Function at 0x7ff7cc01450
Capabilities:
Query or enumerate registry value
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x140
mov rax, qword [0x7ff7cc05580]
xor rax, rsp
mov qword [rsp + 0x138], rax
or dword [rsp + 0x6c], 0xffffffff
mov rsi, rcx
xor r12d, r12d
lea rcx, [rsp + 0x90]
lea rdx, str.MmcssApiPort
mov dword [rsp + 0x68], 0xfff85ee0
mov qword [rsp + 0x78], r12
mov rbp, r12
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, r12d
jl 0x7ff7cc01563
lea r8d, [r12 + 0x48]
lea rcx, [rsp + 0xd0]
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0xd0]
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0xe0], 0x150
mov dword [rsp + 0x20], 0xa0000
mov qword [rsi], r12
call qword [sym.imp.ntdll.dll_NtAlpcConnectPort]
mov edi, eax
cmp eax, 0xc0000034
je 0x7ff7cc01769
cmp eax, 0xc0000701
je 0x7ff7cc01769
cmp eax, 0xc0000037
je 0x7ff7cc01769
cmp dword [rsi], r12d
jl 0x7ff7cc01df2
cmp edi, 0xc0000034
je 0x7ff7cc01dfc
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
cmp rbp, r12
jne 0x7ff7cc0175a
mov eax, edi
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.7ff7cc010f0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
mov rcx, rbp
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
nop
jmp 0x7ff7cc01561
lea rdx, str.RegistryMachineSoftwareMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, r12d
jl 0x7ff7cc01538
lea rax, [rsp + 0x80]
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
mov edx, 0x80000100
mov dword [rsp + 0xa0], 0x30
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x40
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], r12
call qword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, r12d
jl 0x7ff7cc01538
lea rdx, str.AlwaysOn
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, r12d
jl 0x7ff7cc01538
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov ebx, 2
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x120]
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
cmp eax, r12d
jge 0x7ff7cc01daa
lea rdx, str.SystemResponsiveness
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, r12d
jl 0x7ff7cc01538
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x120]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x80]
mov r8d, ebx
mov dword [rsp + 0x20], 0x14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
cmp ebx, r12d
jl 0x7ff7cc018ba
cmp dword [rsp + 0x124], 4
jne 0x7ff7cc018ba
cmp dword [rsp + 0x12c], 0x64
je 0x7ff7cc01538
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenSCManagerW]
mov rbx, rax
cmp rax, r12
je 0x7ff7cc01538
lea rdx, str.MMCSS
mov r8d, 0x10
mov rcx, rax
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_OpenServiceW]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_CloseServiceHandle]
cmp rbp, r12
je 0x7ff7cc01538
mov ebx, r12d
cmp ebx, 0x14
jae 0x7ff7cc01538
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.API_MS_WIN_Service_Management_L1_1_0.dll_StartServiceW]
cmp eax, r12d
je 0x7ff7cc01dd6
lea rcx, [rsp + 0x78]
call fcn.7ff7cc019c4
cmp eax, 0xc0000034
je 0x7ff7cc01e08
cmp eax, 0xc000003a
je 0x7ff7cc01e08
cmp eax, 0xc0000017
je 0x7ff7cc01e08
cmp eax, r12d
jl 0x7ff7cc01e15
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
cmp eax, r12d
jne 0x7ff7cc01e15
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0xd0]
lea rdx, [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsi], r12
mov dword [rsp + 0x20], 0xa0000
call qword [sym.imp.ntdll.dll_NtAlpcConnectPort]
mov edi, eax
jmp 0x7ff7cc01538
cmp dword [rsp + 0x124], 4
jne 0x7ff7cc01842
cmp dword [rsp + 0x12c], r12d
je 0x7ff7cc01842
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x7ff7cc01538
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp eax, 0x420
je 0x7ff7cc01922
cmp eax, r12d
je 0x7ff7cc01922
jmp 0x7ff7cc01e15
mov edi, dword [rsi]
mov qword [rsi], r12
jmp 0x7ff7cc01541
or qword [rsi], 0xffffffffffffffff
mov edi, r12d
jmp 0x7ff7cc0154d
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtDelayExecution]
inc ebx
jmp 0x7ff7cc01902