Function at 0x14001ee40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400a9008]
xor rax, rsp
mov qword [rbp + 0x50], rax
cmp dword [0x1400ab348], 0
jne 0x14003a986
and qword [rsp + 0x40], 0
lea r8, [rsp + 0x40]
xor ebx, ebx
lea rcx, str.D:_A__0x100003___BU__A__0x1201bb___WD__A__0x1201bb___AN__A__0x1201bb___AC__A__FA___CO__A__FA___SY__A__FA___BA_S:_ML_____S_1_16_0_
xor r9d, r9d
lea edx, [rbx + 1]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x14003aa18
test ebx, ebx
js 0x14001eed5
call fcn.14001fbb4
mov dword [0x1400a9058], eax
mov rax, qword [rsp + 0x40]
and qword [rsp + 0x40], 0
mov qword [0x1400a9078], rax
mov qword [0x1400a9318], rax
mov eax, dword [0x1400a9398]
mov dword [0x1400a90a8], eax
mov eax, dword [0x1400a939c]
mov dword [0x1400a9148], eax
and qword [rsp + 0x48], 0
test ebx, ebx
js 0x14001ef2a
xor ebx, ebx
lea r8, [rsp + 0x48]
xor r9d, r9d
lea rcx, str.D:_A__0x100003___BU__A__0x1201bb___WD__A__0x1201bb___AN__A__FA___CO__A__FA___SY__A__FA___BA_S:_ML_____S_1_16_0_
lea edx, [rbx + 1]
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x14003aa24
test ebx, ebx
js 0x14001ef2a
mov rax, qword [rsp + 0x48]
lea rcx, [0x1400a9340]
mov qword [rcx], rax
lea rdx, [0x1400a9390]
add rcx, 0x28
cmp rcx, rdx
jl 0x14001ef11
and qword [rsp + 0x48], 0
lea rcx, [rbp - 0x20]
call fcn.14000ffe0
test ebx, ebx
js 0x14001ef50
lea r8, [0x1400a90d0]
lea rdx, [0x1400a9080]
lea rcx, [rbp - 0x20]
call fcn.14001f064
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.14001f1cc
test ebx, ebx
js 0x14001ef74
lea r8, [0x1400a9170]
lea rdx, [0x1400a9120]
lea rcx, [rbp - 0x80]
call fcn.14001f2bc
and dword [rsp + 0x68], 0
lea rax, [0x140074668]
mov qword [rsp + 0x60], rax
test ebx, ebx
js 0x14001efb6
lea r8, [0x1400a9210]
lea rdx, [0x1400a91c0]
lea rcx, [rsp + 0x60]
call fcn.14001fa20
mov ecx, 0x8000
call qword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
mov ebx, eax
test eax, eax
jg 0x14003aa30
and qword [rsp + 0x50], 0
test ebx, ebx
js 0x14001effd
lea rdx, [rsp + 0x50]
mov ecx, 9
call qword [sym.imp.RPCRT4.dll_RpcServerInqDefaultPrincNameW]
mov ebx, eax
test eax, eax
jg 0x14003aa3e
test ebx, ebx
js 0x14001effd
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 9]
call qword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoW]
mov ebx, eax
test eax, eax
jg 0x14003aa4c
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
lea rax, [0x140074610]
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x60], rax
call fcn.14001f210
lea rcx, [rbp - 0x20]
call fcn.140010024
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140024ca0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rbp
ret
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x30], rax
lea r8, [0x140094c00]
lea rax, [0x1400a9a6c]
mov r9d, 0x18
mov qword [rsp + 0x28], rax
lea rdx, [0x140074330]
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x14003aa09
mov rcx, qword [0x1400a92b0]
lea rax, [0x1400a92b0]
cmp rcx, rax
je 0x14003a9fd
test byte [rcx + 0x44], 2
je 0x14003a9fd
mov rcx, qword [rcx + 0x38]
lea r8, [0x140094c18]
mov edx, 0xb
call fcn.14003d1bc
mov byte [0x1400ab300], 1
jmp 0x14001ee6d
mov dword [0x1400a9a6c], 0x258
jmp 0x14001ee6d
call fcn.14004f934
mov ebx, eax
jmp 0x14001ee95
call fcn.14004f934
mov ebx, eax
jmp 0x14001ef01
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14001efb6
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14001efda
movzx ebx, ax
or ebx, 0x80070000
jmp 0x14001effd