Function at 0x10022d0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60b8
call fcn.01003a10
sub rsp, rax
mov dword [rsp + 0x4c], 4
xor r13d, r13d
mov r15, r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x010050a8], rax
movdqu xmm0, xmmword [0x010014c8]
movdqu xmmword [str..AGRSM], xmm0
lea rbx, [0x010101a0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x103
xor r8d, r8d
lea rdi, [0x010013b0]
mov rdx, rdi
movabs rsi, 0xffffffff80000002
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1002376
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002c6b
mov eax, r13d
lea rcx, [0x010101c0]
mov dword [rcx], eax
add eax, 1
add rcx, 4
cmp eax, 4
jb 0x1002380
lea r12, [0x01010040]
mov qword [rsp + 0x20], r12
mov r14d, 0x101
mov r9d, r14d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
mov ebp, 1
test eax, eax
je 0x10023e6
mov qword [rsp + 0x20], r12
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
test eax, eax
jne 0x1002586
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
lea rdi, [0x010014b0]
mov rdx, rdi
mov rcx, qword [0x01010040]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
test eax, eax
je 0x100243b
mov qword [rsp + 0x20], rbx
mov r9d, ebp
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [0x01010040]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x01010048], eax
test eax, eax
jne 0x1002579
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01001498]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002478
movzx eax, byte [rsp + 0x44]
mov dword [0x010101c0], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01001480]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10024b5
movzx eax, byte [rsp + 0x44]
mov dword [0x010101c4], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01001468]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10024f2
movzx eax, byte [rsp + 0x44]
mov dword [0x010101c8], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01001450]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100252f
movzx eax, byte [rsp + 0x44]
mov dword [0x010101cc], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x01001438]
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100256c
movzx eax, byte [rsp + 0x44]
mov dword [0x01005060], eax
mov rcx, qword [0x010101a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x01010040]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x010101b0], r13d
lea r9, [0x01001418]
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x01007a30], rax
mov ebx, 0xb7
test rax, rax
jne 0x10025c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1002c6b
lea r9, [0x010013f8]
xor r8d, r8d
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x01007a38], rax
test rax, rax
jne 0x10025ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x1002c6b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbp, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [rsp + 0x5c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
mov qword [rsp + 0x70], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsp + 0x54], eax
mov ecx, r13d
mov dword [0x01005098], ecx
mov dword [0x0100509c], r13d
mov r14d, dword [rsp + 0x54]
movzx r12d, word [rsp + 0x48]
mov esi, 4
jmp 0x1002647
mov ecx, dword [0x01005098]
mov ebx, 1
test ecx, ecx
jne 0x1002683
mov ecx, ebx
call fcn.010018d0
test eax, eax
je 0x10026a0
mov dword [0x0100509c], r13d
cmp dword [0x010050a4], 0
je 0x1002c0f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x01005098], 0
je 0x1002650
cmp dword [0x0100509c], 0
jne 0x10026a6
call fcn.01001dc0
test eax, eax
jle 0x10026db
mov dword [0x010050a0], ebx
jmp 0x1002763
mov dword [0x0100509c], ebx
call fcn.01001dc0
test eax, eax
jne 0x10026d0
cmp dword [0x010050a4], 0
je 0x1002c0f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.01001dc0
test eax, eax
je 0x10026af
mov dword [0x010050a0], ebx
jmp 0x1002763
mov dword [0x010050a0], r13d
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [0x01007a30]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
mov rcx, qword [0x01007a30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x01007a38]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test ebx, ebx
je 0x10027dc
mov rcx, qword [section..data]
cmp rcx, 0xffffffffffffffff
je 0x100273f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [section..data], 0xffffffffffffffff
mov dword [0x01005098], r13d
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x010050a0], 0
je 0x1002bad
mov ebx, 1
mov edx, 0x80
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0xf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call fcn.01001dc0
test eax, eax
jle 0x1002ba8
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1b2158
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1002805
cmp byte [rsp + 0x48], 0
je 0x10027ec
cmp byte [0x01005084], 0
jne 0x10027fa
call fcn.010019f0
jmp 0x10027fa
mov ebx, 1
mov dword [0x010050a0], ebx
jmp 0x1002763
cmp byte [0x01005084], 0
je 0x10027fa
call fcn.01001cc0
movzx eax, byte [rsp + 0x48]
mov byte [0x01005084], al
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1b2084
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [0x010050b8]
test eax, eax
je 0x100287d
cmp word [rsp + rax*2 + 0x60], 0
jne 0x100287d
mov rcx, qword [0x010050a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3e8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50], eax
cmp eax, 0x102
je 0x100287d
mov dword [0x010050b8], r13d
mov ecx, ebx
mov dword [rsp + 0x40], ecx
movsxd rax, ecx
cmp word [rsp + rax*2 + 0x60], 0
je 0x100293b
mov eax, dword [0x010050b8]
cmp ecx, eax
je 0x100293b
test eax, eax
jne 0x1002904
call fcn.01001fc0
mov eax, dword [rsp + 0x40]
mov dword [0x010050b8], eax
mov rcx, qword [0x010050a8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [section..data]
mov qword [0x010050b0], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
lea r9, [0x010050a8]
lea r8, [0x01002e80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
test r15, r15
jne 0x1002937
mov dword [0x010050b8], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov rcx, qword [section..data]
mov edx, 0x1b208c
lea r8, [rsp + 0x40]
mov r9d, esi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x40]
add ecx, 1
mov dword [rsp + 0x40], ecx
cmp ecx, 4
jle 0x1002883
cmp dword [0x010050b8], 0
jne 0x1002b30
lea rsi, [rsp + 0x2090]
lea rdi, [rsp + 0x2090]
xor eax, eax
mov ecx, 0x2004
rep stosb byte [rdi], al
lea rbx, [rsp + 0x80]
lea rdi, [rsp + 0x80]
mov ecx, 0x2002
rep stosb byte [rdi], al
mov r14d, r13d
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x2002
mov qword [rsp + 0x20], rbx
mov r9d, 4
lea r8, [rsp + 0x40]
mov edx, 0x1b207c
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, al
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x10029f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x010013e0]
lea rcx, [0x01010060]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r10d, r13d
mov eax, dword [rsp + 0x58]
test eax, eax
jbe 0x1002ad5
lea r10d, [rax - 2]
mov edx, r10d
shr edx, 1
mov r13, rsi
mov ax, word [rbx]
test ax, ax
jl 0x1002a5b
cmp ax, 4
jge 0x1002a5b
movsx rax, ax
lea rcx, [0x010101c0]
mov ax, word [rcx + rax*4]
mov word [rbx], ax
movsx ecx, ax
sub ecx, 1
je 0x1002a56
sub ecx, 1
je 0x1002a4f
sub ecx, 1
je 0x1002a48
mov r12w, 8
jmp 0x1002a5b
mov r12w, 0xd
jmp 0x1002a5b
mov r12w, 0xb
jmp 0x1002a5b
mov r12w, 9
movzx eax, word [0x01005060]
imul ax, r12w
mov r12w, ax
add rbx, 2
test edx, edx
jbe 0x1002ad2
movsx r11d, r12w
mov edi, edx
movsx r8d, word [rbx]
add rbx, 2
mov eax, r8d
cdq
mov ecx, 0x50
idiv ecx
imul edx, r11d
mov eax, 0x66666667
imul edx
mov r9d, edx
sar r9d, 4
mov eax, r9d
shr eax, 0x1f
add r9d, eax
mov ecx, r11d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
add r9w, dx
mov word [r13], r9w
add r13, 2
sub rdi, 1
jne 0x1002a79
xor r13d, r13d
mov eax, r10d
cmp r14d, r10d
cmova eax, r14d
mov r14d, eax
test r10d, r10d
je 0x1002b12
lea rax, [rsp + 0x2090]
cmp rsi, rax
je 0x1002b0a
shr r10d, 1
mov r8d, r10d
mov rdx, rsi
lea rcx, [rsp + 0x2090]
call fcn.010020e0
lea rsi, [rsp + 0x40a0]
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
cmp eax, 4
jle 0x1002993
mov esi, 4
mov ebx, 1
test r14d, r14d
je 0x1002b58
mov dword [0x01005094], 0x3e8
call fcn.01002030
mov ecx, r14d
shr ecx, 1
lea rdx, [rsp + 0x2090]
call fcn.01002120
jmp 0x1002b7e
mov eax, dword [0x01005094]
test eax, eax
je 0x1002b7e
cmp eax, 0x64
ja 0x1002b75
call fcn.01001fc0
mov dword [0x01005094], r13d
jmp 0x1002b7e
add eax, 0xffffff9c
mov dword [0x01005094], eax
cmp dword [0x010050a4], 0
je 0x1002c0f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.01001dc0
test eax, eax
jg 0x100278c
mov rdi, qword [rsp + 0x70]
call fcn.01001fc0
cmp dword [0x010050b8], 0
je 0x1002be3
mov rcx, qword [0x010050a8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3e8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50], eax
cmp eax, 0x102
je 0x1002be3
mov dword [0x010050b8], r13d
call fcn.01001cc0
mov edx, dword [rsp + 0x5c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [0x010050a4], 0
jne 0x1002641
xor ecx, ecx
call fcn.010018d0
mov rcx, qword [0x01007a30]
test rcx, rcx
je 0x1002c2f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x01007a30], r13
mov rcx, qword [0x01007a38]
test rcx, rcx
je 0x1002c48
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x01007a38], r13
mov rcx, qword [section..data]
cmp rcx, 0xffffffffffffffff
je 0x1002c66
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [section..data], 0xffffffffffffffff
call fcn.01001fc0
xor eax, eax
add rsp, 0x60b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret