Function at 0x140029800
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
lea rax, [0x140104c29]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 7
mov rax, qword [rcx]
lea rdx, [rbp - 0x48]
call qword [rax + 0x68]
test al, al
je 0x14002986b
mov bl, 1
test rsi, rsi
je 0x140029b98
mov rcx, qword [rsi + 0x18]
cmp rcx, 2
jae 0x14002995e
lea r9, [0x140104c31]
mov edx, 2
jmp 0x1400298b1
lea rax, [0x140104c34]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0x1d
mov rax, qword [rbx]
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [rax + 0x68]
test al, al
je 0x1400298be
mov bl, 1
test rsi, rsi
je 0x140029b98
cmp qword [rsi + 0x18], 0x15
jae 0x140029b46
lea r9, [0x140104c52]
mov edx, 0x15
mov rcx, rsi
call fcn.1400066c0
jmp 0x140029b98
lea rax, str.SSH_CONNECTION
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0xe
mov rax, qword [rbx]
lea rdi, [rbp + 0x30]
lea r8, [rbp - 0x28]
mov rcx, rbx
mov rdx, rdi
call qword [rax + 0x50]
cmp qword [rbp + 0x40], 0
je 0x140029980
lea rax, str.SSH_CLIENT
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0xa
mov rax, qword [rbx]
lea rdx, [rbp - 0x18]
lea r8, [rbp + 8]
mov rcx, rbx
call qword [rax + 0x50]
cmp qword [rbp - 8], 0
setne r14b
mov rax, qword [rbp]
cmp rax, 0x10
jb 0x140029983
mov rcx, qword [rbp - 0x18]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140029957
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140029bdd
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
jmp 0x140029983
mov rax, rsi
cmp rcx, 0x10
jb 0x14002996a
mov rax, qword [rsi]
mov qword [rsi + 0x10], 2
mov word [rax], 0x584e
mov byte [rax + 2], 0
jmp 0x140029b98
xor r14d, r14d
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x1400299c2
mov rcx, qword [rbp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400299bd
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140029bdd
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
test r14b, r14b
je 0x140029a62
lea rax, str.DISPLAY
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 7
mov rax, qword [rbx]
lea rdx, [rbp + 0x30]
lea r8, [rbp + 0x18]
mov rcx, rbx
call qword [rax + 0x50]
mov rbx, qword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
cmp rax, 0x10
jb 0x140029a32
mov rcx, qword [rbp + 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140029a2d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140029bdd
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400fa3b8
cmp rbx, 3
jb 0x140029a62
mov bl, 1
test rsi, rsi
je 0x140029b98
mov rcx, qword [rsi + 0x18]
cmp rcx, 0xe
jae 0x140029ba8
lea r9, str.X11_Forwarding
mov edx, 0xe
jmp 0x1400298b1
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, 1
test eax, eax
jne 0x140029b19
mov qword [rbp + 0x30], 0
mov qword [rsp + 0x20], rdi
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_Server_
xor r14d, r14d
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140029b0a
mov dword [rbp + 0x50], 4
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea rdx, str.GlassSessionId
xor r14d, r14d
lea r9, [rbp + 0x2c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140029b0a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbp + 0x54]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
setne al
mov ecx, dword [rbp + 0x54]
cmp ecx, dword [rbp - 0x18]
setne cl
and cl, al
movzx r14d, cl
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140029b19
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
setne bl
test rsi, rsi
je 0x140029b98
test r14d, r14d
je 0x140029b98
cmp qword [rsi + 0x18], 0x16
jae 0x140029b6f
lea r9, str.Windows_Remote_Desktop
mov edx, 0x16
mov rcx, rsi
call fcn.1400066c0
jmp 0x140029b96
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0x15
movups xmm0, xmmword [0x140104c52]
movups xmmword [rax], xmm0
movabs rcx, 0x706f746b73654420
mov qword [rax + 0xd], rcx
mov byte [rax + 0x15], 0
jmp 0x140029b98
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0x16
movups xmm0, xmmword [str.Windows_Remote_Desktop]
movups xmmword [rax], xmm0
movabs rcx, 0x706f746b73654420
mov qword [rax + 0xe], rcx
mov byte [rax + 0x16], 0
mov bl, 1
mov eax, ebx
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rax, rsi
cmp rcx, 0x10
jb 0x140029bb4
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0xe
movabs rcx, 0x676e696472617772
mov qword [rax + 6], rcx
movabs rcx, 0x77726f4620313158
mov qword [rax], rcx
mov byte [rax + 0xe], 0
jmp 0x140029b98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3