Function at 0x14019ae90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x500], rbx
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov r12b, 1
call fcn.14019b210
mov esi, eax
cmp eax, 0xffffffff
jne 0x14019aeec
lea esi, [rax + 3]
jmp 0x14019aef6
mov eax, 0x3e7
cmp esi, eax
cmovge esi, eax
xor r13d, r13d
mov qword [rsp + 0x30], r13
lea rdx, [rbx + 0xb0]
cmp qword [rdx + 0x18], 0x10
jb 0x14019af0f
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r14, qword [rsp + 0x30]
test eax, eax
je 0x14019af52
test r14, r14
je 0x14019b0f0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, r13
mov qword [rsp + 0x30], r13
test r14, r14
je 0x14019b0f0
mov ebx, 1
cmp esi, ebx
jl 0x14019b0e6
nop dword [rax + rax]
mov byte [rsp + 0x78], 0
xor eax, eax
mov qword [rsp + 0x79], rax
mov qword [rbp - 0x7f], rax
mov qword [rbp - 0x77], rax
mov dword [rbp - 0x6f], eax
mov word [rbp - 0x6b], ax
mov byte [rbp - 0x69], al
mov r8d, ebx
lea rdx, [0x140216f18]
lea rcx, [rsp + 0x78]
call fcn.1400a61e0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.140141ad0
mov dword [rsp + 0x38], 0x3ff
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14019b0b8
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x70], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x58], 0
cmp byte [rbp - 0x60], 0
jne 0x14019b013
mov r8, r13
jmp 0x14019b02a
lea rax, [rbp - 0x60]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14019b020
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.140009d60
nop
mov dword [rsp + 0x40], ebx
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x14019b0e0
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
sete dil
mov rax, qword [rsp + 0x70]
cmp rax, 0x10
jb 0x14019b0a0
inc rax
mov rcx, qword [rsp + 0x58]
cmp rax, 0x1000
jb 0x14019b09b
test cl, 0x1f
jne 0x14019b0d5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14019b0cf
sub rcx, rax
cmp rcx, 8
jb 0x14019b0c9
cmp rcx, 0x27
ja 0x14019b0c3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0x70], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x68], r13
mov byte [rsp + 0x58], 0
test dil, dil
jne 0x14019b0db
inc ebx
cmp ebx, esi
jg 0x14019b0e6
jmp 0x14019af70
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
call fcn.14014b4d8
int3
xor r12b, r12b
jmp 0x14019b0e6
call fcn.140114c64
nop
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x14019b10a
mov r8, qword [rcx]
cmp rcx, r15
setne dl
call qword [r8 + 0x20]
mov qword [r15 + 0x38], r13
movzx eax, r12b
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140113910
mov rbx, qword [rsp + 0x500]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret