Function at 0x140001260
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ecx, ecx
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x30], rax
lea r8, str.VirtualTerminalLevel
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9d, [rcx + 0x10]
mov qword [rsp + 0x20], rcx
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov ecx, 0x80
mov edi, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001330
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x140001327
lea r9, [rsp + 0x58]
mov edx, 0x80
lea r8, str.__X_
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
test rax, rax
je 0x140001327
mov rdx, rbx
lea rcx, str.e_38_5_240m_s_e_0m_e_38_5_117mie_0m__Attempting_to_read_value_from_ComputerHKEY_CURRENT_USERConsoleVirtualTerminalLevel..._n
call fcn.1400011a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
jne 0x140001449
cmp dword [rsp + 0x40], 1
mov ecx, 0x80
je 0x1400013bd
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400014b3
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x1400014aa
lea r9, [rsp + 0x58]
mov edx, 0x80
lea r8, str.__X_
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
test rax, rax
je 0x1400014aa
mov r8d, dword [rsp + 0x40]
lea rcx, str.e_38_5_240m_s_e_0m_e_38_5_203m_e_0m__ComputerHKEY_CURRENT_USERConsoleVirtualTerminalLevel_exists_but_isnt_set_to_one...___lu__n
mov rdx, rbx
call fcn.1400011a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x140001428
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140001426
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x14000141d
lea r9, [rsp + 0x58]
mov edx, 0x80
lea r8, str.__X_
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
test rax, rax
je 0x14000141d
mov r8d, dword [rsp + 0x40]
lea rcx, str.e_38_5_240m_s_e_0m_e_38_5_154me_0m__ComputerHKEY_CURRENT_USERConsoleVirtualTerminalLevel_is_already_set_to_one___lu___n
mov rdx, rbx
call fcn.1400011a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140002610
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
cmp edi, 2
jne 0x140001426
lea ecx, [rdi + 0x7e]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400014b3
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
jne 0x1400014aa
lea r9, [rsp + 0x58]
mov rcx, rbx
lea r8, str.__X_
lea edx, [rdi + 0x7e]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
test rax, rax
je 0x1400014aa
mov rdx, rbx
lea rcx, str.e_38_5_240m_s_e_0m_e_38_5_203m_e_0m__ComputerHKEY_CURRENT_USERConsoleVirtualTerminalLevel_wasnt_found__n
call fcn.1400011a0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x140001428