Function at 0x14009ffa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov r10, r8
mov qword [rsp + 0x80], r12
mov r11, rdx
mov qword [rsp + 0x48], r14
mov r14, r9
lea rax, [0x140104c70]
mov qword [rcx], rax
xor r12d, r12d
mov rax, qword [0x140129398]
mov rbx, rcx
mov dword [rcx + 0x10], r12d
xor r8d, r8d
mov qword [rcx + 8], r12
mov rdx, r10
mov rcx, r11
mov r9d, dword [rax + 0xb0]
lea rax, [rbp - 0x18]
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400a0312
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a0308
mov eax, dword [rbp - 0x20]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], r15
sub eax, 1
je 0x1400a01df
sub eax, 1
je 0x1400a01df
sub eax, 1
je 0x1400a00bc
sub eax, 1
je 0x1400a0074
cmp eax, 3
je 0x1400a01df
mov edi, 0x65e
jmp 0x1400a02fe
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x1c]
mov dword [rbp + 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a02fe
mov eax, dword [rbp - 0x1c]
mov qword [rbx], rax
mov dword [rbx + 0x10], 1
jmp 0x1400a02fe
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r14
mov dword [rbp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a02fe
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x1400a02fe
add eax, eax
mov r15d, eax
lea rsi, [rax + rax]
cmp r15, 0xff
ja 0x1400a015e
mov rax, qword [rbx + 0x18]
mov qword [rbx], rax
mov word [rax + rsi], r12w
mov qword [rbx + 8], r15
mov r15, qword [rbx]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov word [r15], r12w
mov ecx, dword [rbp + 0x20]
lea esi, [rcx + rcx]
add rsi, rsi
sub rsi, rcx
mov rcx, qword [rbp - 0x18]
add rsi, r15
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x1400a0182
mov qword [rbx + 8], r12
jmp 0x1400a02fe
lea rcx, [rsi + 2]
call fcn.1400c83d4
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1400a010c
mov rcx, rbx
call fcn.1400116c0
test eax, eax
je 0x1400a02fe
jmp 0x1400a0118
mov edx, r12d
mov r9d, r12d
cmp dword [rbp + 0x20], edx
jbe 0x1400a01d2
mov r8, r15
lea r10, str.0123456789ABCDEF
nop word [rax + rax]
mov eax, edx
lea r8, [r8 + 4]
add r9d, 2
inc edx
movzx ecx, byte [rax + rsi]
mov eax, ecx
shr rcx, 4
and eax, 0xf
movzx eax, word [r10 + rax*2]
mov word [r8 - 2], ax
movzx eax, word [r10 + rcx*2]
mov word [r8 - 4], ax
cmp edx, dword [rbp + 0x20]
jb 0x1400a01a0
movsxd rax, r9d
mov word [r15 + rax*2], r12w
jmp 0x1400a02fe
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rdx, r14
mov dword [rbp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a02fe
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x1400a02fe
shr eax, 1
add eax, 2
mov r15d, eax
lea rsi, [rax + rax]
cmp r15, 0xff
ja 0x1400a027f
mov rax, qword [rbx + 0x18]
mov qword [rbx], rax
mov word [rsi + rax], r12w
mov qword [rbx + 8], r15
mov rsi, qword [rbx]
lea rax, [rbp + 0x20]
mov rcx, qword [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1400a02df
mov edx, dword [rbp + 0x20]
test edx, edx
je 0x1400a02df
shr edx, 1
lea ecx, [rdx - 1]
cmp word [rsi + rcx*2], r12w
jne 0x1400a029f
mov edx, ecx
jmp 0x1400a02a4
lea rcx, [rsi + 2]
call fcn.1400c83d4
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1400a0232
mov rcx, rbx
call fcn.1400116c0
test eax, eax
je 0x1400a02fe
jmp 0x1400a023e
mov word [rsi + rdx*2], r12w
cmp dword [rbp - 0x20], 7
jne 0x1400a02e3
test edx, edx
je 0x1400a02b8
lea eax, [rdx - 1]
cmp word [rsi + rax*2], r12w
je 0x1400a02bf
inc edx
mov word [rsi + rdx*2], r12w
test edx, edx
je 0x1400a02e3
mov rax, rsi
mov ecx, edx
cmp word [rax], r12w
jne 0x1400a02d3
mov word [rax], 0xa
add rax, 2
sub rcx, 1
jne 0x1400a02c8
jmp 0x1400a02e3
mov word [rsi], r12w
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rsi + rax*2], r12w
jne 0x1400a02f0
mov qword [rbx + 8], rax
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x140129398]
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x80]
mov dword [rax + 0x64], edi
cmp edi, 2
jne 0x1400a035e
mov rdx, qword [rbp + 0x40]
test rdx, rdx
je 0x1400a0362
mov rcx, qword [rdx]
mov qword [rbx], rcx
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov eax, dword [rdx + 0x10]
mov dword [rbx + 0x10], eax
cmp eax, 5
jne 0x1400a036c
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_htonl]
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret
test edi, edi
je 0x1400a036c
mov edx, edi
mov rcx, rbx
call fcn.1400118f0
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret