Function at 0x14002b6f0
Capabilities:
Get proxy
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x460
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor edx, edx
mov r8d, 0xc08
mov rbx, rcx
call fcn.140041940
xor edi, edi
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x3ff
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x38], edi
mov byte [rsp + 0x50], dil
call fcn.140041940
lea r11, [rsp + 0x40]
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersion
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002b960
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.UseProxy
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002b7c6
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
cmp dword [rbx], edi
je 0x14002b953
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
call fcn.140041940
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.ProxyServer
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002b831
lea rcx, [rbx + 4]
lea r8, [rsp + 0x50]
mov edx, 0x3ff
call fcn.1400433f0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.ProxyPort
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002b87d
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x404], eax
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
call fcn.140041940
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.ProxyLogin
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002b8e3
lea rcx, [rbx + 0x408]
lea r8, [rsp + 0x50]
mov edx, 0x3ff
call fcn.1400433f0
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
call fcn.140041940
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.ProxyPwd
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14002b953
lea rcx, [rsp + 0x50]
call fcn.14003b120
lea rcx, [rbx + 0x808]
lea r8, [rsp + 0x50]
mov edx, 0x3ff
call fcn.1400433f0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002b98e
mov dword [rsp + 0x28], eax
lea rax, str.ReadProxySetting
lea r9, str._s___registry_key_error__d_
lea rdx, str..cnttmss_UploadSample.cpp
mov r8d, 0x34a
mov ecx, 0x44
mov qword [rsp + 0x20], rax
call fcn.1400382e0
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret