Function at 0x14005ae50
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov qword [rsp + 0x50], rsp
mov r9d, ecx
lea rdi, [rsp + 0x58]
xor eax, eax
mov ecx, Ordinal_27
rep stosb byte [rdi], al
mov dword [rsp + 0x58], r9d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov edx, 0xffffffff
mov rcx, qword [0x140308c18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14005aea6
cmp eax, 0x80
je 0x14005b106
mov al, 1
add rsp, 0x78
pop rdi
pop rbx
ret
mov rdx, qword [0x140308c30]
mov rcx, qword [rdx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005aece
lea rdx, str.Client_ID
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rdx, qword [0x140308c30]
mov rcx, qword [rdx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005aee8
lea rdx, str.Address
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x90], eax
mov rdx, qword [0x140308c30]
mov rcx, qword [rdx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005af3b
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Client_ID
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [0x140308c30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov rcx, qword [rdx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005af81
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, ntohs
xor r8d, r8d
lea rdx, str.Address
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [0x140308c30]
mov dword [rsp + 0x98], 0x574f524b
mov rcx, qword [rdx]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005afc4
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Status
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
xor ebx, ebx
nop
mov rcx, qword [0x140308c30]
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov r9d, Ordinal_27
lea r8, str.Status
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x14005b02a
cmp dword [rsp + 0xa8], 0x444f4e45
je 0x14005b049
mov rax, qword [0x140308c28]
cmp byte [rax], 1
jne 0x14005b049
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rdi
cmp rax, 0x7d0
jae 0x14005b049
jmp 0x14005afd0
mov dword [rsp + 0x40], 0x41435456
mov rax, qword [0x140308c30]
mov rcx, qword [rax]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b08e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Status
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov rcx, qword [0x140308c18]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x14005ae9d
mov rdi, qword [0x140308c30]
mov rcx, qword [rdi]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b0cb
lea rdx, str.Client_ID
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rdi, qword [0x140308c30]
mov rcx, qword [rdi]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b0ec
lea rdx, str.Address
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rdi, qword [0x140308c30]
mov rcx, qword [rdi]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14005b106
lea rdx, str.Status
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor al, al
add rsp, 0x78
pop rdi
pop rbx
ret