Function at 0x1400efc20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp + 7], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [rcx + 0x90]
mov qword [rbp + 0x7f], rax
lea r13, [rax + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rcx, [rsi + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jle 0x1400efc7f
cmp byte [rsi + 0x88], 0
je 0x1400f01e4
mov byte [rsi + 0x88], 0
xor r12d, r12d
mov r14d, r12d
call fcn.1400f02a0
mov ebx, eax
xor ecx, ecx
call fcn.1400f1cf0
mov r15, rax
test rax, rax
jne 0x1400efcc1
lea ecx, [rax + 0x48]
call fcn.1402b6dbc
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400efcb9
mov rcx, rax
call fcn.140208510
mov r14, rax
jmp 0x1400efcbc
mov r14, r12
jmp 0x1400f019c
lea rdi, [0x140346ce0]
test ebx, ebx
jne 0x1400efcf2
lea ecx, [rbx + 0x48]
call fcn.1402b6dbc
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400efcea
mov rcx, rax
call fcn.140208510
mov r14, rax
jmp 0x1400efced
mov r14, r12
jmp 0x1400efdef
cmp ebx, 1
je 0x1400efdef
cmp ebx, 2
jne 0x1400efd0d
call fcn.140208840
mov r14, rax
jmp 0x1400efdef
cmp ebx, 3
jne 0x1400efd50
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], r12
lea r8, [rbp - 0x39]
lea rdx, str.ProxyPAC
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x1400efd3d
lea rcx, [rbp - 0x39]
call fcn.1402088a0
mov r14, rax
cmp dword [rbp - 0x31], 0
jle 0x1400efdef
mov rcx, qword [rbp - 0x39]
jmp 0x1400efdea
cmp ebx, 4
jne 0x1400efdef
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x29]
lea rdx, str.ProxyServer
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x1400efde0
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], ebx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyPort
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400efde0
lea ecx, [rbx + 0x48]
call fcn.1402b6dbc
mov qword [rbp + 0x6f], rax
test rax, rax
je 0x1400efddd
mov r8d, dword [rbp + 0x67]
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1402085f0
mov r14, rax
jmp 0x1400efde0
mov r14, r12
cmp dword [rbp - 0x21], 0
jle 0x1400efdef
mov rcx, qword [rbp - 0x29]
call fcn.1402b7350
xor dil, dil
lea rax, [0x140346ce0]
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x71], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r12
test r14, r14
je 0x1400f016a
cmp dword [rsi + 0xdc], 0
jle 0x1400efffe
lea rbx, [rsi + 0xd0]
mov r8d, 1
lea rdx, [0x14034cb9c]
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1400eff4d
mov r8d, 1
lea rdx, [0x14034cb98]
mov rcx, rbx
call fcn.1401fc9f0
test al, al
je 0x1400eff4d
mov r9d, dword [rsi + 0xdc]
add r9d, 0xfffffffe
mov r8d, 1
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.1401fed70
nop
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x19], r12
xor r12d, r12d
mov dword [rbp - 0x11], r12d
mov qword [rbp - 9], r12
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x19]
mov rcx, qword [rbp - 0x69]
call fcn.1400e9760
test al, al
jne 0x1400efebf
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402b7a88
jmp 0x1400eff1f
lea rax, [0x140346ce0]
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], r12
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.1400f06b0
test al, al
je 0x1400eff02
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.1401fe990
test al, al
je 0x1400eff0f
mov dil, 1
jmp 0x1400eff0f
lea rcx, str.Proxycred:_decrypt_error_r_n
call fcn.1402b7a88
nop
cmp dword [rbp - 0x51], 0
jle 0x1400eff1f
mov rcx, qword [rbp - 0x59]
call fcn.1402b7350
nop
mov r8, qword [rbp - 9]
test r8, r8
je 0x1400eff35
xor edx, edx
mov rcx, qword [rbp - 1]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rbp - 0x61], 0
jle 0x1400f008c
mov rcx, qword [rbp - 0x69]
call fcn.1402b7350
jmp 0x1400f008c
mov edx, 0x3b
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x79]
mov rcx, rbx
call fcn.1401fe990
test al, al
je 0x1400f016a
lea r12, vtable.Core::ByteArray.0
mov qword [rbp - 0x59], r12
xor edi, edi
mov dword [rbp - 0x51], edi
mov qword [rbp - 0x49], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x41], rax
mov eax, dword [rbx + 0xc]
lea r9d, [rax + rax]
mov rcx, qword [rsi + 0xc0]
mov rax, qword [rcx]
lea rdx, [rbp - 0x59]
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x20]
test al, al
je 0x1400effdc
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400d6da0
mov rdx, qword [rbp - 0x69]
lea rcx, str.__ls__r_n
call fcn.1402b7a88
cmp dword [rbp - 0x61], edi
jle 0x1400effdc
mov rcx, qword [rbp - 0x69]
call fcn.1402b7350
nop
mov qword [rbp - 0x59], r12
mov r8, qword [rbp - 0x49]
test r8, r8
je 0x1400f0097
xor edx, edx
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400f0097
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
lea rdx, str.ProxyAuthentication
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400f016a
cmp dword [rbp + 0x67], ebx
setne dil
test dil, dil
je 0x1400f016a
lea r8, [rbp - 0x79]
lea rdx, str.ProxyUsername
mov rcx, r15
call fcn.1400d8ae0
test al, al
je 0x1400f016a
lea r8, [rsp + 0x30]
lea rdx, str.ProxyPassword
mov rcx, rsi
call fcn.1400f03c0
test al, al
je 0x1400f016a
test dil, dil
je 0x1400f016a
xor edi, edi
mov ecx, 0x38
call fcn.1402b6dbc
mov r12, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400f015b
lea rax, vtable.Core::Net::NetworkCredential.0
mov qword [r12], rax
lea rax, [0x140346ce0]
mov qword [r12 + 8], rax
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], rax
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], rax
xor eax, eax
mov qword [r12 + 0x30], rax
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6d]
mov eax, dword [r12 + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x79]
mov rcx, qword [r12 + 0x18]
call fcn.1402ba94c
mov edx, dword [rbp - 0x6d]
lea rcx, [r12 + 0x18]
call fcn.1401fde50
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x7d]
mov eax, dword [r12 + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rsp + 0x30]
mov rcx, qword [r12 + 0x28]
call fcn.1402ba94c
mov edx, dword [rbp - 0x7d]
lea rcx, [r12 + 0x28]
call fcn.1401fde50
nop
jmp 0x1400f015e
mov r12, rdi
mov rax, qword [r14]
mov rdx, r12
mov rcx, r14
call qword [rax + 0x30]
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
cmp dword [rsp + 0x38], 0
jle 0x1400f018a
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
nop
cmp dword [rbp - 0x71], 0
jle 0x1400f0199
mov rcx, qword [rbp - 0x79]
call fcn.1402b7350
xor r12d, r12d
mov ecx, 0x18
call fcn.1402b6dbc
mov rcx, rax
mov qword [rax + 0x10], r14
cmp dword [rsi + 0x80], 0
jne 0x1400f01c7
mov qword [rax], r12
mov qword [rax + 8], r12
mov qword [rsi + 0x70], rax
mov qword [rsi + 0x78], rax
jmp 0x1400f01de
mov rax, qword [rsi + 0x70]
mov qword [rcx], rax
mov qword [rcx + 8], r12
mov rax, qword [rsi + 0x70]
mov qword [rax + 8], rcx
mov qword [rsi + 0x70], rcx
inc dword [rsi + 0x80]
mov rax, qword [rsi + 0x70]
mov rbx, qword [rax + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, rbx
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret