Function at 0x18003ba78
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r13d, dword [rbp + 0x240]
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov r14d, r9d
mov qword [rsp + 0x68], r15
mov rdi, rdx
mov qword [rsp + 0x58], r15
mov rsi, rcx
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x50], r15d
mov qword [rbp - 0x80], r8
mov qword [rbp - 0x78], rcx
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x18003bb06
test byte [rcx + 0x1c], 8
je 0x18003bb06
mov rcx, qword [rcx + 0x10]
lea edx, [r15 + 0xa]
lea r8, [0x18007db08]
call fcn.18001171c
test rsi, rsi
je 0x18003c67f
test rdi, rdi
je 0x18003c67f
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180012974
mov ebx, eax
test eax, eax
je 0x18003bb4e
mov ecx, eax
call fcn.180011120
mov edx, eax
mov r9, rsi
mov ecx, 1
mov r8d, 0x1c6a
call fcn.180038d90
mov eax, ebx
jmp 0x18003c684
mov eax, r13d
mov r12d, r13d
and eax, 0x10000
and r12d, 0x100
mov dword [rsp + 0x40], eax
mov edx, 2
test eax, eax
je 0x18003bb72
lea esi, [rdx + 1]
jmp 0x18003bb85
mov eax, r12d
neg eax
sbb esi, esi
and esi, edx
bt r13d, 0x17
jae 0x18003bb85
or esi, 4
lea r9, [rsp + 0x48]
mov r8d, esi
mov edx, r14d
mov rcx, rdi
call fcn.18004cdbc
mov r14, qword [rsp + 0x58]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003bbf7
mov ecx, ebx
call fcn.180011120
lea r9, str.database
mov r8d, 0x1c65
mov edi, 1
mov edx, eax
mov ecx, edi
call fcn.180038d90
mov r12d, dword [rsp + 0x40]
cmp r14, 0xffffffffffffffff
je 0x18003c622
call fcn.180003c48
mov rcx, r14
test al, al
je 0x18003c618
call qword [sym.imp.ext_ms_win_setupapi_inf_l1_1_0.dll_SetupCloseInfFile]
nop dword [rax + rax]
jmp 0x18003c622
mov edi, 1
test r12d, r12d
je 0x18003be2d
xor r12d, r12d
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x54], r12d
mov edx, edi
mov dword [rsp + 0x70], r12d
lea rcx, str.D:P_A__GA___CO__A__GA___BA__A__GA___SY_
mov ebx, r12d
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
je 0x18003bc72
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18003bc85
lea rdx, [rsp + 0x54]
call fcn.180014d94
mov rcx, qword [rsp + 0x68]
mov ebx, eax
test eax, eax
je 0x18003bc85
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ecx, r12d
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x68], rcx
jmp 0x18003bc85
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
test ebx, ebx
jne 0x18003be15
call fcn.18000df50
mov qword [rsp + 0x78], r12
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
nop dword [rax + rax]
lea r9, [rsp + 0x78]
mov r8d, edi
mov rcx, rax
lea edx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenThreadToken]
nop dword [rax + rax]
test eax, eax
jne 0x18003bd1d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x3f0
jne 0x18003bcfb
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
lea r8, [rsp + 0x78]
lea edx, [rbx + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
nop dword [rax + rax]
test eax, eax
jne 0x18003bd1d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.TOKEN
mov r8d, 0x1c6d
mov edx, eax
mov ecx, edi
call fcn.180038d90
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x18003bdfd
mov rdx, qword [rsp + 0x68]
lea rcx, [0x18008ac58]
mov qword [rsp + 0x38], rcx
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x19
xor ecx, ecx
mov byte [rsp + 0x20], r12b
mov qword [rsp + 0x58], r12
call qword [sym.imp.ntdll.dll_RtlNewSecurityObjectEx]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x18003bdd6
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetFileSecurityW]
nop dword [rax + rax]
test eax, eax
jne 0x18003bdbe
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
lea r9, str.database
mov r8d, 0x1c77
mov edx, eax
mov ecx, edi
mov ebx, eax
call fcn.180038d90
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18003bdec
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18003bdec
lea r9, str.database
mov r8d, 0x1c60
mov edx, eax
mov ecx, edi
call fcn.180038d90
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18003be2b
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18003be2b
lea r9, str.database
mov r8d, 0x1c60
mov edx, ebx
mov ecx, edi
call fcn.180038d90
xor eax, eax
mov r12d, dword [rsp + 0x40]
test r12d, r12d
jne 0x18003be90
mov rcx, qword [rsp + 0x48]
call fcn.180050a34
mov ecx, 0x800100
mov eax, r13d
and eax, ecx
cmp eax, ecx
jne 0x18003be7e
mov rcx, qword [rsp + 0x48]
mov edx, 0x132
mov r8d, 0xffff
call fcn.18002e928
mov edx, 0x12f
mov rcx, qword [rsp + 0x48]
mov r8d, 0xffff
call fcn.18002e928
jmp 0x18003bfa0
bt r13d, 0x1a
jae 0x18003bfa0
mov edx, 0x132
jmp 0x18003be69
bt r13d, 0x11
jae 0x18003bfa2
mov rcx, qword [rsp + 0x48]
mov edx, 0x12e
mov r8d, 0xffff
call fcn.18002e928
mov ebx, eax
test eax, 0xfffffffd
je 0x18003bedb
mov ecx, eax
call fcn.180011120
lea r9, [0x18007cad8]
mov r8d, 0x1c66
mov edx, eax
mov ecx, edi
call fcn.180038d90
jmp 0x18003bbcc
mov rcx, qword [rsp + 0x48]
lea rdx, str.SmTblGpo
mov r8d, 5
call fcn.18004dc74
xor eax, eax
mov edx, ebx
mov r8d, 0x1c95
mov qword [rsp + 0x58], rax
lea ebx, [rax + 2]
mov ecx, ebx
call fcn.180038d90
mov rax, qword gs:[0x58]
lea r9, [rsp + 0x58]
mov ecx, dword [0x18008b2a0]
mov r8d, 0xc
mov rdx, qword [rax + rcx*8]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
cmp dword [r8 + rdx], ebx
cmovne eax, r15d
mov r8d, eax
call fcn.180043f28
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call fcn.180038ef4
mov rcx, qword [rsp + 0x58]
call fcn.180011914
xor eax, eax
test ebx, ebx
je 0x18003bf77
mov ecx, ebx
call fcn.180011120
mov edx, eax
mov r8d, 0x1c96
mov ecx, edi
call fcn.180038d90
jmp 0x18003bbcc
mov rcx, qword [rsp + 0x48]
cmp qword [rcx + 0x30], 0xffffffffffffffff
jne 0x18003bfa2
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SmTblTattoo
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 6]
call fcn.18004d254
xor eax, eax
mov dword [rbp - 0x50], r15d
mov word [rbp - 0x4c], ax
test r12d, r12d
je 0x18003c04b
mov rax, qword [rbp - 0x78]
lea r9, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r8, [0x180072958]
lea rdx, str.GPOPath
mov dword [rsp + 0x20], 0x104
lea rcx, [0x18007bb88]
call qword [sym.imp.api_ms_win_core_privateprofile_l1_1_0.dll_GetPrivateProfileStringW]
nop dword [rax + rax]
xor eax, eax
cmp word [rbp - 0x50], ax
je 0x18003c04b
lea edx, [rax + 0x5c]
lea rcx, [rbp - 0x50]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
je 0x18003c00e
mov word [rax], cx
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x50]
call fcn.18004e0d8
mov r15d, eax
test eax, eax
jns 0x18003c04b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18003c04b
mov ecx, eax
call fcn.18000ec90
lea r9, [rbp - 0x50]
mov r8d, 0x1c62
jmp 0x18003becd
lea r9, [rbp - 0x70]
mov rcx, r14
lea r8, str.Revision
lea rdx, [0x18007bb88]
call fcn.180016d68
xor r8d, r8d
test eax, eax
je 0x18003c08d
lea r8, [rsp + 0x60]
mov edx, edi
lea rcx, [rbp - 0x70]
call fcn.180016f70
neg eax
sbb edx, edx
and edx, dword [rsp + 0x60]
mov dword [rsp + 0x60], edx
xor r8d, r8d
jmp 0x18003c091
mov edx, dword [rsp + 0x60]
test edx, edx
mov ecx, 2
mov eax, r8d
cmove eax, ecx
mov ecx, eax
or ecx, 8
test r13d, r13d
cmovns ecx, eax
mov eax, r13d
mov r13d, ecx
or r13d, 0x10
and al, 0x40
cmove r13d, ecx
cmp edx, edi
jle 0x18003c0cc
mov ecx, 8
or r13d, 4
mov dword [rsp + 0x50], ecx
jmp 0x18003c0d0
mov ecx, dword [rsp + 0x50]
mov r12d, dword [rbp + 0x248]
test dil, r12b
je 0x18003c3b7
mov eax, dword [rbp + 0x240]
and eax, 0x2000
mov dword [rsp + 0x54], eax
jne 0x18003c13d
mov qword [rsp + 0x38], r8
mov r9d, esi
mov qword [rsp + 0x30], r8
mov rdx, r14
mov r8, qword [rsp + 0x48]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ecx
lea rcx, [0x18007db40]
call fcn.1800393e4
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c13d
mov ecx, eax
call fcn.180011120
lea r9, [0x18007db40]
mov r8d, 0x1c64
jmp 0x18003bbbe
mov qword [rsp + 0x38], r8
lea rax, str.LSAAnonymousNameLookup
mov r8, qword [rsp + 0x48]
lea rcx, [0x18007db40]
mov qword [rsp + 0x30], rax
mov r9d, esi
mov eax, dword [rsp + 0x50]
mov rdx, r14
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003c18a
mov ecx, ebx
call fcn.180011120
lea r9, str.LSAAnonymousNameLookup
jmp 0x18003c132
mov r8, qword [rsp + 0x48]
lea rcx, [0x18007dac8]
mov qword [rsp + 0x38], rax
mov r9d, esi
mov qword [rsp + 0x30], rax
mov rdx, r14
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003c1d3
mov ecx, ebx
call fcn.180011120
lea r9, [0x18007dac8]
jmp 0x18003c132
mov r8, qword [rsp + 0x48]
lea rcx, [0x18007db88]
mov qword [rsp + 0x38], rax
mov r9d, esi
mov qword [rsp + 0x30], rax
mov rdx, r14
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003c21c
mov ecx, ebx
call fcn.180011120
lea r9, [0x18007db88]
jmp 0x18003c132
mov r8, qword [rsp + 0x48]
lea rcx, [0x18007daa8]
mov qword [rsp + 0x38], rax
mov r9d, esi
mov qword [rsp + 0x30], rax
mov rdx, r14
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003c265
mov ecx, ebx
call fcn.180011120
lea r9, [0x18007daa8]
jmp 0x18003c132
mov r8, qword [rsp + 0x48]
lea rcx, [0x18007dc48]
mov qword [rsp + 0x38], rax
mov r9d, esi
mov qword [rsp + 0x30], rax
mov rdx, r14
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c2af
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dc48]
jmp 0x18003c132
cmp dword [rsp + 0x54], r8d
jne 0x18003c32a
mov edx, dword [0x18008b2a0]
mov rax, qword gs:[0x58]
mov ecx, 0xc
mov rax, qword [rax + rdx*8]
cmp dword [rcx + rax], 2
jne 0x18003c32a
test dword [rbp + 0x240], 0x800000
jne 0x18003c32a
mov eax, dword [rsp + 0x50]
lea rcx, [0x18007dc78]
mov qword [rsp + 0x38], r8
mov r9d, esi
mov qword [rsp + 0x30], r8
mov rdx, r14
mov r8, qword [rsp + 0x48]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c32a
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dc78]
jmp 0x18003c132
mov eax, dword [rsp + 0x50]
lea rcx, [0x18007dbd0]
mov qword [rsp + 0x38], r8
or eax, 0x11
mov qword [rsp + 0x30], r8
mov r9d, esi
mov r8, qword [rsp + 0x48]
mov rdx, r14
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call fcn.1800393e4
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x18003c376
mov ecx, ebx
call fcn.180011120
lea r9, [0x18007dbd0]
jmp 0x18003c132
cmp dword [rsp + 0x40], eax
mov r8d, eax
mov rdx, qword [rsp + 0x48]
mov r9d, r15d
setne r8b
mov dword [rsp + 0x20], edi
mov rcx, r14
call fcn.180039150
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c3b7
mov ecx, eax
call fcn.180011120
lea r9, str.policy_attachments.
mov r8d, 0x1c39
jmp 0x18003bbbe
mov ecx, r13d
or ecx, edi
mov dword [rsp + 0x54], ecx
test r12b, 0x20
je 0x18003c40d
mov rax, qword [rsp + 0x48]
mov r8d, ecx
mov dword [rsp + 0x30], r15d
lea rcx, [0x18007dc08]
mov dword [rsp + 0x28], esi
mov r9, r14
mov edx, edi
mov qword [rsp + 0x20], rax
call fcn.180039d90
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c409
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dc08]
jmp 0x18003c132
mov ecx, dword [rsp + 0x54]
test r12b, 0x40
je 0x18003c459
mov rax, qword [rsp + 0x48]
mov r8d, ecx
mov dword [rsp + 0x30], r15d
lea rcx, [0x18007dcc8]
mov dword [rsp + 0x28], esi
mov r9, r14
mov edx, 2
mov qword [rsp + 0x20], rax
call fcn.180039d90
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c459
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dcc8]
jmp 0x18003c132
test r12b, r12b
jns 0x18003c4d5
mov rax, qword [rsp + 0x48]
lea rcx, [0x18007dc98]
mov dword [rsp + 0x30], r15d
mov r9, r14
mov dword [rsp + 0x28], esi
mov r8d, r13d
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.180039d90
xor r13d, r13d
mov ebx, eax
test eax, eax
je 0x18003c4a1
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dc98]
jmp 0x18003c132
mov rdx, qword [rsp + 0x48]
mov r9d, r15d
mov r8d, esi
mov dword [rsp + 0x20], r13d
mov rcx, r14
call fcn.180039150
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c4d5
mov ecx, eax
call fcn.180011120
lea r9, str.service_attachments.
jmp 0x18003c3ac
bt r12d, 0xf
jae 0x18003c4fc
mov rdx, qword [rsp + 0x48]
mov r9d, r15d
mov r8d, esi
mov rcx, r14
call fcn.18003a5f0
xor r8d, r8d
mov ebx, eax
test eax, eax
jne 0x18003bbc7
mov r13d, dword [rsp + 0x50]
test r12b, 8
je 0x18003c553
mov qword [rsp + 0x38], r8
lea rcx, [0x18007dba8]
mov qword [rsp + 0x30], r8
mov eax, r13d
mov r8, qword [rsp + 0x48]
or eax, 3
mov dword [rsp + 0x28], r15d
mov r9d, esi
mov rdx, r14
mov dword [rsp + 0x20], eax
call fcn.1800393e4
xor r8d, r8d
mov ebx, eax
test eax, eax
je 0x18003c553
mov ecx, eax
call fcn.180011120
lea r9, [0x18007dba8]
jmp 0x18003c132
test r12b, 4
je 0x18003c5a1
mov qword [rsp + 0x38], r8
lea rcx, [0x18007db18]
mov qword [rsp + 0x30], r8
or r13d, 5
mov r8, qword [rsp + 0x48]
mov r9d, esi
mov dword [rsp + 0x28], r15d
mov rdx, r14
mov dword [rsp + 0x20], r13d
call fcn.1800393e4
mov ebx, eax
test eax, eax
je 0x18003c5a1
mov ecx, eax
call fcn.180011120
lea r9, [0x18007db18]
jmp 0x18003c132
mov rdx, qword [rsp + 0x48]
mov rcx, r14
call fcn.180039214
mov r12d, dword [rsp + 0x40]
test r12d, r12d
jne 0x18003c5c7
mov rcx, qword [rsp + 0x48]
call fcn.18004cd84
jmp 0x18003bbcc
test dword [rbp + 0x240], 0x40000
je 0x18003bbcc
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx]
and eax, 0xf0
mov dword [rsp + 0x54], eax
add eax, 0xfffffff0
test eax, 0xffffffef
jne 0x18003bbcc
lea r9, [rsp + 0x54]
mov dword [rsp + 0x20], 4
lea r8, str.LastUsedMergeTable
call fcn.18005088c
mov ebx, eax
jmp 0x18003bbcc
mov rcx, rax
call fcn.180017d50
test rax, rax
jne 0x18003c615
test r12d, r12d
jne 0x18003c635
test ebx, ebx
je 0x18003c635
mov rcx, qword [rsp + 0x48]
call fcn.180050278
mov rcx, qword [rsp + 0x48]
mov edx, edi
call fcn.18004cbc4
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x18003bb47
test byte [rcx + 0x1c], 8
je 0x18003bb47
mov rcx, qword [rcx + 0x10]
lea r8, [0x18007db08]
mov edx, 0xb
mov r9d, ebx
call fcn.180011748
jmp 0x18003bb47
mov eax, 1
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180002a90
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret