Function at 0x14002b820
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rbx, rdx
mov dword [rsp + 0x50], ecx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14004e310
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, str.AutoRuns
call fcn.140010550
mov r12d, 1
test eax, eax
je 0x14002b8ce
mov ecx, r12d
call fcn.14005a668
mov rcx, rax
call fcn.14005b384
mov ecx, eax
mov edx, 0x20000
call fcn.14005b940
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
test eax, 0xfffffffd
jne 0x14002b8ce
mov rcx, qword [0x1400a6040]
lea rdx, [0x140082f84]
mov r8d, 0xfeff
call fcn.1400117d0
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, str.AutoRuns
call fcn.140011340
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, str.AutoRuns
call fcn.140010aa0
test eax, eax
jne 0x14002b902
mov eax, r12d
jmp 0x14002be65
call fcn.140006a80
call fcn.140016d30
mov ecx, dword [rsp + 0x50]
lea r8, [rsp + 0x64]
mov rdx, rbx
call fcn.140018fc0
test al, al
jne 0x14002b92b
mov eax, 0xffffffff
jmp 0x14002be65
mov qword [rsp + 0x4e8], rdi
lea r8, [rsp + 0x68]
xor edi, edi
mov dword [rsp + 0x60], 4
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov qword [rsp + 0x68], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x5c], edi
mov ebx, edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14002b9b6
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.NanoServer
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002b9ab
cmp dword [rsp + 0x58], 4
jne 0x14002b9ab
cmp dword [rsp + 0x5c], r12d
cmove ebx, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1400a48ec], edi
mov dword [0x1400a5978], ebx
je 0x14002ba15
cmp dword [0x1400a576c], r12d
movzx edx, r12b
sete r9b
cmp byte [0x1400a468d], r12b
sete r8b
xor ecx, ecx
call fcn.140044c00
mov ebx, eax
test eax, eax
je 0x14002ba15
mov ecx, 2
call fcn.14005a668
mov rcx, rax
lea rdx, str.Unable_to_initialize_VirusTotal_connection:_n
call fcn.1400117d0
mov ecx, ebx
call fcn.14001f3a0
mov eax, 0xffffffff
jmp 0x14002be5d
cmp byte [0x1400a468e], dil
mov qword [rsp + 0x4e0], rsi
mov qword [rsp + 0x4a8], r14
lea r14, str.autoruns
mov qword [rsp + 0x4a0], r15
mov r15d, 0x61
je 0x14002bb62
movzx r8d, word [0x1400a2ce4]
lea rdx, str.Time_cEntry_Location_cEntry_cEnabled_cCategory_cProfile_cDescription_c
mov rcx, qword [0x1400a6040]
mov r9d, r8d
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
call fcn.1400117d0
cmp dword [0x1400a36f0], edi
je 0x14002baa1
movzx r8d, word [0x1400a2ce4]
lea rdx, str.Signer_c
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
movzx r8d, word [0x1400a2ce4]
lea rdx, str.Company_cImage_Path_cVersion_cLaunch_String
mov rcx, qword [0x1400a6040]
mov r9d, r8d
mov dword [rsp + 0x20], r8d
call fcn.1400117d0
cmp dword [0x1400a48ec], edi
je 0x14002baea
movzx r8d, word [0x1400a2ce4]
lea rdx, str._cVT_detection_cVT_permalink
mov rcx, qword [0x1400a6040]
mov r9d, r8d
call fcn.1400117d0
cmp dword [0x1400a48a4], edi
je 0x14002bb24
movzx r8d, word [0x1400a2ce4]
lea rdx, str._cMD5_cSHA_1_cPESHA_1_cPESHA_256_cSHA_256_cIMP
mov rcx, qword [0x1400a6040]
mov r9d, r8d
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
call fcn.1400117d0
cmp dword [0x1400a48a8], edi
je 0x14002bb4a
movzx r8d, word [0x1400a2ce4]
lea rdx, str._cWmi_Query_cScript_Language
mov rcx, qword [0x1400a6040]
mov r9d, r8d
call fcn.1400117d0
mov rcx, qword [0x1400a6040]
lea rdx, [0x14007a934]
call fcn.1400117d0
jmp 0x14002bc12
cmp byte [0x1400a468f], dil
je 0x14002bc12
mov ecx, r12d
call fcn.14005a668
mov ecx, 0x3c
mov rdx, rax
mov rsi, rax
call fcn.14005c798
mov r8d, 0x3f
lea rbx, str._xml_version_1.0__encoding_utf_16__
mov rdx, rsi
movzx ecx, r8w
call fcn.14005c798
movzx ecx, word [rbx + 2]
lea rbx, [rbx + 2]
movzx r8d, cx
test cx, cx
jne 0x14002bb94
mov ecx, 0x3e
mov rdx, rsi
call fcn.14005c798
mov rcx, qword [0x1400a6040]
lea rdx, [0x14007a934]
call fcn.1400117d0
mov ecx, r12d
call fcn.14005a668
mov ecx, 0x3c
mov rdx, rax
mov rsi, rax
call fcn.14005c798
movzx ecx, r15w
mov rbx, r14
mov rdx, rsi
call fcn.14005c798
movzx ecx, word [rbx + 2]
lea rbx, [rbx + 2]
test cx, cx
jne 0x14002bbf0
mov ecx, 0x3e
mov rdx, rsi
call fcn.14005c798
xor ecx, ecx
call fcn.1400167b0
mov rbx, qword [0x1400a5b88]
mov edx, r12d
mov esi, dword [rsp + 0x64]
mov ecx, esi
mov qword [0x1400a5b88], rdi
call fcn.140025ae0
mov rcx, qword [0x1400a5be0]
mov qword [0x1400a5b88], rbx
test rcx, rcx
jne 0x14002bc58
xor edx, edx
mov ecx, esi
call fcn.140025ae0
mov rcx, qword [0x1400a5be0]
mov rdx, qword [0x1400a6598]
mov rax, rdx
sub rax, qword [0x1400a6590]
test rax, 0xfffffffffffffff8
jne 0x14002bc8f
mov ecx, 2
call fcn.14005a668
mov rdx, rax
lea rcx, str.No_other_accounts_detected_on_this_system._n_n
call fcn.14005c5c0
jmp 0x14002bde1
test rcx, rcx
je 0x14002bcc1
lea rdx, [rsp + 0x70]
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14002bca0
lea rcx, [rsp + 0x70]
call fcn.14005c190
mov rdx, qword [0x1400a6598]
sub rdx, qword [0x1400a6590]
sar rdx, 3
test rdx, rdx
je 0x14002bde1
mov rcx, rdi
nop dword [rax + rax]
mov rax, qword [0x1400a6590]
lea rbx, [rcx*8]
lea rdx, [rbp + 0x180]
mov rcx, qword [rbx + rax]
add rcx, 0x210
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x14002bd01
lea rcx, [rbp + 0x180]
call fcn.14005c190
cmp qword [0x1400a5be0], 0
jne 0x14002bd3a
mov rax, qword [0x1400a6590]
mov rcx, qword [rbx + rax]
cmp byte [rcx], 0
jne 0x14002bd70
movzx eax, word [rsp + 0x70]
cmp ax, 0x2a
jne 0x14002bd4d
cmp word [rsp + 0x72], 0
je 0x14002bd70
test ax, ax
je 0x14002be8a
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call fcn.14004ebac
test rax, rax
je 0x14002be8a
mov rax, qword [0x1400a6590]
mov rdx, qword [0x1400a5b88]
mov rcx, qword [rbx + rax]
mov r8d, dword [rcx + 4]
xor ecx, ecx
call fcn.14002a900
test al, al
jne 0x14002be80
cmp word [rsp + 0x70], 0x2a
jne 0x14002bda9
cmp word [rsp + 0x72], 0
je 0x14002be8a
mov rax, qword [0x1400a6590]
mov ecx, 2
mov rbx, qword [rbx + rax]
call fcn.14005a668
lea r8, [rbx + 0x210]
mov rcx, rax
lea rdx, str.Error_switching_to_profile__s:_n
call fcn.1400117d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001f3a0
cmp byte [0x1400a468f], 0
mov rsi, qword [rsp + 0x4e0]
je 0x14002be4b
mov ecx, r12d
call fcn.14005a668
mov ecx, 0x3c
mov rdx, rax
mov rbx, rax
call fcn.14005c798
mov ecx, 0x2f
mov rdx, rbx
call fcn.14005c798
nop word [rax + rax]
mov rdx, rbx
movzx ecx, r15w
call fcn.14005c798
movzx eax, word [r14 + 2]
lea r14, [r14 + 2]
movzx r15d, ax
test ax, ax
jne 0x14002be20
mov ecx, 0x3e
mov rdx, rbx
call fcn.14005c798
mov r15, qword [rsp + 0x4a0]
xor eax, eax
mov r14, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x4e8]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14004bd30
add rsp, 0x4b0
pop r12
pop rbx
pop rbp
ret
xor edx, edx
mov rcx, rsi
call fcn.140025ae0
mov rax, qword [0x1400a6598]
inc edi
sub rax, qword [0x1400a6590]
sar rax, 3
mov ecx, edi
cmp rcx, rax
jb 0x14002bce0
jmp 0x14002bde1