Function at 0x14002ca10
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp + 7], 0xfffffffffffffffe
cmp byte [0x1401c1c21], 0
jne 0x14002ca46
movzx eax, byte [0x1401c6d87]
jmp 0x14002d0cd
mov byte [0x1401c1c21], 0
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x39], rbx
lea r14, str.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0000000
mov r13d, 1
xor r12d, r12d
test r14, 0xffffffffffff0000
jne 0x14002caa8
movzx edi, r14w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x14002cb14
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.1400026e0
mov rbx, qword [rbp - 0x39]
jmp 0x14002cb14
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x27
or eax, ecx
jge 0x14002cad6
mov edx, 0x27
lea rcx, [rbp - 0x39]
call fcn.1400024e0
mov rbx, qword [rbp - 0x39]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x4e
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14002caf6
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x14002cafe
mov r8, r14
call fcn.1400cd294
cmp dword [rbx - 0xc], 0x27
jl 0x14002d0c2
mov dword [rbx - 0x10], 0x27
mov word [rbx + 0x4e], r12w
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x21], rdi
lea r15, str.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
test r15, 0xffffffffffff0000
jne 0x14002cb66
movzx esi, r15w
mov ecx, esi
call fcn.1400019e0
test rax, rax
je 0x14002cbd3
mov r8d, esi
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.1400026e0
mov rdi, qword [rbp - 0x21]
jmp 0x14002cbd3
mov r14d, dword [rdi - 0x10]
mov rsi, r15
sub rsi, rdi
sar rsi, 1
mov ecx, r13d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x20
or eax, ecx
jge 0x14002cb95
mov edx, 0x20
lea rcx, [rbp - 0x21]
call fcn.1400024e0
mov rdi, qword [rbp - 0x21]
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x40
mov rcx, rdi
add rdx, rdx
cmp rsi, r14
ja 0x14002cbb5
lea r8, [rdi + rsi*2]
call fcn.1400cd0d4
jmp 0x14002cbbd
mov r8, r15
call fcn.1400cd294
cmp dword [rdi - 0xc], 0x20
jl 0x14002d0b7
mov dword [rdi - 0x10], 0x20
mov word [rdi + 0x40], r12w
mov r8d, dword [rbx - 0x10]
sub r8d, dword [rdi - 0x10]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x39]
call fcn.14001b4b0
nop
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rax - 0x10]
test ecx, ecx
je 0x14002cd9a
js 0x14002cd8f
cmp word [rax], 0x30
jne 0x14002cd9a
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x7f]
call fcn.14001b4b0
nop
mov r14, qword [rax]
lea rdx, [r14 - 0x18]
mov rcx, qword [rbp + 0x7f]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x14002cd42
cmp dword [rbx + 0x10], 0
jl 0x14002cc6c
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x14002cc6c
mov rcx, rdx
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002cc5f
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x7f], rax
jmp 0x14002cd42
movsxd rdi, dword [r14 - 0x10]
test edi, edi
jne 0x14002ccc8
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14002cd42
cmp dword [rbx + 0x10], 0
jge 0x14002cca2
cmp dword [rcx - 0xc], 0
jl 0x14002cd63
mov dword [rcx - 0x10], r12d
mov rax, qword [rbp + 0x7f]
mov word [rax], r12w
jmp 0x14002cd42
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002ccb5
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
jmp 0x14002cd42
test r14, r14
je 0x14002cd84
mov r12d, dword [rcx - 0x10]
mov rsi, r14
sub rsi, rcx
sar rsi, 1
test edi, edi
js 0x14002cd79
mov edx, r13d
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x14002cd04
mov edx, edi
lea rcx, [rbp + 0x7f]
call fcn.1400024e0
mov rcx, qword [rbp + 0x7f]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r12
ja 0x14002cd22
lea r8, [rcx + rsi*2]
call fcn.1400cd0d4
jmp 0x14002cd2a
mov r8, r14
call fcn.1400cd294
mov rax, qword [rbp + 0x7f]
cmp edi, dword [rax - 0xc]
jg 0x14002cd6e
mov dword [rax - 0x10], edi
mov rax, qword [rbp + 0x7f]
xor r12d, r12d
mov word [rbx + rax], r12w
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002cbe9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002cbe9
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [0x1401c7f40]
test rcx, rcx
je 0x14002cdac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x31], rbx
lea r14, [0x14014c6e8]
test r14, 0xffffffffffff0000
jne 0x14002cdf6
movzx ebx, r14w
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002ce62
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.1400026e0
jmp 0x14002ce62
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x15
or eax, ecx
jge 0x14002ce24
mov edx, 0x15
lea rcx, [rbp - 0x31]
call fcn.1400024e0
mov rbx, qword [rbp - 0x31]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0x2a
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14002ce44
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x14002ce4c
mov r8, r14
call fcn.1400cd294
cmp dword [rbx - 0xc], 0x15
jl 0x14002d0ac
mov dword [rbx - 0x10], 0x15
mov word [rbx + 0x2a], r12w
lea r8, str.sionsProxySettings_
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x11]
call fcn.14001b610
nop
lea r8, [rbp + 0x7f]
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14000f540
nop
lea rcx, [0x1401c7f40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne bl
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002cecb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002cee4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002cefc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
jne 0x14002d05a
mov dword [rbp + 0x77], r12d
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
lea r14, str.UseLoc
test r14, 0xffffffffffff0000
jne 0x14002cf5d
movzx ebx, r14w
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002cfc8
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400026e0
jmp 0x14002cfc8
mov esi, dword [rbx - 0x10]
mov rdi, r14
sub rdi, rbx
sar rdi, 1
sub r13d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 6
or eax, r13d
jge 0x14002cf8a
mov edx, 6
lea rcx, [rbp - 0x29]
call fcn.1400024e0
mov rbx, qword [rbp - 0x29]
movsxd rdx, dword [rbx - 0xc]
mov r9d, 0xc
mov rcx, rbx
add rdx, rdx
cmp rdi, rsi
ja 0x14002cfaa
lea r8, [rbx + rdi*2]
call fcn.1400cd0d4
jmp 0x14002cfb2
mov r8, r14
call fcn.1400cd294
cmp dword [rbx - 0xc], 6
jl 0x14002d04f
mov dword [rbx - 0x10], 6
mov word [rbx + 0xc], r12w
lea r8, [0x14014c718]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.14001b610
nop
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x77]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [0x1401c7f40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002d024
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002d03c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
jne 0x14002d05a
cmp dword [rbp + 0x67], 0
setne bl
mov byte [0x1401c6d87], bl
jmp 0x14002d05c
mov ecx, 0x80070057
call fcn.140001920
nop
xor bl, bl
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002d075
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002d08e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x39]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002d0a7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
jmp 0x14002d0cd
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
nop
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret