Function at 0x140002b24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r12
push r14
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140019158]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
mov rcx, qword [0x140019138]
lea r12, [0x140019138]
cmp rcx, r12
je 0x140002b95
test byte [rcx + 0x1c], 1
je 0x140002b95
mov r9, qword [rsi + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], r14
call fcn.14000286c
mov edx, Ordinal_41
lea ecx, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x140002bea
lea ebx, [rax + 8]
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x14000300a
test byte [rcx + 0x1c], 2
je 0x140002fe7
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xb]
mov r9d, ebx
lea r8, [0x1400155e0]
call fcn.140001034
jmp 0x140002fe0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x105
mov qword [rsp + 0x28], rax
lea rdx, str.SPBroadcastAddr
lea rax, [rbp - 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002c5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, ntohl
lea r9, str.SPBroadcastAddr
jmp 0x140002f5b
dec dword [rsp + 0x30]
lea r8, [rsp + 0x44]
lea rdx, [rbp - 0x40]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_InetPtonW]
nop dword [rax + rax]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsi + 0x18]
mov dword [rcx], eax
mov rax, qword [rsi + 0x18]
cmp dword [rax], 0
jne 0x140002cbb
mov r9d, 0x57
mov ebx, r9d
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
lea edx, [r9 - 0x4a]
jmp 0x140002fbb
mov ebx, 4
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPBroadcastRetry
add rax, rbx
mov dword [rsp + 0x30], ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002d2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, reloc.WS2_32.dll_ntohl
lea r9, str.SPBroadcastRetry
jmp 0x140002f5b
mov rax, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPUpdateMinutes
add rax, 0xc
mov dword [rsp + 0x30], ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x18]
test eax, eax
je 0x140002d76
mov eax, dword [0x140019170]
jmp 0x140002d94
mov eax, 0x2760
cmp dword [rcx + 0xc], eax
ja 0x140002d86
cmp dword [rcx + 0xc], 0
jne 0x140002d8d
mov dword [rcx + 0xc], eax
mov rcx, qword [rsi + 0x18]
imul eax, dword [rcx + 0xc], 0xea60
mov dword [rcx + 0xc], eax
lea rdx, str.SPTimeoutSeconds
mov rax, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
add rax, 8
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002e0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, recvfrom
lea r9, str.SPTimeoutSeconds
jmp 0x140002f5b
mov rax, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPMaxNodes
add rax, 0x10
mov dword [rsp + 0x30], ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002e7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, reloc.WS2_32.dll_recv
lea r9, str.SPMaxNodes
jmp 0x140002f5b
mov rax, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPBrowseMethod
add rax, 0x14
mov dword [rsp + 0x30], ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, reloc.WS2_32.dll_recvfrom
lea r9, str.SPBrowseMethod
jmp 0x140002f5b
mov rax, qword [rsi + 0x18]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
lea rdx, str.SPGetHostByAddr
add rax, 0x18
mov dword [rsp + 0x30], ebx
mov rcx, r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140002f6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, reloc.WS2_32.dll_select
lea r9, str.SPGetHostByAddr
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400027e0
jmp 0x140002fcb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov rcx, qword [rsi + 0x18]
mov qword [rcx + 0x20], rax
mov rax, qword [rsi + 0x18]
cmp qword [rax + 0x20], 0
jne 0x14000300e
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140002fcb
test byte [rcx + 0x1c], 2
je 0x140002fcb
mov edx, socket
mov r9d, eax
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400155e0]
call fcn.140001034
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
and qword [rsi + 0x18], 0
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x14000300a
test byte [rcx + 0x1c], 2
je 0x14000300a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400155e0]
mov edx, reloc.WS2_32.dll_setsockopt
mov r9d, ebx
call fcn.140001034
mov eax, ebx
jmp 0x140003037
mov rcx, qword [0x140019138]
cmp rcx, r12
je 0x140003035
test byte [rcx + 0x1c], 1
je 0x140003035
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400155e0]
mov edx, reloc.WS2_32.dll_sendto
call fcn.140001008
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400131f0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rbp
ret