al, 0x63
xor r8b, r8b
mov byte [rsp + 0x51], al
xor r8b, 0x63
xor r9b, 0x63
mov byte [rsp + 0x54], r8b
mov cl, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x55], r9b
xor cl, 0x63
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dl, listen
xor dl, 0x63
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x74]
mov r10b, reloc.WLDAP32.dll_Ordinal_60
mov byte [rsp + 0x53], dl
xor r10b, 0x63
mov qword [rsp + 0x20], rax
xor r11b, 0x63
mov byte [rsp + 0x56], r10b
mov bl, reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x57], r11b
mov dil, 6
lea rdx, [rsp + 0x51]
mov sil, 2
xor bl, 0x63
xor dil, 0x63
mov byte [rsp + 0x58], bl
xor sil, 0x63
mov byte [rsp + 0x59], dil
xor r14b, 0x63
mov byte [rsp + 0x5a], sil
xor r9d, r9d
mov byte [rsp + 0x5b], r14b
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005c09c
cmp dword [rsp + 0x74], r13d
setne al
jmp 0x14005c09e
xor al, al
mov byte [0x1400f1e13], al
mov r9b, reloc.WLDAP32.dll_Ordinal_60
movzx r14d, r9b
mov dword [rsp + 0x70], 4
mov r11b, 0x24
mov byte [rsp + 0x50], 0x53
movzx r15d, r11b
xor r9b, 0x53
mov al, 0x30
mov byte [rsp + 0x55], r9b
xor al, 0x53
mov cl, 0x26
mov byte [rsp + 0x51], al
xor cl, 0x53
mov dl, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor dl, 0x53
mov qword [rsp + 0x28], rax
mov r8b, Ordinal_41
mov byte [rsp + 0x53], dl
xor r8b, 0x53
lea rax, [rsp + 0x74]
mov r10b, 0x3e
mov byte [rsp + 0x54], r8b
xor r10b, 0x53
mov qword [rsp + 0x20], rax
xor r11b, 0x53
mov byte [rsp + 0x56], r10b
mov bl, 0x3a
mov byte [rsp + 0x57], r11b
mov dil, 0x3d
lea rdx, [rsp + 0x51]
mov sil, gethostname
xor r12d, r12d
xor bl, 0x53
mov byte [rsp + 0x5d], r12b
xor dil, 0x53
mov byte [rsp + 0x58], bl
xor sil, 0x53
mov byte [rsp + 0x59], dil
xor r14b, 0x53
mov byte [rsp + 0x5a], sil
xor r15b, 0x53
mov byte [rsp + 0x5b], r14b
xor r9d, r9d
mov byte [rsp + 0x5c], r15b
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, qword [rsp + 0x190]
mov r14, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1a0]
test eax, eax
jne 0x14005c18e
cmp dword [rsp + 0x74], r13d
setne al
jmp 0x14005c190
xor al, al
xor edx, edx
mov byte [0x1400f1e12], al
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
mov al, 0x36
mov dword [rsp + 0x70], 0x100
movzx r10d, al
mov byte [rsp + 0x50], 0x41
xor al, 0x41
mov cl, Ordinal_41
mov byte [rsp + 0x51], al
xor cl, 0x41
mov dl, 0x2f
mov byte [rsp + 0x52], cl
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor dl, 0x41
mov qword [rsp + 0x28], rax
mov r8b, 0x25
mov byte [rsp + 0x53], dl
xor r8b, 0x41
lea rax, [rbp - 0x80]
mov r9b, reloc.WLDAP32.dll_Ordinal_46
mov byte [rsp + 0x54], r8b
xor r9b, 0x41
mov qword [rsp + 0x20], rax
xor r11d, r11d
mov byte [rsp + 0x55], r9b
xor r10b, 0x41
mov byte [rsp + 0x57], r11b
xor r9d, r9d
mov byte [rsp + 0x56], r10b
xor r8d, r8d
lea rdx, [rsp + 0x51]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14005c245
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x14005c233
lea rdx, [rbp - 0x80]
jmp 0x14005c2ce
mov al, 0x6d
mov byte [rsp + 0x50], reloc.WLDAP32.dll_Ordinal_32
xor al, 0x20
mov r8b, 0x45
xor r8b, 0x20
mov byte [rsp + 0x51], al
xor esi, esi
mov byte [rsp + 0x54], r8b
mov cl, 0x49
mov byte [rsp + 0x5a], sil
xor cl, 0x20
lea rax, [rsp + 0x51]
mov dl, Ordinal_79
mov byte [rsp + 0x52], cl
xor dl, 0x20
mov r9b, 0x43
xor r9b, 0x20
mov byte [rsp + 0x53], dl
mov r10b, 0x52
mov byte [rsp + 0x55], r9b
xor r10b, 0x20
mov r11b, 0x41
xor r11b, 0x20
mov byte [rsp + 0x56], r10b
mov bl, 0x46
mov byte [rsp + 0x57], r11b
xor bl, 0x20
mov dil, 0x54
xor dil, 0x20
mov byte [rsp + 0x58], bl
mov byte [rsp + 0x59], dil
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x14005c2c0
lea rdx, [rsp + 0x51]
lea rcx, [0x1400f1e58]
call fcn.140060420
movdqa xmm1, xmmword [0x1400dfdc0]
mov dl, reloc.WS2_32.dll_listen
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r9d, r9d
xor r8d, r8d
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm0
mov byte [rsp + 0x60], dl
lea rdx, [rsp + 0x51]
mov dword [rsp + 0x70], 4
xor al, cl
mov byte [rsp + 0x61], r13b
mov rcx, qword [rsp + 0x68]
mov byte [rsp + 0x51], al
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [0x1400f1e00]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1c0]
test eax, eax
je 0x14005c39b
mov dword [0x1400f1e00], r13d
movdqa xmm1, xmmword [0x1400dfde0]
mov dl, Ordinal_32
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r9d, r9d
xor r8d, r8d
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm0
mov byte [rsp + 0x60], dl
lea rdx, [rsp + 0x51]
mov dword [rsp + 0x70], 4
xor al, cl
mov byte [rsp + 0x61], r13b
mov rcx, qword [rsp + 0x68]
mov byte [rsp + 0x51], al
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [0x1400f1e04]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14005c444
mov dword [0x1400f1e04], r13d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400c1970
add rsp, 0x1a8
pop r13
pop rbp
ret