Function at 0x140020de0
Capabilities:
Convert ip address from string
Get proxy
Get routing table
Query or enumerate registry value

Disassembly:
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x78
xor ecx, ecx
call fcn.140020520
mov rdi, rax
test rax, rax
jne 0x14001ffa0
add rsp, 0x78
pop rdi
pop rbp
ret
mov qword [rsp + 0x70], rbx
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x68], rsi
xor r8d, r8d
xor esi, esi
mov qword [rsp + 0x60], r12
xor ecx, ecx
mov dword [rbp + 0x18], esi
mov r12d, esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x1400202d7
mov ecx, dword [rbp + 0x18]
mov qword [rsp + 0x58], r13
call fcn.14002fc3c
xor r8d, r8d
lea rdx, [rbp + 0x18]
mov rcx, rax
mov r13, rax
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x1400202d2
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], r14
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], r15
lea rdx, [0x140069580]
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400201f8
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140069600]
mov dword [rbp + 0x20], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140020079
mov eax, 1
movzx ebx, bl
cmp dword [rbp + 0x30], eax
cmove ebx, eax
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400201f8
lea rax, [rbp - 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140069580]
mov rcx, 0xffffffff80000002
mov r15, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400202c0
mov rcx, qword [rbp - 0x40]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x140069610]
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140020133
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140020133
mov ecx, eax
call fcn.14002fc3c
mov rcx, qword [rbp - 0x40]
lea r9, [rbp + 0x28]
mov r15, rax
lea rdx, [0x140069610]
lea rax, [rbp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140020133
mov rcx, r15
call fcn.14002fc28
mov r15, rsi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1400202c0
mov edx, 0x3a
mov rcx, r15
call fcn.14002e37c
test rax, rax
je 0x14002015b
mov byte [rax], sil
lea r8, [rbp - 0x44]
mov rdx, r15
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1400202b8
mov rbx, rsi
cmp qword [rdi + 8], rbx
jbe 0x1400202b8
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdi]
lea r8, [rbp + 0x30]
mov ecx, 2
mov r14, qword [rax + rbx*8]
mov rdx, qword [r14 + 0x18]
call sub.WS2_32.dll_InetPtonW
cmp eax, 1
jne 0x1400201ea
mov rdx, qword [r14 + 8]
lea r8, [rbp - 0x48]
lea ecx, [rax + 1]
call sub.WS2_32.dll_InetPtonW
cmp eax, 1
jne 0x1400201ea
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x1400201ea
mov edx, dword [rbp - 0x48]
and edx, eax
and eax, dword [rbp - 0x44]
cmp eax, edx
jne 0x1400201ea
mov rcx, r12
call fcn.14002fc28
mov rcx, qword [r14 + 8]
call fcn.1400343b0
mov r12, rax
inc rbx
cmp rbx, qword [rdi + 8]
jb 0x140020190
jmp 0x1400202b8
mov edx, dword [r13]
mov r9d, esi
mov r8d, 0xffffffff
test rdx, rdx
je 0x14002022d
lea rax, [r13 + 0x28]
nop
cmp dword [rax - 0x24], esi
jne 0x140020223
mov ecx, dword [rax]
cmp r8d, ecx
jbe 0x140020223
mov r9d, dword [rax - 0x18]
mov r8d, ecx
add rax, 0x38
sub rdx, 1
jne 0x140020210
mov ecx, 0x20
mov dword [rbp + 0x20], r9d
call fcn.14002fc3c
mov r9d, setsockopt
lea rdx, [rbp + 0x20]
mov r8, rax
mov r15, rax
lea ecx, [r9 - 0xe]
call sub.WS2_32.dll_InetNtopW
test r15, r15
je 0x1400202b8
mov rbx, rsi
cmp qword [rdi + 8], rbx
jbe 0x1400202b8
mov rax, qword [rdi]
mov r9, r15
mov r14, qword [rax + rbx*8]
mov rax, qword [r14 + 0x50]
sub r9, rax
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [rax]
movzx edx, word [rax + r9]
sub r8d, edx
jne 0x140020296
add rax, 2
test edx, edx
jne 0x140020280
test r8d, r8d
jne 0x1400202af
mov rcx, r12
call fcn.14002fc28
mov rcx, qword [r14 + 8]
call fcn.1400343b0
mov r12, rax
inc rbx
cmp rbx, qword [rdi + 8]
jb 0x140020262
mov rcx, r15
call fcn.14002fc28
mov rcx, r13
call fcn.14002fc28
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
cmp qword [rdi + 8], rsi
jbe 0x140020300
nop dword [rax]
mov rax, qword [rdi]
mov rbx, qword [rax + rsi*8]
mov rcx, rbx
call fcn.140015aa0
mov rcx, rbx
call fcn.14002fc28
inc rsi
cmp rsi, qword [rdi + 8]
jb 0x1400202e0
xor edx, edx
mov rcx, rdi
call fcn.1400045b0
mov rcx, rdi
call fcn.14002fc28
mov rsi, qword [rsp + 0x68]
mov rax, r12
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbp
ret
jmp 0x14001ff80