Function at 0x14000610c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
mov rbp, rsp
push rsi
push r12
push r13
push r14
sub rsp, 0x40
lea rax, [r11 + 0x18]
xor ebx, ebx
mov r14, rdx
mov qword [r11 - 0x40], rax
lea rax, [r11 - 0x38]
lea r13d, [rbx + 4]
lea r9, [r11 + 0x20]
lea rdx, str.Timeout
xor r8d, r8d
mov qword [r11 - 0x48], rax
mov rsi, rcx
mov dword [rsp + 0x38], ebx
mov dword [r11 + 0x18], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, 0x80070000
mov r11d, eax
test eax, eax
jne 0x14000617b
mov eax, dword [rsp + 0x30]
lea ecx, [rax - 3]
cmp ecx, 0x39
ja 0x140006180
mov dword [0x1400283a4], eax
jmp 0x140006196
cmp eax, 2
je 0x140006196
movzx eax, r11w
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.LogLevel
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x1400061e0
test eax, eax
je 0x1400061e0
movzx ecx, ax
or ecx, r12d
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1400064d8
mov ecx, dword [rsp + 0x38]
mov eax, 3
cmp ecx, eax
cmova ecx, eax
mov dword [rsp + 0x38], ecx
cmp dword [r14], ebx
je 0x140006220
test ecx, ecx
jne 0x140006214
lea ecx, [rax - 2]
call fcn.140019078
mov edx, 1
mov ecx, edx
call fcn.1400190cc
mov dword [r14], ebx
jmp 0x14000625d
mov edx, 1
call fcn.1400190cc
jmp 0x14000625d
test ecx, ecx
je 0x14000625d
mov edx, 1
call fcn.1400190cc
lea r8, [0x140021098]
lea rdx, [0x140020de0]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], 1
call fcn.140018f38
test eax, eax
js 0x1400064d8
mov dword [r14], 1
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.CDBufferRead
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x1400062a3
cmp dword [rsp + 0x34], ebx
mov eax, ebx
setne al
mov dword [0x1400283a8], eax
jmp 0x1400062bd
cmp eax, 2
je 0x1400062bd
movzx eax, ax
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.CDBufferSize
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140006302
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140006307
mov dword [0x1400283ac], eax
jmp 0x14000631d
cmp eax, 2
je 0x14000631d
movzx eax, r11w
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.NetworkBufferRead
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140006363
cmp dword [rsp + 0x34], ebx
mov eax, ebx
setne al
mov dword [0x1400283b0], eax
jmp 0x14000637d
cmp eax, 2
je 0x14000637d
movzx eax, ax
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.NetworkBufferSize
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x1400063c2
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400063c7
mov dword [0x1400283b4], eax
jmp 0x1400063dd
cmp eax, 2
je 0x1400063dd
movzx eax, r11w
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.InternetBufferRead
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140006423
cmp dword [rsp + 0x34], ebx
mov eax, ebx
setne al
mov dword [0x1400283b8], eax
jmp 0x14000643d
cmp eax, 2
je 0x14000643d
movzx eax, ax
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.InternetBufferSize
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140006482
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140006487
mov dword [0x1400283bc], eax
jmp 0x140006499
cmp eax, 2
je 0x140006499
movzx eax, r11w
or eax, r12d
test r11d, r11d
cmovle eax, r11d
test eax, eax
js 0x1400064d8
lea rax, [rbp + 0x20]
lea r9, [rbp + 0x28]
lea rdx, str.BufferWrite
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x20], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400064d8
cmp dword [rsp + 0x34], ebx
setne bl
mov dword [0x1400283c0], ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret