Function at 0x140012810
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
lea rax, [0x14014191d]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov rax, qword [rcx]
lea rdx, [rbp - 0x50]
call qword [rax + 0x60]
test al, al
je 0x14001287d
mov bl, 1
test rsi, rsi
je 0x140012ba3
mov rcx, qword [rsi + 0x18]
cmp rcx, 2
jae 0x14001296f
lea r9, [0x140141925]
mov edx, 2
jmp 0x1400128c3
lea rax, [0x140141928]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x1d
mov rax, qword [rbx]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [rax + 0x60]
test al, al
je 0x1400128d0
mov bl, 1
test rsi, rsi
je 0x140012ba3
cmp qword [rsi + 0x18], 0x15
jae 0x140012b51
lea r9, [0x140141946]
mov edx, 0x15
mov rcx, rsi
call fcn.140003190
jmp 0x140012ba3
lea rax, str.SSH_CONNECTION
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 0xe
mov rax, qword [rbx]
lea r14, [rbp + 0x28]
lea r8, [rbp - 0x30]
mov rcx, rbx
mov rdx, r14
call qword [rax + 0x50]
cmp qword [rbp + 0x38], 0
je 0x140012991
lea rax, str.SSH_CLIENT
mov qword [rbp], rax
mov qword [rbp + 8], 0xa
mov rax, qword [rbx]
lea rdx, [rbp - 0x20]
mov r8, rbp
mov rcx, rbx
call qword [rax + 0x50]
cmp qword [rbp - 0x10], 0
setne r15b
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140012994
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140012968
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140012bea
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400651e0
jmp 0x140012994
mov rax, rsi
cmp rcx, 0x10
jb 0x14001297b
mov rax, qword [rsi]
mov qword [rsi + 0x10], 2
mov word [rax], 0x584e
mov byte [rax + 2], 0
jmp 0x140012ba3
xor r15d, r15d
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x1400129d3
mov rcx, qword [rbp + 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400129ce
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x140012bea
add rax, 0x28
mov rdx, rax
mov rcx, rdi
call fcn.1400651e0
test r15b, r15b
je 0x140012a73
lea rax, str.DISPLAY
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 7
mov rax, qword [rbx]
lea rdx, [rbp + 0x28]
lea r8, [rbp + 0x10]
mov rcx, rbx
call qword [rax + 0x50]
mov rdi, qword [rbp + 0x38]
mov rax, qword [rbp + 0x40]
cmp rax, 0x10
jb 0x140012a43
mov rcx, qword [rbp + 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140012a3e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140012bea
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
cmp rdi, 3
jb 0x140012a73
mov bl, 1
test rsi, rsi
je 0x140012ba3
mov rcx, qword [rsi + 0x18]
cmp rcx, 0xe
jae 0x140012bb5
lea r9, str.X11_Forwarding
mov edx, 0xe
jmp 0x1400128c3
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, 1
test eax, eax
jne 0x140012b26
mov qword [rbp + 0x28], 0
mov qword [rsp + 0x20], r14
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_Server_
xor edi, edi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140012b17
mov dword [rbp + 0x48], 4
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea rdx, str.GlassSessionId
xor edi, edi
lea r9, [rbp + 0x24]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140012b17
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rbp + 0x4c]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
setne al
mov ecx, dword [rbp + 0x4c]
cmp ecx, dword [rbp - 0x20]
setne cl
and cl, al
movzx edi, cl
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140012b26
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
setne bl
test rsi, rsi
je 0x140012ba3
test edi, edi
je 0x140012ba3
cmp qword [rsi + 0x18], 0x16
jae 0x140012b7a
lea r9, str.Windows_Remote_Desktop
mov edx, 0x16
mov rcx, rsi
call fcn.140003190
jmp 0x140012ba1
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0x15
movabs rcx, 0x706f746b73654420
mov qword [rax + 0xd], rcx
movups xmm0, xmmword [0x140141946]
movups xmmword [rax], xmm0
mov byte [rax + 0x15], 0
jmp 0x140012ba3
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0x16
movabs rcx, 0x706f746b73654420
mov qword [rax + 0xe], rcx
movups xmm0, xmmword [str.Windows_Remote_Desktop]
movups xmmword [rax], xmm0
mov byte [rax + 0x16], 0
mov bl, 1
mov eax, ebx
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rax, rsi
cmp rcx, 0x10
jb 0x140012bc1
mov rax, qword [rsi]
mov qword [rsi + 0x10], 0xe
movabs rcx, 0x676e696472617772
mov qword [rax + 6], rcx
movabs rcx, 0x77726f4620313158
mov qword [rax], rcx
mov byte [rax + 0xe], 0
jmp 0x140012ba3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3