Function at 0x1400f0ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp + 7], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [rcx + 0x90]
mov qword [rbp + 0x7f], rax
lea r13, [rax + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jle 0x1400f0f1f
cmp byte [rsi + 0x88], 0
je 0x1400f1484
mov byte [rsi + 0x88], 0
xor r12d, r12d
mov r14d, r12d
call fcn.1400f1540
mov ebx, eax
xor ecx, ecx
call fcn.1400f2f90
mov r15, rax
test rax, rax
jne 0x1400f0f61
lea ecx, [rax + 0x48]
call fcn.1402b968c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f0f59
mov rcx, rax
call fcn.14020abd0
mov r14, rax
jmp 0x1400f0f5c
mov r14, r12
jmp 0x1400f143c
lea rdi, [0x140348ca0]
test ebx, ebx
jne 0x1400f0f92
lea ecx, [rbx + 0x48]
call fcn.1402b968c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f0f8a
mov rcx, rax
call fcn.14020abd0
mov r14, rax
jmp 0x1400f0f8d
mov r14, r12
jmp 0x1400f108f
cmp ebx, 1
je 0x1400f108f
cmp ebx, 2
jne 0x1400f0fad
call fcn.14020af00
mov r14, rax
jmp 0x1400f108f
cmp ebx, 3
jne 0x1400f0ff0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r12
lea r8, [rbp - 0x39]
lea rdx, str.ProxyPAC
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1400f0fdd
lea rcx, [rbp - 0x39]
call fcn.14020af60
mov r14, rax
cmp dword [rbp - 0x31], 0
jle 0x1400f108f
mov rcx, qword [rbp - 0x39]
jmp 0x1400f108a
cmp ebx, 4
jne 0x1400f108f
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
lea rdx, str.ProxyServer
mov rcx, rax
call fcn.1400d8b50
test al, al
je 0x1400f1080
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], ebx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, [0x14034ebe0]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f1080
lea ecx, [rbx + 0x48]
call fcn.1402b968c
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x1400f107d
mov r8d, dword [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.14020acb0
mov r14, rax
jmp 0x1400f1080
mov r14, r12
cmp dword [rbp - 0x21], 0
jle 0x1400f108f
mov rcx, qword [rbp - 0x29]
call fcn.1402b9c20
xor dil, dil
lea rax, [0x140348ca0]
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x71], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
test r14, r14
je 0x1400f140a
cmp dword [rsi + 0xdc], 0
jle 0x1400f129e
lea rbx, [rsi + 0xd0]
mov r8d, 1
lea rdx, [0x14034ebdc]
mov rcx, rbx
call fcn.1402019e0
test al, al
je 0x1400f11ed
mov r8d, 1
lea rdx, [0x14034ec14]
mov rcx, rbx
call fcn.1401ff110
test al, al
je 0x1400f11ed
mov r9d, dword [rsi + 0xdc]
add r9d, 0xfffffffe
mov r8d, 1
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.140201490
nop
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x19], r12
xor r12d, r12d
mov dword [rbp - 0x11], r12d
mov qword [rbp - 9], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 0x69]
call fcn.1400eaa00
test al, al
jne 0x1400f115f
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402ba358
jmp 0x1400f11bf
lea rax, [0x140348ca0]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r12
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.1400f1950
test al, al
je 0x1400f11a2
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.1402010b0
test al, al
je 0x1400f11af
mov dil, 1
jmp 0x1400f11af
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402ba358
nop
cmp dword [rbp - 0x51], 0
jle 0x1400f11bf
mov rcx, qword [rbp - 0x59]
call fcn.1402b9c20
nop
mov r8, qword [rbp - 9]
test r8, r8
je 0x1400f11d5
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rbp - 0x61], 0
jle 0x1400f132c
mov rcx, qword [rbp - 0x69]
call fcn.1402b9c20
jmp 0x1400f132c
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
mov rcx, rbx
call fcn.1402010b0
test al, al
je 0x1400f140a
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x59], r12
xor edi, edi
mov dword [rbp - 0x51], edi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x41], rax
mov eax, dword [rbx + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rsi + 0xc0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x20]
test al, al
je 0x1400f127c
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400d6e10
mov rdx, qword [rbp - 0x69]
lea rcx, str.__ls__r_n
call fcn.1402ba358
cmp dword [rbp - 0x61], edi
jle 0x1400f127c
mov rcx, qword [rbp - 0x69]
call fcn.1402b9c20
nop
mov qword [rbp - 0x59], r12
mov r8, qword [rbp - 0x49]
test r8, r8
je 0x1400f1337
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400f1337
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, [0x14034ec18]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f140a
cmp dword [rbp + 0x67], ebx
setne dil
test dil, dil
je 0x1400f140a
lea r8, [rbp - 0x79]
lea rdx, str.ProxyUsername
mov rcx, r15
call fcn.1400d8b50
test al, al
je 0x1400f140a
lea r8, [rsp + 0x30]
lea rdx, str.ProxyPassword
mov rcx, rsi
call fcn.1400f1660
test al, al
je 0x1400f140a
test dil, dil
je 0x1400f140a
xor edi, edi
mov ecx, 0x38
call fcn.1402b968c
mov r12, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f13fb
lea rax, vtable.Core::Net::NetworkCredential.0
mov qword [r12], rax
lea rax, [0x140348ca0]
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], rax
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], rax
xor eax, eax
mov qword [r12 + 0x30], rax
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x6d]
mov eax, dword [r12 + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x79]
mov rcx, qword [r12 + 0x18]
call fcn.1402bd21c
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.140200570
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1401ff260
movsxd r9, dword [rbp - 0x7d]
mov eax, dword [r12 + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [r12 + 0x28]
call fcn.1402bd21c
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.140200570
nop
jmp 0x1400f13fe
mov r12, rdi
mov rax, qword [r14]
mov rdx, r12
mov rcx, r14
call qword [rax + 0x30]
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
cmp dword [rsp + 0x38], 0
jle 0x1400f142a
mov rcx, qword [rsp + 0x30]
call fcn.1402b9c20
nop
cmp dword [rbp - 0x71], 0
jle 0x1400f1439
mov rcx, qword [rbp - 0x79]
call fcn.1402b9c20
xor r12d, r12d
mov ecx, 0x18
call fcn.1402b968c
mov rcx, rax
mov qword [rax + 0x10], r14
cmp dword [rsi + 0x80], 0
jne 0x1400f1467
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x78], rax
jmp 0x1400f147e
mov rax, qword [rsi + 0x70]
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov rax, qword [rsi + 0x70]
mov qword [rax + 8], rcx
mov qword [rsi + 0x70], rcx
inc dword [rsi + 0x80]
mov rax, qword [rsi + 0x70]
mov rbx, qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret