Function at 0x1400287e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
mov eax, 0x48
call fcn.140189b00
sub rsp, rax
xor edi, edi
lea rax, [rsp + 0x78]
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionMisc.
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002893c
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.EnableSampleSubmission
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x60]
test eax, eax
mov eax, edi
cmovne ecx, edi
lea r9, [rsp + 0x70]
lea rdx, str.SampleSubmissionFolderSizeInMB
mov dword [rsp + 0x60], ecx
test ecx, ecx
setne al
xor r8d, r8d
xchg dword [0x14023c7fc], eax
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400288e3
mov eax, dword [rsp + 0x60]
cmp eax, 0x258
ja 0x1400288e3
test eax, eax
jne 0x1400288ec
mov eax, Ordinal_301
mov dword [rsp + 0x60], eax
imul eax, eax, 0xf4240
mov r8d, gethostname
lea rbx, str.LoadSampleSubmissionAndAtseConfiguration
mov dword [rsp + 0x30], eax
mov dword [0x14023c804], eax
mov eax, dword [0x14023c7fc]
mov dword [rsp + 0x28], eax
lea r9, str._s___EnableSampleSubmission:__d__Folder_Size__Byte_:__d
lea rdx, str..cnttmss_AtseScan.cpp
lea ecx, [r8 + 0xf]
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140028969
mov r8d, Ordinal_60
mov dword [rsp + 0x28], eax
lea rbx, str.LoadSampleSubmissionAndAtseConfiguration
lea r9, str._s___registry_key_error__d_
lea rdx, str..cnttmss_AtseScan.cpp
lea ecx, [r8 + 0xa]
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
lea rax, [rsp + 0x78]
lea rdx, str.SOFTWARETrendMicroPC_cillinNTCorpCurrentVersionReal_Time_Scan_Configuration
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028a9c
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.EnableAtseCveExploitAction
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x60]
test eax, eax
mov eax, edi
cmovne ecx, edi
lea r9, [rsp + 0x70]
lea rdx, str.EnableAtseCveActionQuarantine
mov dword [rsp + 0x60], ecx
test ecx, ecx
setne al
xor r8d, r8d
xchg dword [0x14023c800], eax
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r8d, dword [rsp + 0x60]
lea r9, str._s___g_bEnableAtseScanAction:__d___g_nAtseScanAction:__d_
test eax, eax
lea rdx, str..cnttmss_AtseScan.cpp
cmovne r8d, edi
mov dword [rsp + 0x60], r8d
neg r8d
mov r8d, reloc.WLDAP32.dll_Ordinal_79
sbb eax, eax
lea ecx, [r8 - 0xb]
add eax, 2
xchg dword [0x1401f3010], eax
mov eax, dword [reloc.WS2_32.dll_accept]
mov dword [rsp + 0x30], eax
mov eax, dword [0x14023c800]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x48
pop rdi
pop rbx
ret
mov r8d, 0x55
mov dword [rsp + 0x28], eax
lea r9, str._s___registry_key_error__d_
lea rdx, str..cnttmss_AtseScan.cpp
lea ecx, [r8 - 0x11]
mov qword [rsp + 0x20], rbx
call fcn.1400382e0
add rsp, 0x48
pop rdi
pop rbx
ret