Function at 0x1400f24a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp + 7], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [rcx + 0x98]
mov qword [rbp + 0x7f], rax
lea r13, [rax + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jle 0x1400f24ff
cmp byte [rsi + 0x90], 0
je 0x1400f2a67
mov byte [rsi + 0x90], 0
xor r12d, r12d
mov r14d, r12d
call fcn.1400f2b20
mov ebx, eax
xor ecx, ecx
call fcn.1400f4570
mov r15, rax
test rax, rax
jne 0x1400f2541
lea ecx, [rax + 0x48]
call fcn.1402bcb4c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f2539
mov rcx, rax
call fcn.14020eac0
mov r14, rax
jmp 0x1400f253c
mov r14, r12
jmp 0x1400f2a1c
lea rdi, [0x14034d1a0]
test ebx, ebx
jne 0x1400f2572
lea ecx, [rbx + 0x48]
call fcn.1402bcb4c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f256a
mov rcx, rax
call fcn.14020eac0
mov r14, rax
jmp 0x1400f256d
mov r14, r12
jmp 0x1400f266f
cmp ebx, 1
je 0x1400f266f
cmp ebx, 2
jne 0x1400f258d
call fcn.14020edf0
mov r14, rax
jmp 0x1400f266f
cmp ebx, 3
jne 0x1400f25d0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r12
lea r8, [rbp - 0x39]
lea rdx, str.ProxyPAC
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1400f25bd
lea rcx, [rbp - 0x39]
call fcn.14020ee50
mov r14, rax
cmp dword [rbp - 0x31], 0
jle 0x1400f266f
mov rcx, qword [rbp - 0x39]
jmp 0x1400f266a
cmp ebx, 4
jne 0x1400f266f
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
lea rdx, str.ProxyServer
mov rcx, rax
call fcn.1400d9fd0
test al, al
je 0x1400f2660
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], ebx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyPort
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f2660
lea ecx, [rbx + 0x48]
call fcn.1402bcb4c
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x1400f265d
mov r8d, dword [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.14020eba0
mov r14, rax
jmp 0x1400f2660
mov r14, r12
cmp dword [rbp - 0x21], 0
jle 0x1400f266f
mov rcx, qword [rbp - 0x29]
call fcn.1402bd0e0
xor dil, dil
lea rax, [0x14034d1a0]
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x71], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
test r14, r14
je 0x1400f29ea
cmp dword [rsi + 0xe4], 0
jle 0x1400f287e
lea rbx, [rsi + 0xd8]
mov r8d, 1
lea rdx, [0x140352a3c]
mov rcx, rbx
call fcn.140205020
test al, al
je 0x1400f27cd
mov r8d, 1
lea rdx, [0x140352a38]
mov rcx, rbx
call fcn.140202750
test al, al
je 0x1400f27cd
mov r9d, dword [rsi + 0xe4]
add r9d, 0xfffffffe
mov r8d, 1
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.140204ad0
nop
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x19], r12
xor r12d, r12d
mov dword [rbp - 0x11], r12d
mov qword [rbp - 9], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 0x69]
call fcn.1400ebf70
test al, al
jne 0x1400f273f
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402bd818
jmp 0x1400f279f
lea rax, [0x14034d1a0]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r12
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.1400f2f30
test al, al
je 0x1400f2782
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.1402046f0
test al, al
je 0x1400f278f
mov dil, 1
jmp 0x1400f278f
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402bd818
nop
cmp dword [rbp - 0x51], 0
jle 0x1400f279f
mov rcx, qword [rbp - 0x59]
call fcn.1402bd0e0
nop
mov r8, qword [rbp - 9]
test r8, r8
je 0x1400f27b5
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rbp - 0x61], 0
jle 0x1400f290c
mov rcx, qword [rbp - 0x69]
call fcn.1402bd0e0
jmp 0x1400f290c
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
mov rcx, rbx
call fcn.1402046f0
test al, al
je 0x1400f29ea
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x59], r12
xor edi, edi
mov dword [rbp - 0x51], edi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x41], rax
mov eax, dword [rbx + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rsi + 0xc8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x20]
test al, al
je 0x1400f285c
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400d8290
mov rdx, qword [rbp - 0x69]
lea rcx, str.__ls__r_n
call fcn.1402bd818
cmp dword [rbp - 0x61], edi
jle 0x1400f285c
mov rcx, qword [rbp - 0x69]
call fcn.1402bd0e0
nop
mov qword [rbp - 0x59], r12
mov r8, qword [rbp - 0x49]
test r8, r8
je 0x1400f2917
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400f2917
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyAuthentication
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f29ea
cmp dword [rbp + 0x67], ebx
setne dil
test dil, dil
je 0x1400f29ea
lea r8, [rbp - 0x79]
lea rdx, str.ProxyUsername
mov rcx, r15
call fcn.1400d9fd0
test al, al
je 0x1400f29ea
lea r8, [rsp + 0x30]
lea rdx, str.ProxyPassword
mov rcx, rsi
call fcn.1400f2c40
test al, al
je 0x1400f29ea
test dil, dil
je 0x1400f29ea
xor edi, edi
mov ecx, 0x38
call fcn.1402bcb4c
mov r12, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f29db
lea rax, vtable.Core::Net::NetworkCredential.0
mov qword [r12], rax
lea rax, [0x14034d1a0]
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], rax
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], rax
xor eax, eax
mov qword [r12 + 0x30], rax
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x6d]
mov eax, dword [r12 + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x79]
mov rcx, qword [r12 + 0x18]
call fcn.1402c06dc
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.140203bb0
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x7d]
mov eax, dword [r12 + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [r12 + 0x28]
call fcn.1402c06dc
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.140203bb0
nop
jmp 0x1400f29de
mov r12, rdi
mov rax, qword [r14]
mov rdx, r12
mov rcx, r14
call qword [rax + 0x30]
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
cmp dword [rsp + 0x38], 0
jle 0x1400f2a0a
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x71], 0
jle 0x1400f2a19
mov rcx, qword [rbp - 0x79]
call fcn.1402bd0e0
xor r12d, r12d
mov ecx, 0x18
call fcn.1402bcb4c
mov rcx, rax
mov qword [rax + 0x10], r14
cmp dword [rsi + 0x88], 0
jne 0x1400f2a4a
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rsi + 0x78], rax
mov qword [rsi + 0x80], rax
jmp 0x1400f2a61
mov rax, qword [rsi + 0x78]
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov rax, qword [rsi + 0x78]
mov qword [rax + 8], rcx
mov qword [rsi + 0x78], rcx
inc dword [rsi + 0x88]
mov rax, qword [rsi + 0x78]
mov rbx, qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret