Function at 0x14002a500
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r15, rcx
call fcn.1400021b0
mov rcx, rax
test rax, rax
je 0x14002ab93
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
call fcn.1400021b0
mov rcx, rax
test rax, rax
je 0x14002ab9e
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov ecx, MsiGetPropertyW
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14, 0xffffffffffffffff
test eax, eax
jne 0x14002ab10
lea rdx, str.AMD_Cleanup_Utility_has_detected_that_your_system_is_not_currently_in_safe_mode._Would_you_like_to_reboot_and_run_in_safe_mode_
lea rcx, [rsp + 0x38]
call fcn.140041c90
lea rdx, [0x1400bebc0]
lea rcx, [rsp + 0x30]
call fcn.140041c90
lea rcx, [0x1400e0e10]
cmp qword [0x1400e0e28], 8
cmovae rcx, qword [0x1400e0e10]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r12d, r12d
test eax, eax
je 0x14002a92f
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r12w
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
lea r8, [rsp + 0x70]
mov edx, 0x87
lea rcx, [rbp - 0x50]
call fcn.14002e550
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x14002a68a
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14002a66a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aba9
call fcn.140070654
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14002a6ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a6c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aba9
call fcn.140070654
lea r8, [rsp + 0x50]
mov edx, 0x7e
lea rcx, [rbp - 0x30]
call fcn.14002e550
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x14002a74d
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002a72c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002abaf
call fcn.140070654
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14002a78e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a788
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002abaf
call fcn.140070654
nop
mov rax, qword [rsp + 0x38]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14002a7e6
mov ecx, dword [rdx + 0x10]
shr ecx, 0x1f
test cl, cl
je 0x14002a7be
cmp dword [rdx + 0xc], 0
jl 0x14002abb5
mov dword [rdx + 8], r12d
mov word [rax], r12w
jmp 0x14002a7e6
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a7d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
jb 0x14002a801
mov rdx, qword [rsp + 0x70]
test rdx, rdx
jne 0x14002a801
mov eax, r12d
jmp 0x14002a80e
mov rax, r14
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002a804
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.1400417f0
nop
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14002a874
mov ecx, dword [rdx + 0x10]
shr ecx, 0x1f
test cl, cl
je 0x14002a84c
cmp dword [rdx + 0xc], 0
jl 0x14002abc0
mov dword [rdx + 8], r12d
mov word [rax], r12w
jmp 0x14002a874
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a862
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
jb 0x14002a890
mov rdx, qword [rsp + 0x50]
test rdx, rdx
jne 0x14002a890
mov eax, r12d
jmp 0x14002a89d
mov rax, r14
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002a893
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.1400417f0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002a8ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a8e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002abcb
call fcn.140070654
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14002a92f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a92a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002abd1
call fcn.140070654
xor bl, bl
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSystemInformation
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002aaa9
mov dword [rsp + 0x44], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.140072740
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.SystemProductName
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002aaa9
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
lea rax, [rbp - 0x10]
mov r8, r14
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002a9d0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.1400027d0
lea rbx, [rbp - 0x70]
mov rdi, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x58]
cmp rsi, 8
cmovae rbx, rdi
nop dword [rax]
lea rax, [rbp - 0x70]
cmp rsi, 8
cmovae rax, rdi
mov rdx, qword [rbp - 0x60]
lea rax, [rax + rdx*2]
cmp rbx, rax
je 0x14002aa32
movzx ecx, word [rbx]
call fcn.1400819a4
mov word [rbx], ax
add rbx, 2
mov rsi, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x70]
jmp 0x14002aa00
lea rcx, [rbp - 0x70]
cmp rsi, 8
cmovae rcx, rdi
mov qword [rsp + 0x20], 7
lea r9, str.virtual
xor r8d, r8d
call fcn.1400176b0
cmp rax, 0xffffffffffffffff
setne bl
cmp rsi, 8
jb 0x14002aa98
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002aa90
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ab8d
mov rcx, rdi
call fcn.140070654
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x14002aad3
lea rcx, str.___________________VM_Detected__________________
call fcn.1400262b0
mov rcx, r15
call fcn.1400350a0
mov rbx, qword [rsp + 0x30]
jmp 0x14002ab19
mov rbx, qword [rsp + 0x30]
cmp byte [r15 + 0x454], 0
jne 0x14002ab83
cmp byte [r15 + 0x452], 0
jne 0x14002ab10
mov r9d, 0x144
mov r8, rbx
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 6
je 0x14002ab83
cmp eax, 1
jne 0x14002ab19
mov rcx, r15
call fcn.1400350a0
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002ab34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14002ab53
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
mov eax, 1
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, r15
call fcn.14002ec10
jmp 0x14002ab19
call fcn.14007d0fc
nop
mov ecx, 0x80004005
call fcn.1400277b0
nop
mov ecx, 0x80004005
call fcn.1400277b0
nop
call fcn.14007d0fc
int3
call fcn.14007d0fc
nop
mov ecx, 0x80070057
call fcn.1400277b0
nop
mov ecx, 0x80070057
call fcn.1400277b0
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3