Function at 0x100004954
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x540
mov rax, qword [0x10001d1d0]
xor rax, rsp
mov qword [rsp + 0x530], rax
xor ebp, ebp
lea rax, [r11 - 0x4e0]
mov rbx, 0xffffffff80000002
lea rdx, str.systemcurrentcontrolsetcontrol_stagedboot
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x78], ebp
mov dword [rsp + 0x50], ebp
mov qword [r11 - 0x4e0], rbp
mov rsi, rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
lea r13, [0x10001d1e0]
lea r12d, [rbp + 2]
lea r15, [0x100015650]
lea r14d, [rbp + 4]
cmp eax, ebp
je 0x100007db0
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004a1a
test byte [rcx + 0x1c], 1
je 0x100004a1a
cmp byte [rcx + 0x19], r14b
jb 0x100004a1a
mov rcx, qword [rcx + 0x10]
mov edx, 0x3f
mov r8, r15
call fcn.10000121c
call fcn.1000052b4
mov edi, eax
cmp eax, ebp
jne 0x100007e41
mov eax, 8
lea rdx, [rsp + 0x70]
mov cl, 1
mov word [0x10001d194], ax
call qword [sym.imp.ntdll.dll_RtlCreateEnvironment]
cmp eax, ebp
jl 0x100007e74
lea rcx, [rsp + 0x70]
call fcn.100003e60
lea rcx, [rsp + 0x70]
call fcn.100003b44
jmp 0x100004a60
lea rax, [rsp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x100004acd
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.DontWatchSysProcs
xor r8d, r8d
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebp
je 0x100007ea7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea rcx, str._SystemRoot__system32_services.exe
xor r8d, r8d
xor edx, edx
call fcn.100003580
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rbp
je 0x100008288
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004b1b
test byte [rcx + 0x1c], 1
je 0x100004b1b
cmp byte [rcx + 0x19], r14b
jb 0x100004b1b
mov rcx, qword [rcx + 0x10]
mov edx, 0x42
mov r9, rax
mov r8, r15
call fcn.100003504
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
lea rdx, [0x100015c90]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x20], 0x80
call fcn.100004e00
lea rcx, [rsp + 0x68]
mov edi, eax
call fcn.1000031b0
cmp edi, ebp
jne 0x100007ec2
mov eax, 9
mov word [0x10001d194], ax
cmp dword [0x10001d1ac], ebp
jne 0x100007ef0
lea rax, [rsp + 0x58]
lea rdx, str.SYSTEMCurrentControlSetControlWatchdogDisplay
mov r9d, 0x2001b
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebp
je 0x100007f08
lea rax, [rsp + 0x58]
mov edi, 0x20019
lea rdx, str.SYSTEMCurrentControlSetControlCrashControlMachineCrash
xor r8d, r8d
mov rcx, rbx
mov r9d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebp
je 0x100008141
lea rax, [rsp + 0x58]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionReliability
mov r9d, edi
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x100004c58
mov rcx, qword [rsp + 0x58]
lea rdx, str.ShutdownEventPending
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp eax, ebp
je 0x100004c45
mov rcx, qword [rsp + 0x58]
lea rdx, str.ShutdownStateSnapshot
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp edi, ebp
je 0x10000814e
xor r8d, r8d
lea rcx, str._SystemRoot__system32lsass.exe
lea edx, [r8 + 1]
call fcn.100003580
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rbp
je 0x100008288
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004ca8
test byte [rcx + 0x1c], 1
je 0x100004ca8
cmp byte [rcx + 0x19], r14b
jb 0x100004ca8
mov rcx, qword [rcx + 0x10]
mov edx, 0x46
mov r9, rax
mov r8, r15
call fcn.100003504
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov ebx, 0x80
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
lea rdx, [0x100015c90]
lea r8d, [rbx - 0x7f]
xor r9d, r9d
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call fcn.100004e00
lea rcx, [rsp + 0x68]
mov edi, eax
call fcn.1000031b0
cmp edi, ebp
jne 0x10000825f
mov eax, 0xa
mov word [0x10001d194], ax
call fcn.100002b00
cmp eax, ebp
jne 0x1000082cf
lea rcx, str._SystemRoot__system32lsm.exe
xor r8d, r8d
mov edx, r14d
call fcn.100003580
mov rdi, rax
mov qword [rsp + 0x68], rax
cmp rax, rbp
je 0x100008288
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004d5c
test byte [rcx + 0x1c], 1
je 0x100004d5c
cmp byte [rcx + 0x19], r14b
jb 0x100004d5c
mov rcx, qword [rcx + 0x10]
mov edx, 0x48
mov r9, rax
mov r8, r15
call fcn.100003504
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], rax
lea rdx, [0x100015c90]
mov r9d, 8
mov r8d, r14d
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call fcn.100004e00
lea rcx, [rsp + 0x68]
mov edi, eax
call fcn.1000031b0
cmp edi, ebp
jne 0x100008292
mov eax, 0xb
mov word [0x10001d194], ax
jmp 0x100004db3
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
cmp rsi, rbp
jne 0x10000830a
mov eax, edi
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.100001000
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r9, str.StagedBootCompletionEvent
lea edx, [rbp + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100007df9
test byte [rcx + 0x1c], r12b
je 0x100007df9
cmp byte [rcx + 0x19], 5
jb 0x100007df9
mov rcx, qword [rcx + 0x10]
cmp rax, rbp
mov r9d, ebp
lea edx, [rbp + 0x3e]
mov r8, r15
setne r9b
call fcn.100001e70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x88]
lea rdx, str.Session0Time
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x1000049f1
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004dc7
test byte [rcx + 0x1c], r12b
je 0x100004dc7
cmp byte [rcx + 0x19], 1
jb 0x100004dc7
mov r9d, dword [rsp + 0x50]
mov edx, 0x40
jmp 0x1000082be
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100007e9d
test byte [rcx + 0x1c], r12b
je 0x100007e9d
cmp byte [rcx + 0x19], r12b
jb 0x100007e9d
mov rcx, qword [rcx + 0x10]
mov edx, 0x41
mov r8, r15
call fcn.10000121c
mov qword [rsp + 0x70], rbp
jmp 0x100004a60
mov eax, dword [0x10001e040]
cmp dword [rsp + 0x60], r14d
cmove eax, dword [rsp + 0x50]
mov dword [0x10001e040], eax
jmp 0x100004ac2
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004dc7
test byte [rcx + 0x1c], r12b
je 0x100004dc7
cmp byte [rcx + 0x19], r12b
jb 0x100004dc7
mov edx, 0x43
jmp 0x1000082bb
cmp dword [0x10001d1a8], r14d
je 0x100004b7d
call fcn.10000f29c
nop
jmp 0x100004b7d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.EventFlag
xor r8d, r8d
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x100008130
cmp dword [rsp + 0x60], r14d
jne 0x100008130
cmp dword [rsp + 0x50], ebp
je 0x100008130
mov edi, 0x104
lea rcx, [rsp + 0x320]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x100008103
lea r8, str.MEMORY.DMP
lea rcx, [rsp + 0x320]
mov rdx, rdi
call fcn.1000016b4
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1000080fc
lea rdx, str.RegistryMachineSystemCurrentControlSetControlCrashControlMachineCrash
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
xor r9d, r9d
mov edx, 0x2001f
mov dword [rsp + 0x28], 1
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], rbp
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntdll.dll_NtCreateKey]
cmp eax, ebp
jl 0x1000080f3
lea rdx, str.DumpFile
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x68], 1
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x320]
lea rdx, [rsp + 0x90]
mov r9d, 1
repne scasw ax, word [rdi]
lea rax, [rsp + 0x320]
xor r8d, r8d
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
lea rdx, str.TempDestination
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, 0xffffffff80000002
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.EventFlag
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], ebp
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x100004ba8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x10000814e
lea rdx, str._SystemRoot__system32WerFault.exe
lea rcx, str.SaveDumpStart
call fcn.10000e8b4
mov ebx, 3
mov qword [rsp + 0x80], rax
cmp rax, rbp
je 0x10000819b
lea r8, str.__k__c
mov edx, ebx
mov rcx, rax
call fcn.100003580
lea rcx, [rsp + 0x80]
mov rdi, rax
mov qword [rsp + 0x68], rax
call fcn.1000031b0
jmp 0x1000081a3
mov rdi, rbp
mov qword [rsp + 0x68], rbp
cmp rdi, rbp
je 0x100004c58
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x1000081d8
test byte [rcx + 0x1c], 1
je 0x1000081d8
cmp byte [rcx + 0x19], r14b
jb 0x1000081d8
mov rcx, qword [rcx + 0x10]
mov edx, 0x44
mov r9, rdi
mov r8, r15
call fcn.100003504
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
lea rdx, [0x100015c90]
xor r9d, r9d
mov r8d, ebx
mov rcx, rdi
mov dword [rsp + 0x20], 0x80
call fcn.100004e00
lea rcx, [rsp + 0x68]
mov edi, eax
call fcn.1000031b0
cmp edi, ebp
je 0x100004c58
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004c58
test byte [rcx + 0x1c], r12b
je 0x100004c58
cmp byte [rcx + 0x19], r12b
jb 0x100004c58
mov rcx, qword [rcx + 0x10]
mov edx, 0x45
mov r9d, edi
mov r8, r15
call fcn.100001e70
nop
jmp 0x100004c58
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004dc7
test byte [rcx + 0x1c], r12b
je 0x100004dc7
cmp byte [rcx + 0x19], r12b
jb 0x100004dc7
lea edx, [rbx - 0x39]
jmp 0x1000082bb
mov edi, 0xd
jmp 0x100004dc7
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004dc7
test byte [rcx + 0x1c], r12b
je 0x100004dc7
cmp byte [rcx + 0x19], r12b
jb 0x100004dc7
mov edx, 0x49
mov r9d, edi
mov rcx, qword [rcx + 0x10]
mov r8, r15
call fcn.100001e70
jmp 0x100004dc7
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100004db3
test byte [rcx + 0x1c], r12b
je 0x100004db3
cmp byte [rcx + 0x19], r14b
jb 0x100004db3
mov rcx, qword [rcx + 0x10]
mov edx, 0x4a
mov r8, r15
call fcn.10000121c
nop
jmp 0x100004db3
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x100008333
test byte [rcx + 0x1c], r12b
je 0x100008333
cmp byte [rcx + 0x19], 5
jb 0x100008333
mov rcx, qword [rcx + 0x10]
mov edx, 0x4b
mov r8, r15
call fcn.10000121c
or edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp eax, ebp
jne 0x100008333
mov rcx, qword [0x10001d1e0]
cmp rcx, r13
je 0x10000836e
test byte [rcx + 0x1c], r12b
je 0x10000836e
cmp byte [rcx + 0x19], 5
jb 0x10000836e
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r8, r15
call fcn.10000121c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x100004dc7