Function at 0x140064620
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
xor eax, eax
lea rdi, [0x14021a1b0]
mov ecx, 0xa
rep stosd dword [rdi], eax
lea rcx, [0x14021a1b0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x14021a1d8]
mov r8d, 0xf8
call fcn.14014d290
xor edx, edx
lea rcx, [0x14021a2d0]
mov r8d, 0x208
call fcn.14014d290
xor edx, edx
lea rcx, [0x14021a4d8]
mov r8d, 0x208
call fcn.14014d290
xor ebx, ebx
mov dword [0x14021a708], 0x288
lea rax, [0x1401b6658]
mov dword [0x14021a6e0], ebx
mov qword [0x14021a6e8], rax
lea rcx, [0x14021a788]
mov qword [0x14021a710], rax
xor edx, edx
lea rax, [0x1401b6658]
mov qword [0x14021a6f8], rbx
mov qword [0x14021a738], rax
mov r8d, 0x30c
lea rax, [0x1401b6658]
mov qword [0x14021a700], rbx
mov qword [0x14021a760], rax
mov dword [0x14021a70c], 0x40
mov qword [0x14021a720], rbx
mov qword [0x14021a728], rbx
mov dword [0x14021a730], 0x288
mov dword [0x14021a734], 0x40
mov qword [0x14021a748], rbx
mov qword [0x14021a750], rbx
mov dword [0x14021a758], 0xa8
mov dword [0x14021a75c], 0x20
mov qword [0x14021a770], rbx
mov qword [0x14021a778], rbx
mov dword [0x14021a780], 0x84
mov dword [0x14021a784], 8
call fcn.14014d290
xor edx, edx
lea rcx, [0x14021aa94]
mov r8d, 0x100
call fcn.14014d290
xorps xmm1, xmm1
mov qword [0x14021ac68], rbx
xorps xmm0, xmm0
mov qword [0x14021ac70], rbx
lea rax, [0x1401b6658]
mov dword [0x14021ac78], 0x8c8
mov qword [0x14021ac58], rax
lea rax, [0x1401b6658]
mov qword [0x14021ac88], rax
lea rax, [0x1401b6790]
mov qword [0x14021acb8], rax
movups xmmword [0x14021ab94], xmm0
mov dword [0x14021ac7c], 0x20
movups xmmword [0x14021aba4], xmm0
mov byte [0x14021ac80], bl
movups xmmword [0x14021abb4], xmm0
mov qword [0x14021ac98], rbx
movups xmmword [0x14021abc4], xmm0
mov qword [0x14021aca0], rbx
movups xmmword [0x14021abd4], xmm1
mov dword [0x14021aca8], 0x190
movups xmmword [0x14021abe4], xmm1
mov dword [0x14021acac], 8
movups xmmword [0x14021abf4], xmm1
mov qword [0x14021acb0], rbx
movups xmmword [0x14021ac04], xmm1
movups xmmword [0x14021ac14], xmm1
movups xmmword [0x14021ac24], xmm1
movups xmmword [0x14021ac34], xmm1
movups xmmword [0x14021ac44], xmm1
lea rax, [rbp + 0x170]
movdqa xmmword [0x14021acc0], xmm0
mov word [0x14021acd0], bx
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [0x14021acd8], rbx
mov r9d, 0x20119
mov qword [0x14021ace0], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov byte [0x14021ace8], bl
mov qword [rbp + 0x170], rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006491e
lea rax, [rbp + 0x170]
mov qword [rbp + 0x170], rbx
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006491e
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14006492b
mov rcx, qword [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x170]
mov qword [rbp + 0x170], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400649d3
lea rax, [rbp + 0x170]
mov qword [rbp + 0x170], rbx
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400649d3
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400649e0
mov rcx, qword [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [rbp + 0x170], 0x1fe
mov dword [rsp + 0x50], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x178], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064a8c
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x178]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.Proxy.Type
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x180]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140064a8c
lea rcx, [rsp + 0x50]
call fcn.14003df88
mov dword [0x14021a788], eax
cmp eax, 3
jbe 0x140064a8c
mov dword [0x14021a788], ebx
xor eax, eax
mov dword [rbp + 0x170], 0xfe
mov dword [0x14021a78c], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x178], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rsi, [0x14021a78c]
test eax, eax
jne 0x140064b21
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x178]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, [0x1401b84e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x180]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140064b28
mov word [0x14021a78c], bx
xor eax, eax
mov dword [rbp + 0x170], 0x7e
mov dword [0x14021a88c], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x178], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064bbd
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x178]
lea rax, [0x14021a88c]
xor r8d, r8d
lea rdx, str.Proxy.Login
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x180]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140064bc4
mov word [0x14021a88c], bx
xor eax, eax
mov dword [rbp + 0x170], 0x7e
mov dword [0x14021a90c], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x178], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064c59
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x178]
lea rax, [0x14021a90c]
xor r8d, r8d
lea rdx, str.Proxy.Password
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x180]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140064c60
mov word [0x14021a90c], bx
cmp word [0x14021a78c], bx
jne 0x140064da9
xor eax, eax
mov dword [rbp + 0x170], 0x1fe
mov dword [rsp + 0x50], eax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea rax, [rbp + 0x180]
mov qword [rbp + 0x180], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x178], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064da9
mov rcx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x178]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProxyServer
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x180]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140064da9
lea rdx, str.https
lea rcx, [rsp + 0x50]
call fcn.1400308bc
test rax, rax
jne 0x140064d32
lea rdx, str.http
lea rcx, [rsp + 0x50]
call fcn.1400308bc
test rax, rax
je 0x140064da9
lea rdx, [0x1401b85e4]
mov rcx, rax
call fcn.1400308bc
mov rdi, 0xffffffffffffffff
mov edx, 0x80
mov r9, rdi
mov rcx, rsi
lea r8, [rax + 2]
call fcn.14003c218
lea rdx, [0x1401b70d4]
mov rcx, rsi
call fcn.1400308bc
test rax, rax
je 0x140064d73
mov word [rax], bx
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x140064d73
cmp rdi, 3
jbe 0x140064da2
lea rdx, [0x1401b6678]
mov rcx, rsi
call fcn.1400308bc
test rax, rax
je 0x140064da2
mov dword [0x14021a788], 3
jmp 0x140064da9
mov word [0x14021a78c], bx
call fcn.140060150
mov rbx, qword [rsp + 0x288]
lea rax, [0x14021a1b0]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret