Function at 0x14000af60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xc8
mov rax, qword [0x14019ac80]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, r9
mov rax, r8
mov rbx, rdx
mov qword [rbp - 0x19], rdx
xor r15d, r15d
mov dword [rbp - 0x41], r15d
mov qword [rbp - 0x19], r15
cmp qword [r8 + 0x18], 0xf
jbe 0x14000afa5
mov rax, qword [r8]
lea r8, [rbp - 0x19]
mov rdx, rax
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14000afd3
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
jmp 0x14000b2a5
mov dword [rbp - 0x11], r15d
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14000afe4
mov rdx, qword [rsi]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x17]
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000afb9
xorps xmm0, xmm0
cmp dword [rbp + 0x17], 1
jne 0x14000afbc
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], al
mov eax, dword [rbp - 0x11]
sub eax, 1
mov edi, eax
jne 0x14000b038
mov qword [rbp + 7], rdi
mov byte [rbp + rax - 9], 0
jmp 0x14000b06c
lea rcx, [rbp - 9]
cmp rdi, 0xf
ja 0x14000b057
mov qword [rbp + 7], rdi
mov r8, rdi
xor edx, edx
call fcn.140125b30
mov byte [rbp + rdi - 9], 0
jmp 0x14000b06c
mov byte [rsp + 0x20], 0
mov r9, rdi
movzx r8d, byte [rbp - 0x69]
mov rdx, rdi
call fcn.14000a3d0
lea rax, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rax, qword [rbp - 9]
cmp qword [rsi + 0x18], 0xf
jbe 0x14000b084
mov rsi, qword [rsi]
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xorps xmm0, xmm0
test eax, eax
jne 0x14000b19d
movups xmmword [rbp - 0x61], xmm0
mov rdi, qword [rbp + 7]
lea r14, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova r14, qword [rbp - 9]
movabs rsi, 0x7fffffffffffffff
cmp rdi, rsi
ja 0x14000b2e3
cmp rdi, 0xf
ja 0x14000b101
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x61], xmm0
lea rax, [rbp - 0x61]
mov edi, 3
jmp 0x14000b1bb
mov rax, rdi
or rax, 0xf
cmp rax, rsi
jbe 0x14000b13d
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400f2bb8
mov rcx, rax
test rax, rax
je 0x14000b2e9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000b177
mov ecx, socket
cmp rax, rcx
cmovb rax, rcx
mov rsi, rax
lea rcx, [rax + 1]
test rcx, rcx
jne 0x14000b15a
mov rax, r15
jmp 0x14000b177
cmp rcx, 0x1000
jb 0x14000b172
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b2dd
jmp 0x14000b11b
call fcn.1400f2bb8
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rsi
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140125490
lea rax, [rbp - 0x61]
mov edi, 3
jmp 0x14000b1bb
movups xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x14017d1d0]
movdqu xmmword [rbp - 0x29], xmm1
mov byte [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov edi, 5
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
test dil, 4
je 0x14000b21c
and edi, 0xfffffffb
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14000b21c
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b217
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2e9
call fcn.1400f2bb0
test dil, 2
je 0x14000b25e
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14000b25e
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2e9
call fcn.1400f2bb0
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x14000b295
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b290
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2d7
call fcn.1400f2bb0
mov qword [rbp + 7], r15
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14000b2b8
mov qword [rbp - 0x19], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400f2b90
add rsp, 0xc8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401005b4
nop
call fcn.140002ba0
int3
call fcn.140002c40
int3
call fcn.1401005b4
int3