Function at 0x140002dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140094010]
xor rax, rsp
mov qword [rbp + 0x270], rax
xor r15d, r15d
cmp qword [0x140094c08], r15
jne 0x140002e92
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov qword [0x140094c08], rax
test rax, rax
jne 0x140002e3c
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x140002e92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_job_object__error:0x_08lx._n
call fcn.140004600
jmp 0x140002e92
mov r9d, 0x90
mov dword [rbp + 0x30], 0x2000
lea r8, [rbp + 0x20]
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x140002e92
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x140002e7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_set_limit_for_the_job_object__error:0x_08lx._n
call fcn.140004600
mov rcx, qword [0x140094c08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140094c08], r15
cmp dword [0x140094c00], r15d
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3a8], rsi
mov qword [rsp + 0x3b0], r14
je 0x140002fae
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov rdi, rax
test rax, rax
je 0x140002fbb
xor edx, edx
lea rcx, [rbp + 0x170]
mov r8d, 0x100
call fcn.1400074f0
mov r9d, 0x100
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x170]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetUserObjectInformationA]
mov rdx, 0xffffffffffffffff
lea rax, [rbp + 0x170]
mov rbx, rdx
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140002f16
movsxd r14, ebx
mov rcx, r14
add rcx, 0x11
cmovb rcx, rdx
call fcn.140017574
mov rsi, rax
test rax, rax
jne 0x140002f5a
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x140002fbb
lea rdx, str.AddDesktopInfo
lea rcx, str._s:_DesktopInfo_malloc_failed._n
call fcn.140004600
jmp 0x140002fbb
lea eax, [rbx + 1]
mov r9, r14
movsxd rdx, eax
lea rcx, [rsi + 0x10]
lea r8, [rbp + 0x170]
call fcn.140016cec
mov qword [rsi + 8], rdi
xor ecx, ecx
mov rax, qword [0x1400968d8]
mov qword [rsi], rax
mov qword [0x1400968d8], rsi
call fcn.140004c40
test al, al
je 0x140002fbb
mov edx, dword [0x140094c00]
lea r8, [rbp + 0x170]
lea rcx, str.__d__Desktop__s_added__spawning_new_thread._n
call fcn.140004600
jmp 0x140002fbb
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
call fcn.1400015f0
call fcn.1400017b0
mov r14, qword [rsp + 0x3b0]
mov rdi, rax
mov rsi, qword [rsp + 0x3a8]
test rax, rax
jne 0x140002ff6
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x140002fef
lea rcx, str.VM3DService_failed_to_create_window._n
call fcn.140004600
xor al, al
jmp 0x1400033b9
cmp dword [0x140094c10], r15d
je 0x140003016
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
lea rcx, str.VMdesktopEventsVM3DServiceShutdownMsg
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x140094c14], eax
test eax, eax
jne 0x14000304b
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x14000304b
lea rdx, str.ServiceInit
lea rcx, str._s:_Unable_to_register_shutdown_message._n
call fcn.140004600
cmp dword [0x140094c00], r15d
jne 0x140003079
mov edx, 1
mov rcx, rdi
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
test eax, eax
jne 0x1400030e4
lea rdx, str.VM3DService_failed_WTSRegisterSessionNotification___n
xor ecx, ecx
call fcn.140004c70
jmp 0x1400030e4
mov edx, 0x20
mov dword [rsp + 0x30], 2
mov ecx, edx
mov dword [rsp + 0x28], r15d
lea r9, [fcn.140001930]
mov dword [rsp + 0x20], r15d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SetWinEventHook]
mov qword [0x1400968e0], rax
test rax, rax
jne 0x1400030c3
lea rdx, str.VM3DService_failed_SetWinEventHook__
xor ecx, ecx
call fcn.140004c70
mov rax, qword [0x1400968e0]
xor r9d, r9d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov rcx, rax
mov dword [rsp + 0x20], r15d
lea edx, [r9 + 0x20]
call fcn.140001930
call fcn.140003620
lea rcx, str.powrprof.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140003117
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_load_powrprof.dll:__u_n
xor ecx, ecx
mov r8d, eax
call fcn.140004c70
jmp 0x140003190
lea rdx, str.GetCurrentPowerPolicies
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000313b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_lookup_GetCurrentPowerPolicies:__u_n
jmp 0x14000317d
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0xb0]
call qword [0x14007b5a0]
test rax, rax
je 0x140003170
mov r8d, dword [rbp - 0x54]
lea rdx, str.Windows_Power_Sleep_timeout:__lu_seconds_n
xor ecx, ecx
call fcn.140004c70
mov r8d, dword [rbp - 0x38]
lea rdx, str.Windows_Display_Sleep_timeout:__lu_seconds_n
jmp 0x140003180
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Unable_to_retrieve_Power_Policy:__u_n
mov r8d, eax
xor ecx, ecx
call fcn.140004c70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx ecx, byte [0x1400966cc]
mov ebx, r15d
mov eax, dword [0x1400966c0]
mov dword [rbp - 0x7c], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x64], r15d
test cl, cl
je 0x1400031be
test eax, eax
je 0x1400031be
cmp byte [0x1400968c0], bl
je 0x1400031c3
mov ebx, 1
test cl, cl
je 0x1400031cb
test eax, eax
jne 0x14000320e
cmp dword [0x140094c00], r15d
jne 0x1400031fb
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x1400032ab
lea rdx, str.IsAdapterPresent
lea rcx, str._s:_Session0_is_not_allowed_to_open_the_adapter._n
call fcn.140004600
jmp 0x1400032ab
call fcn.140002460
test al, al
je 0x1400032ab
mov eax, dword [0x1400966c0]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x48]
lea rax, [rsp + 0x78]
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], rax
mov eax, dword [0x140094c00]
mov dword [rbp - 0x80], eax
mov rax, qword [0x140096778]
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x60], 0x10
mov dword [rsp + 0x78], 0x1d
mov dword [rsp + 0x7c], 8
call qword [0x14007b5a0]
mov ebx, eax
cmp eax, 0xc00002b6
jne 0x140003288
call fcn.140002460
test al, al
je 0x14000328c
mov eax, dword [0x1400966c0]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov rax, qword [0x140096778]
call qword [0x14007b5a0]
mov ebx, eax
test ebx, ebx
jns 0x1400032a0
lfence
mov r8d, ebx
lea rdx, str.Unable_to_query_service_config:_0x_08x_n
xor ecx, ecx
call fcn.140004c70
mov rax, qword [rbp - 0x80]
mov qword [0x1400966c4], rax
mov rax, qword [0x1400966c4]
lea rdx, str.VM3DService_requestTopo_u_n
shr rax, 0x20
mov ecx, 2
movsx r8d, al
call fcn.140004c70
movsx r8d, byte [0x1400966c9]
lea rdx, str.VM3DService_forceSetSameTopo_u_n
mov ecx, 2
call fcn.140004c70
cmp byte [0x1400966c8], r15b
je 0x1400032f2
call fcn.1400025e0
cmp qword [0x1400968e8], r15
jne 0x14000330c
xor edx, edx
mov rcx, rdi
call fcn.140002330
mov qword [0x1400968e8], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x6c], r15d
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x70], 4
lea rdx, str.SYSTEMCurrentControlSetServices_vm3dservice
mov dword [rsp + 0x68], r15d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000339a
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.ToolsInstall
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000339a
cmp dword [rsp + 0x68], 4
jne 0x14000339a
cmp dword [rsp + 0x6c], 1
jne 0x14000339a
mov al, 1
jmp 0x14000339c
xor al, al
test al, al
lea rcx, str.VM3DService_WDDM_Install:_Non_VMTools_n
lea rdx, str.VM3DService_WDDM_Install:_VMTools_n
cmove rdx, rcx
xor ecx, ecx
call fcn.140004c70
mov al, 1
mov rbx, qword [rsp + 0x3a0]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140006280
add rsp, 0x380
pop r15
pop rdi
pop rbp
ret