Function at 0x14010cb60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x230
mov qword [rbp - 0x208], rbx
mov qword [rbp - 0x200], rsi
mov qword [rbp - 0x1f8], rdi
mov qword [rbp - 0x1f0], r12
mov qword [rbp - 0x1e8], r13
mov r13, rcx
mov rbx, rdx
mov rsi, r8
mov rdi, r9
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov dword [rbp - 0x1e0], 0xffffffff
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0xc0], rax
mov qword [rbp - 0xb8], rdx
lea rdx, [rbp - 0xc0]
lea rcx, [rbp - 0x1d0]
call fcn.1400c90d0
mov edx, 0x100
lea rcx, [0x1401bddf0]
sub rsp, 0x20
call fcn.1400aac10
add rsp, 0x20
mov qword [rbp - 0xb0], rax
mov qword [rbp - 0xa8], rdx
mov rcx, qword [rbp - 0xb0]
add rcx, rcx
sub rsp, 0x20
call fcn.1400dc370
add rsp, 0x20
mov dword [rbp - 0xa0], eax
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x1e0]
mov rdx, qword [rbp - 0xa8]
lea r9, [rbp - 0xa0]
push r9
push rdx
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
cmp esi, 0xea
jne 0x14010ccdb
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.1400c9940
add rsp, 0x20
lea rcx, [rbp - 0x1d0]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov r12, rax
lea r8, [rbp - 0x1e0]
mov r9, qword [rbp - 0xa8]
lea rdx, [rbp - 0xa0]
push rdx
push r9
mov r9, r8
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov esi, eax
jmp 0x14010ccfc
test esi, esi
jne 0x14010ccfc
lea rdx, [rbp - 0xb0]
mov ecx, dword [rbp - 0xa0]
shr rcx, 1
sub rsp, 0x20
call fcn.1400c9940
add rsp, 0x20
mov r9d, esi
lea r10, [0x14010ca60]
mov qword [rbp - 0x88], r10
xor r8d, r8d
mov qword [rbp - 0x90], r8
lea r8, [rbp - 0x90]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x80]
mov ecx, 0x261
sub rsp, 0x20
call fcn.14010b180
add rsp, 0x20
cmp dword [rbp - 0x1e0], 7
sete dl
lea r8, [0x14010cf20]
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x70], 0
lea rcx, [rbp - 0x70]
sub rsp, 0x20
call fcn.140016b90
add rsp, 0x20
cmp dword [rbp - 0x1e0], r13d
sete dl
lea r9, [0x14010cf90]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x60]
sub rsp, 0x20
call fcn.140016b90
add rsp, 0x20
lea rdx, [rbp - 0xb0]
mov rcx, qword [rbp - 0xb0]
dec rcx
sub rsp, 0x20
call fcn.1400c9940
add rsp, 0x20
cmp qword [rbp - 0xb0], 0
je 0x14010ce0b
mov rdi, qword [rbp - 0xb0]
mov r8, qword [rbp - 0xb0]
mov r9, qword [rbp - 0xa8]
lea r10, [r9 + r8*2]
cmp word [r10 - 2], 0
jne 0x14010ce0b
lea rdx, [rbp - 0xb0]
mov rax, qword [rbp - 0xb0]
lea rcx, [rax - 1]
sub rsp, 0x20
call fcn.1400c9940
add rsp, 0x20
mov r8, qword [rbp - 0xb0]
mov qword [rbp - 0x40], r8
mov r9, qword [rbp - 0xa8]
mov qword [rbp - 0x38], r9
lea rdx, [rbp - 0x40]
lea r10, [0x1401c2d60]
mov qword [rbp - 0x28], r10
mov qword [rbp - 0x30], 1
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140115b30
add rsp, 0x20
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rdx, rbx
mov rcx, qword [rbp - 0x50]
sub rsp, 0x20
call fcn.140010740
add rsp, 0x20
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
xor esi, esi
cmp qword [rbp - 0x20], rsi
je 0x14010cec6
mov rdi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x48]
mov r12, rdi
mov r13, rsi
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400c9910
add rsp, 0x20
mov qword [rdi], rax
mov qword [rdi + 8], rdx
mov r8d, reloc.WS2_32.dll_recv
add rdi, r8
add rbx, r8
inc rsi
cmp rsi, qword [rbp - 0x20]
jb 0x14010ce84
sub rsp, 8
call fcn.14010ced5
add rsp, 8
jmp 0x14010ceea
mov rbx, qword [rbp - 0x208]
mov rsi, qword [rbp - 0x200]
mov rdi, qword [rbp - 0x1f8]
mov r12, qword [rbp - 0x1f0]
mov r13, qword [rbp - 0x1e8]
mov rsp, rbp
pop rbp
ret