Function at 0x1400f1a50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp + 7], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [rcx + 0x90]
mov qword [rbp + 0x7f], rax
lea r13, [rax + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jle 0x1400f1aaf
cmp byte [rsi + 0x88], 0
je 0x1400f2014
mov byte [rsi + 0x88], 0
xor r12d, r12d
mov r14d, r12d
call fcn.1400f20d0
mov ebx, eax
xor ecx, ecx
call fcn.1400f3b20
mov r15, rax
test rax, rax
jne 0x1400f1af1
lea ecx, [rax + 0x48]
call fcn.14029806c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f1ae9
mov rcx, rax
call fcn.1401f4810
mov r14, rax
jmp 0x1400f1aec
mov r14, r12
jmp 0x1400f1fcc
lea rdi, [0x140323de0]
test ebx, ebx
jne 0x1400f1b22
lea ecx, [rbx + 0x48]
call fcn.14029806c
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f1b1a
mov rcx, rax
call fcn.1401f4810
mov r14, rax
jmp 0x1400f1b1d
mov r14, r12
jmp 0x1400f1c1f
cmp ebx, 1
je 0x1400f1c1f
cmp ebx, 2
jne 0x1400f1b3d
call fcn.1401f4b40
mov r14, rax
jmp 0x1400f1c1f
cmp ebx, 3
jne 0x1400f1b80
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r12
lea r8, [rbp - 0x39]
lea rdx, str.ProxyPAC
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1400f1b6d
lea rcx, [rbp - 0x39]
call fcn.1401f4ba0
mov r14, rax
cmp dword [rbp - 0x31], 0
jle 0x1400f1c1f
mov rcx, qword [rbp - 0x39]
jmp 0x1400f1c1a
cmp ebx, 4
jne 0x1400f1c1f
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
lea rdx, str.ProxyServer
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1400f1c10
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], ebx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyPort
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f1c10
lea ecx, [rbx + 0x48]
call fcn.14029806c
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x1400f1c0d
mov r8d, dword [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1401f48f0
mov r14, rax
jmp 0x1400f1c10
mov r14, r12
cmp dword [rbp - 0x21], 0
jle 0x1400f1c1f
mov rcx, qword [rbp - 0x29]
call fcn.140298600
xor dil, dil
lea rax, [0x140323de0]
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x71], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
test r14, r14
je 0x1400f1f9a
cmp dword [rsi + 0xdc], 0
jle 0x1400f1e2e
lea rbx, [rsi + 0xd0]
mov r8d, 1
lea rdx, [0x1403299cc]
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1400f1d7d
mov r8d, 1
lea rdx, [0x1403299c8]
mov rcx, rbx
call fcn.1401e8ee0
test al, al
je 0x1400f1d7d
mov r9d, dword [rsi + 0xdc]
add r9d, 0xfffffffe
mov r8d, 1
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.1401eb1b0
nop
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x19], r12
xor r12d, r12d
mov dword [rbp - 0x11], r12d
mov qword [rbp - 9], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 0x69]
call fcn.1400eb560
test al, al
jne 0x1400f1cef
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.140298d38
jmp 0x1400f1d4f
lea rax, [0x140323de0]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r12
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.1400f24e0
test al, al
je 0x1400f1d32
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.1401eadd0
test al, al
je 0x1400f1d3f
mov dil, 1
jmp 0x1400f1d3f
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.140298d38
nop
cmp dword [rbp - 0x51], 0
jle 0x1400f1d4f
mov rcx, qword [rbp - 0x59]
call fcn.140298600
nop
mov r8, qword [rbp - 9]
test r8, r8
je 0x1400f1d65
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rbp - 0x61], 0
jle 0x1400f1ebc
mov rcx, qword [rbp - 0x69]
call fcn.140298600
jmp 0x1400f1ebc
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
mov rcx, rbx
call fcn.1401eadd0
test al, al
je 0x1400f1f9a
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x59], r12
xor edi, edi
mov dword [rbp - 0x51], edi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x41], rax
mov eax, dword [rbx + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rsi + 0xc0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x20]
test al, al
je 0x1400f1e0c
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400d39e0
mov rdx, qword [rbp - 0x69]
lea rcx, str.__ls__r_n
call fcn.140298d38
cmp dword [rbp - 0x61], edi
jle 0x1400f1e0c
mov rcx, qword [rbp - 0x69]
call fcn.140298600
nop
mov qword [rbp - 0x59], r12
mov r8, qword [rbp - 0x49]
test r8, r8
je 0x1400f1ec7
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400f1ec7
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyAuthentication
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f1f9a
cmp dword [rbp + 0x67], ebx
setne dil
test dil, dil
je 0x1400f1f9a
lea r8, [rbp - 0x79]
lea rdx, str.ProxyUsername
mov rcx, r15
call fcn.1400d5720
test al, al
je 0x1400f1f9a
lea r8, [rsp + 0x30]
lea rdx, str.ProxyPassword
mov rcx, rsi
call fcn.1400f21f0
test al, al
je 0x1400f1f9a
test dil, dil
je 0x1400f1f9a
xor edi, edi
mov ecx, 0x38
call fcn.14029806c
mov r12, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f1f8b
lea rax, vtable.Core::Net::NetworkCredential.0
mov qword [r12], rax
lea rax, [0x140323de0]
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], rax
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], rax
xor eax, eax
mov qword [r12 + 0x30], rax
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6d]
mov eax, dword [r12 + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x79]
mov rcx, qword [r12 + 0x18]
call fcn.14029b4d8
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1401ea290
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x7d]
mov eax, dword [r12 + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [r12 + 0x28]
call fcn.14029b4d8
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1401ea290
nop
jmp 0x1400f1f8e
mov r12, rdi
mov rax, qword [r14]
mov rdx, r12
mov rcx, r14
call qword [rax + 0x30]
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
cmp dword [rsp + 0x38], 0
jle 0x1400f1fba
mov rcx, qword [rsp + 0x30]
call fcn.140298600
nop
cmp dword [rbp - 0x71], 0
jle 0x1400f1fc9
mov rcx, qword [rbp - 0x79]
call fcn.140298600
xor r12d, r12d
mov ecx, 0x18
call fcn.14029806c
mov rcx, rax
mov qword [rax + 0x10], r14
cmp dword [rsi + 0x80], 0
jne 0x1400f1ff7
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x78], rax
jmp 0x1400f200e
mov rax, qword [rsi + 0x70]
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov rax, qword [rsi + 0x70]
mov qword [rax + 8], rcx
mov qword [rsi + 0x70], rcx
inc dword [rsi + 0x80]
mov rax, qword [rsi + 0x70]
mov rbx, qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret