Function at 0x7ff74aff890
Capabilities:
Query or enumerate registry value

Disassembly:
mov r15d, 0xffffffff
jmp 0x7ff74affe0b
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.PingInterval
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0f0d9
mov eax, 0x78
mov word [0x7ff74b58370], ax
mov eax, 0x168
mov word [0x7ff74b58600], ax
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.UserPingSetQuota
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x7ff74b0034e
jmp 0x7ff74b0f16e
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x140
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], rsi
mov qword [rbp + 0x150], rdi
movaps xmmword [rbp + 0x100], xmm6
mov rax, qword [0x7ff74b58340]
xor rax, rbp
mov qword [rbp + 0xf0], rax
xor r12d, r12d
lea r9, [rbp + 0x50]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xc]
mov qword [rbp + 0x20], r9
mov r14, r12
mov r15, r12
mov dword [rbp + 0x38], r12d
mov r13d, r12d
mov dword [rbp + 0x10], r12d
mov edi, r12d
mov dword [rbp + 0x18], r12d
call qword [sym.imp.SspiCli.dll_EnumerateSecurityPackagesW]
mov edx, 0xffffffff
lea esi, [r12 + 1]
lea rbx, [0x7ff74b58350]
cmp eax, r12d
jne 0x7ff74b0e8e5
mov edi, dword [rbp + 0xc]
lea rax, [rdi + rdi]
cmp rax, rdx
ja 0x7ff74b0e820
shl rdi, 4
cmp rdi, rdx
ja 0x7ff74b0e820
mov ecx, eax
call fcn.7ff74ae3720
mov ecx, edi
mov r14, rax
call fcn.7ff74ae3720
mov rdi, rax
mov qword [rbp + 0x30], rax
cmp r14, r12
je 0x7ff74b0e8bc
cmp rax, r12
je 0x7ff74b0e8bc
mov r8d, dword [rbp + 0xc]
xor edx, edx
mov rcx, r14
add r8, r8
call sub.msvcrt.dll_memset
mov r8d, dword [rbp + 0xc]
xor edx, edx
shl r8, 4
mov rcx, rdi
call sub.msvcrt.dll_memset
cmp dword [rbp + 0xc], r12d
jbe 0x7ff74affb5c
mov rbx, qword [rbp + 0x28]
mov r12, rdi
mov rdi, qword [0x7ff74b58350]
mov r13, r14
mov eax, 0xffff
add rbx, 6
cmp word [rbx], ax
je 0x7ff74affb3d
xor r9d, r9d
cmp dword [0x7ff74b582c8], r9d
je 0x7ff74aff9d7
lea rax, [0x7ff74b58350]
cmp rdi, rax
je 0x7ff74aff9d7
test byte [rdi + 0x1c], 8
jne 0x7ff74b0e82e
test byte [rbx - 6], 0x10
je 0x7ff74affadd
mov r8d, dword [rbp + 0x10]
mov eax, r9d
cmp r8d, r9d
jbe 0x7ff74affa0c
mov rcx, qword [rbp + 0x30]
movzx edx, word [rbx]
add rcx, 8
cmp word [rcx], dx
je 0x7ff74b003c4
add eax, esi
add rcx, 0x10
cmp eax, r8d
jb 0x7ff74aff9f8
mov r10d, 0xffffffff
mov eax, r10d
cmp eax, r10d
jne 0x7ff74affae3
movzx eax, word [rbx]
mov word [r12 + 8], ax
mov rcx, qword [rbx + 0xa]
cmp rcx, r9
je 0x7ff74b0e88f
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov ecx, eax
mov edi, eax
call fcn.7ff74ae3720
xor r9d, r9d
mov rdx, rax
mov qword [r12], rax
cmp rax, r9
je 0x7ff74b0e89b
shr rdi, 1
mov r8, qword [rbx + 0xa]
je 0x7ff74affaa4
cmp rdi, 0x7fffffff
ja 0x7ff74affaa4
mov ecx, 0x7ffffffe
sub rcx, rdi
sub r8, rax
lea rax, [rdi + rcx]
cmp rax, r9
je 0x7ff74affa97
movzx eax, word [r8 + rdx]
cmp ax, r9w
je 0x7ff74affa97
mov word [rdx], ax
add rdx, 2
sub rdi, rsi
jne 0x7ff74affa77
cmp rdi, r9
je 0x7ff74b0e85d
mov word [rdx], r9w
cmp dword [0x7ff74b582c8], r9d
je 0x7ff74b0e88b
mov rdi, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rdi, rax
je 0x7ff74afface
test byte [rdi + 0x1c], 8
jne 0x7ff74b0e866
mov r8d, dword [rbp + 0x10]
add r8d, esi
add r12, 0x10
mov dword [rbp + 0x10], r8d
mov r10d, 0xffffffff
mov eax, dword [rbx - 6]
test al, 0x10
je 0x7ff74affb38
and eax, 0x40
xor ecx, ecx
not eax
cmp eax, ecx
je 0x7ff74affb38
mov r8d, dword [rbp + 0x18]
mov eax, ecx
cmp r8d, ecx
jbe 0x7ff74affb16
movzx edx, word [rbx]
mov rcx, r14
cmp word [rcx], dx
je 0x7ff74affb19
add eax, esi
add rcx, 2
cmp eax, r8d
jb 0x7ff74affb06
mov eax, r10d
cmp eax, r10d
jne 0x7ff74affb38
movzx eax, word [rbx]
add r8d, esi
mov word [r13], ax
mov rdi, qword [0x7ff74b58350]
add r13, 2
mov dword [rbp + 0x18], r8d
mov eax, 0xffff
add r15d, esi
add rbx, 0x20
cmp r15d, dword [rbp + 0xc]
jb 0x7ff74aff9ac
mov r13d, dword [rbp + 0x10]
xor r12d, r12d
lea rbx, [0x7ff74b58350]
mov rcx, qword [rbp + 0x28]
call sub.SspiCli.dll_FreeContextBuffer
mov r15, qword [rbp + 0x30]
mov edi, dword [rbp + 0x18]
mov qword [rbp + 0x28], r12
jmp 0x7ff74affb72
lea rax, [rbp + 0x40]
lea rdx, str.SOFTWAREMicrosoftRPC
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x7ff74b0eb04
mov rcx, qword [rbp + 0x40]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
lea rdx, str.DCOM_Security
xor r8d, r8d
mov dword [rbp], 0xa0
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x7ff74b0e92a
cmp eax, r12d
je 0x7ff74b0e984
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74affc02
mov rcx, qword [0x7ff74b58350]
cmp rcx, rbx
je 0x7ff74affc02
test byte [rcx + 0x1c], 8
jne 0x7ff74b0eae6
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x7ff74affc0e
mov ebx, dword [rbp + 0x10]
mov ecx, r12d
cmp ebx, r12d
jbe 0x7ff74affc38
mov eax, ecx
add rax, rax
cmp word [r15 + rax*8 + 8], 9
jne 0x7ff74b0eb49
cmp ecx, ebx
jae 0x7ff74affc38
cmp ecx, r12d
jne 0x7ff74b0eb58
cmp dword [rbp + 0x38], r12d
jne 0x7ff74affc64
mov edx, dword [rbp + 0x18]
mov ecx, r12d
cmp edx, r12d
jbe 0x7ff74affc64
mov eax, ecx
cmp word [r14 + rax*2], 9
jne 0x7ff74b0eb82
cmp ecx, edx
jae 0x7ff74affc64
cmp ecx, r12d
jne 0x7ff74b0eb91
mov rcx, qword [0x7ff74b58420]
call fcn.7ff74ae3010
mov r9, qword [0x7ff74b584a0]
mov r8d, dword [0x7ff74b582e0]
mov rdx, qword [0x7ff74b584a8]
mov ecx, dword [0x7ff74b582e4]
call fcn.7ff74aff6f0
mov eax, dword [rbp + 0x18]
mov rcx, qword [0x7ff74b58420]
mov dword [0x7ff74b582e0], eax
mov dword [0x7ff74b582e4], ebx
mov qword [0x7ff74b584a8], r15
mov qword [0x7ff74b584a0], r14
lock add dword [rcx + 0x3c], 0xffffffff
mov dword [rcx + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [0x7ff74b582b4], r12d
mov dword [0x7ff74b582b0], r12d
mov dword [0x7ff74b58298], r12d
mov dword [0x7ff74b5829c], r12d
mov dword [0x7ff74b582c4], esi
mov dword [0x7ff74b582b8], r12d
mov dword [0x7ff74b582ac], 2
mov dword [0x7ff74b582a8], 2
mov dword [0x7ff74b582a4], r12d
mov dword [0x7ff74b582a0], r12d
mov ebx, 0x20019
mov r14d, 0x80
cmp qword [0x7ff74b58210], r12
jne 0x7ff74afe89c
lea rax, [rbp + 0x30]
lea rdx, str.SOFTWAREMicrosoftOLE
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x30], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x7ff74b0ebb1
mov rcx, qword [rbp + 0x30]
xor eax, eax
lock cmpxchg qword [0x7ff74b58210], rcx
jne 0x7ff74b0ebfb
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [0x7ff74b58358]
cmp rax, r12
je 0x7ff74b0ec0b
mov rdx, qword [0x7ff74b58210]
xor r8d, r8d
mov rcx, rax
call fcn.7ff74afeef8
mov rdi, rax
jmp 0x7ff74affd9e
cmp rdi, r12
je 0x7ff74b00388
xor eax, eax
lock cmpxchg qword [0x7ff74b58218], rdi
jne 0x7ff74b0ec13
mov rcx, qword [0x7ff74b58218]
call fcn.7ff74b016f0
cmp eax, r12d
jl 0x7ff74b00388
mov r9, qword [0x7ff74b58218]
mov rdx, qword [r9 + 0x10]
cmp rdx, r12
je 0x7ff74b00388
lea r8, [0x7ff74b01a84]
lea rcx, [rbp + 0x18]
mov r15d, 0xffffffff
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
cmp eax, r12d
je 0x7ff74b0ec4f
mov r13d, 4
cmp qword [0x7ff74b58220], r12
jne 0x7ff74affefd
lea rax, [rbp + 0x20]
lea rdx, str.SOFTWAREPolicies
mov r9d, ebx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x20], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x7ff74b0ed24
mov rcx, qword [rbp + 0x20]
xor eax, eax
lock cmpxchg qword [0x7ff74b58220], rcx
jne 0x7ff74b0ec93
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [0x7ff74b58358]
cmp rax, r12
je 0x7ff74b0eca3
mov rdx, qword [0x7ff74b58220]
xor r8d, r8d
mov rcx, rax
call fcn.7ff74afeef8
mov rdi, rax
jmp 0x7ff74affe96
cmp rdi, r12
je 0x7ff74b00388
xor eax, eax
lock cmpxchg qword [0x7ff74b58228], rdi
jne 0x7ff74b0ecab
mov rcx, qword [0x7ff74b58228]
call fcn.7ff74b016f0
cmp eax, r12d
jl 0x7ff74b00388
mov r9, qword [0x7ff74b58228]
mov rdx, qword [r9 + 0x10]
cmp rdx, r12
je 0x7ff74b00388
lea r8, [0x7ff74b016c8]
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
cmp eax, r12d
je 0x7ff74b0ece7
lea rdi, [0x7ff74b58350]
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.EnableDCOM
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov r14w, 0x79
mov r15w, 0x59
cmp eax, r12d
jne 0x7ff74b0ed6f
cmp dword [rbp + 8], esi
jne 0x7ff74b0ed6f
cmp dword [rbp], r12d
je 0x7ff74b0ed6f
cmp word [rbp + 4], r14w
je 0x7ff74afff6d
cmp word [rbp + 4], r15w
jne 0x7ff74b0ed6f
mov r9d, esi
mov dword [0x7ff74b582b4], esi
jmp 0x7ff74afff78
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74afff97
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74afff97
test byte [rcx + 0x1c], 8
jne 0x7ff74b0ed7b
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.OleModalLoopBehavior
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0ed96
mov r9d, dword [0x7ff74b582b0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74affff7
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74affff7
test byte [rcx + 0x1c], 8
jne 0x7ff74b0edbd
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.DCOMSCMRemoteCallFlags
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0edd8
mov r9d, dword [0x7ff74b5829c]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00057
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b00057
test byte [rcx + 0x1c], 8
jne 0x7ff74b0edfe
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.EnableDCOMHTTP
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0ee19
mov r9d, dword [0x7ff74b58298]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b000b7
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b000b7
test byte [rcx + 0x1c], 8
jne 0x7ff74b0ee4c
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.IgnoreServerExceptions
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0ee67
mov r9d, dword [0x7ff74b582c4]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00117
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b00117
test byte [rcx + 0x1c], 8
jne 0x7ff74b0ee9b
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.BreakOnSilencedServerExceptions
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0eeb6
mov r9d, dword [0x7ff74b582b8]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00177
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b00177
test byte [rcx + 0x1c], 8
jne 0x7ff74b0eee9
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rdx, str.LegacyAuthenticationService
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov dword [rbp], r12d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0ef04
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.LegacyAuthenticationLevel
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov r9d, dword [0x7ff74b582ac]
cmp eax, r12d
je 0x7ff74b0efe5
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b0f014
mov rcx, qword [0x7ff74b58350]
lea rdi, [0x7ff74b58350]
mov bl, 8
cmp rcx, rdi
je 0x7ff74b00219
test byte [rcx + 0x1c], bl
jne 0x7ff74b0effa
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.LegacyImpersonationLevel
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov r9d, dword [0x7ff74b582a8]
cmp eax, r12d
jne 0x7ff74b00266
cmp dword [rbp + 8], r13d
cmove r9d, dword [rbp + 4]
mov dword [0x7ff74b582a8], r9d
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00284
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b00284
test byte [rcx + 0x1c], bl
jne 0x7ff74b0f022
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.LegacyMutualAuthentication
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0f03d
mov r9d, dword [0x7ff74b582a4]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b002e3
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b002e3
test byte [rcx + 0x1c], bl
jne 0x7ff74b0f070
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.LegacySecureReferences
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0f08b
mov esi, dword [0x7ff74b582a0]
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00341
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b00341
test byte [rcx + 0x1c], bl
jne 0x7ff74b0f0bb
cmp qword [0x7ff74b58380], r12
jne 0x7ff74aff7f9
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 4]
lea rdx, str.MaxActivationRetriesPerServer
xor r8d, r8d
mov dword [rbp], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
je 0x7ff74b0f1c3
mov rcx, qword [rbp + 0xf0]
xor rcx, rbp
call fcn.7ff74ae3090
mov rbx, qword [rbp + 0x140]
mov rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x150]
movaps xmm6, xmmword [rbp + 0x100]
lea rsp, [rbp + 0x110]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r10d, 0xffffffff
jmp 0x7ff74affa15
mov rcx, qword [rbp + 0x28]
call sub.SspiCli.dll_FreeContextBuffer
jmp 0x7ff74b00388
mov eax, dword [rbx - 6]
movzx r9d, word [rbx]
mov rcx, qword [rdi + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0xa
mov dword [rsp + 0x20], eax
call fcn.7ff74b29508
mov rdi, qword [0x7ff74b58350]
xor r9d, r9d
jmp 0x7ff74aff9d7
sub rdx, 2
jmp 0x7ff74affaa0
mov r9, qword [r12]
mov rcx, qword [rdi + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0xb
call fcn.7ff74b25f00
mov rdi, qword [0x7ff74b58350]
jmp 0x7ff74afface
mov r8d, dword [rbp + 0x10]
mov rdi, qword [0x7ff74b58350]
jmp 0x7ff74affad2
mov rcx, qword [rbp + 0x28]
call sub.SspiCli.dll_FreeContextBuffer
mov r8d, dword [rbp + 0x18]
mov rdx, qword [rbp + 0x30]
mov ecx, dword [rbp + 0x10]
mov r9, r14
call fcn.7ff74aff6f0
jmp 0x7ff74b00388
mov rcx, qword [0x7ff74b584e0]
mov r8, r14
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
jmp 0x7ff74b0e820
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74affb72
mov rcx, qword [0x7ff74b58350]
cmp rcx, rbx
je 0x7ff74affb72
test byte [rcx + 0x1c], 2
je 0x7ff74affb72
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0xc
mov r9d, eax
call fcn.7ff74b25ec4
nop
jmp 0x7ff74affb72
mov eax, dword [rbp]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x7ff74b0e940
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.7ff74ae3a20
sub rsp, rcx
mov rcx, qword [rbp + 0x40]
lea r9, [rsp + 0x30]
lea rax, [rbp]
lea rdx, str.DCOM_Security
mov qword [rsp + 0x28], rax
mov qword [rbp + 0x20], r9
mov qword [rsp + 0x20], r9
lea r9, [rbp + 8]
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
nop
jmp 0x7ff74affbda
cmp dword [rbp + 8], 7
jne 0x7ff74affbe3
cmp dword [rbp], 3
jbe 0x7ff74affbe3
and dword [rbp + 0x18], 0
mov ebx, edi
add rdi, rdi
mov rcx, rdi
mov dword [rbp + 0x38], esi
mov r12, r14
call fcn.7ff74ae3720
mov r14, rax
test rax, rax
jne 0x7ff74b0e9c8
mov r9, r12
mov r8d, ebx
mov rdx, r15
mov ecx, r13d
jmp 0x7ff74b0e8b2
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rdx, qword [rbp + 0x20]
xor eax, eax
cmp word [rdx], ax
je 0x7ff74b0eaa4
mov r13, r14
cmp dword [rbp + 0x18], ebx
jae 0x7ff74b0eaa4
mov rcx, rdx
call qword [sym.imp.msvcrt.dll__wtoi]
xor r8d, r8d
mov edi, eax
cmp dword [0x7ff74b582c8], r8d
je 0x7ff74b0ea3b
mov rcx, qword [0x7ff74b58350]
lea rax, [0x7ff74b58350]
cmp rcx, rax
je 0x7ff74b0ea3b
test byte [rcx + 0x1c], 8
je 0x7ff74b0ea3b
mov r9, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x10]
lea edx, [r8 + 0xd]
lea r8, [0x7ff74b50000]
call fcn.7ff74b25f00
xor r8d, r8d
movzx edx, bx
mov eax, r8d
cmp edx, r8d
jbe 0x7ff74b0ea58
mov rcx, r12
cmp word [rcx], di
je 0x7ff74b0ea5d
add eax, esi
add rcx, 2
cmp eax, edx
jb 0x7ff74b0ea49
mov eax, 0xffffffff
mov ecx, 0xffffffff
cmp eax, ecx
je 0x7ff74b0ea7b
mov eax, 0xffff
cmp edi, eax
ja 0x7ff74b0eabe
add dword [rbp + 0x18], esi
mov word [r13], di
add r13, 2
mov rdx, qword [rbp + 0x20]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
lea rdx, [rdx + rcx*2 + 2]
mov qword [rbp + 0x20], rdx
cmp word [rdx], r8w
jne 0x7ff74b0e9e7
mov rcx, qword [0x7ff74b584e0]
mov r8, r12
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
xor r12d, r12d
jmp 0x7ff74affc02
mov ecx, dword [rbp + 0x10]
mov r9, r12
mov r8d, ebx
mov rdx, r15
call fcn.7ff74aff6f0
mov rcx, qword [0x7ff74b584e0]
mov r8, r14
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
jmp 0x7ff74b00388
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0xe
mov r9d, eax
call fcn.7ff74b25ec4
nop
jmp 0x7ff74affc02
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74affc0e
mov rcx, qword [0x7ff74b58350]
cmp rcx, rbx
je 0x7ff74affc0e
test byte [rcx + 0x1c], sil
je 0x7ff74affc0e
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0xf
mov r9d, eax
call fcn.7ff74b25ec4
nop
jmp 0x7ff74affc0e
add ecx, esi
cmp ecx, ebx
jae 0x7ff74affc2b
jmp 0x7ff74affc19
mov rax, qword [0x7ff74b584a8]
mov r8d, ecx
lea rcx, [r15 + 0x10]
shl r8, 4
mov rdx, r15
movdqu xmm6, xmmword [r8 + rax]
call sub.msvcrt.dll_memmove
movdqu xmmword [r15], xmm6
jmp 0x7ff74affc38
add ecx, esi
cmp ecx, edx
jae 0x7ff74affc57
jmp 0x7ff74affc49
mov eax, ecx
lea rcx, [r14 + 2]
mov rdx, r14
lea r8, [rax + rax]
movzx edi, word [r8 + r14]
call sub.msvcrt.dll_memmove
mov word [r14], di
jmp 0x7ff74affc64
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00388
mov rcx, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rcx, rdx
je 0x7ff74b00388
test byte [rcx + 0x1c], sil
je 0x7ff74b00388
lea edx, [r14 - 0x70]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov r9d, eax
call fcn.7ff74b25ec4
jmp 0x7ff74b00388
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x7ff74affd6b
mov rdi, r12
jmp 0x7ff74affd9e
mov rcx, qword [rdi + 0x10]
cmp rcx, r12
je 0x7ff74b0ec26
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], r12
mov rcx, qword [rdi]
cmp rcx, r12
je 0x7ff74b0ec37
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov qword [rdi], r12
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
nop
jmp 0x7ff74affdb8
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00388
mov rax, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rax, rdx
je 0x7ff74b00388
test byte [rax + 0x1c], sil
je 0x7ff74b00388
call sub.KERNEL32.dll_GetLastError
mov edx, 0x11
mov rcx, qword [0x7ff74b58350]
jmp 0x7ff74b0ebe3
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
nop
jmp 0x7ff74affe63
mov rdi, r12
jmp 0x7ff74affe96
mov rcx, qword [rdi + 0x10]
cmp rcx, r12
je 0x7ff74b0ecbe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], r12
mov rcx, qword [rdi]
cmp rcx, r12
je 0x7ff74b0eccf
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov qword [rdi], r12
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
nop
jmp 0x7ff74affeb0
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b00388
mov rax, qword [0x7ff74b58350]
lea rdx, [0x7ff74b58350]
cmp rax, rdx
je 0x7ff74b00388
test byte [rax + 0x1c], sil
je 0x7ff74b00388
call sub.KERNEL32.dll_GetLastError
mov edx, 0x12
jmp 0x7ff74b0ec87
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74affefd
mov rcx, qword [0x7ff74b58350]
lea rdi, [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74afff04
test byte [rcx + 0x1c], r13b
je 0x7ff74afff04
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x13
mov r9d, eax
call fcn.7ff74b25ec4
jmp 0x7ff74afff04
mov r9d, dword [0x7ff74b582b4]
jmp 0x7ff74afff78
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x14
call fcn.7ff74b262fc
nop
jmp 0x7ff74afff97
cmp dword [rbp + 8], r13d
jne 0x7ff74afffd1
cmp dword [rbp], r12d
je 0x7ff74afffd1
mov r9d, dword [rbp + 4]
and r9d, esi
mov dword [0x7ff74b582b0], r9d
jmp 0x7ff74afffd8
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x15
call fcn.7ff74b262fc
nop
jmp 0x7ff74affff7
cmp dword [rbp + 8], r13d
jne 0x7ff74b00031
mov r9d, dword [0x7ff74b5829c]
cmp dword [rbp], r12d
cmovne r9d, dword [rbp + 4]
mov dword [0x7ff74b5829c], r9d
jmp 0x7ff74b00038
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x16
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b00057
cmp dword [rbp + 8], esi
jne 0x7ff74b00091
cmp dword [rbp], r12d
je 0x7ff74b00091
cmp word [rbp + 4], r14w
je 0x7ff74b0ee3e
cmp word [rbp + 4], r15w
jne 0x7ff74b00091
mov r9d, esi
mov dword [0x7ff74b58298], esi
jmp 0x7ff74b00098
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x17
call fcn.7ff74b262fc
nop
jmp 0x7ff74b000b7
cmp dword [rbp + 8], esi
jne 0x7ff74b000f1
cmp dword [rbp], r12d
je 0x7ff74b000f1
cmp word [rbp + 4], r14w
je 0x7ff74b0ee8c
cmp word [rbp + 4], r15w
jne 0x7ff74b000f1
mov r9d, r12d
mov dword [0x7ff74b582c4], r12d
jmp 0x7ff74b000f8
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x18
call fcn.7ff74b262fc
nop
jmp 0x7ff74b00117
cmp dword [rbp + 8], esi
jne 0x7ff74b00151
cmp dword [rbp], r12d
je 0x7ff74b00151
cmp word [rbp + 4], r14w
je 0x7ff74b0eedb
cmp word [rbp + 4], r15w
jne 0x7ff74b00151
mov r9d, esi
mov dword [0x7ff74b582b8], esi
jmp 0x7ff74b00158
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x19
call fcn.7ff74b262fc
nop
jmp 0x7ff74b00177
mov ebx, 3
cmp dword [rbp + 8], ebx
jne 0x7ff74b001ad
cmp dword [rbp], 6
jb 0x7ff74b001ad
mov ecx, dword [rbp]
call fcn.7ff74ae3720
mov rdi, rax
cmp rax, r12
je 0x7ff74b001ad
mov rcx, qword [0x7ff74b58210]
lea rax, [rbp]
lea r9, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rdx, str.LegacyAuthenticationService
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x7ff74b0ef7f
cmp dword [rbp + 8], ebx
jne 0x7ff74b0ef7f
mov ebx, dword [rbp]
cmp ebx, 6
jb 0x7ff74b0ef7f
cmp word [rdi + 2], r12w
jne 0x7ff74b0ef7f
mov eax, ebx
shr eax, 1
sub eax, esi
cmp word [rdi + rax*2], r12w
je 0x7ff74b0ef9a
mov rcx, qword [0x7ff74b584e0]
mov r8, rdi
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov ebx, r12d
mov rdi, r12
mov dword [rbp], ebx
mov rcx, qword [0x7ff74b58420]
call fcn.7ff74ae3010
mov r8, qword [0x7ff74b5a008]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov rcx, qword [0x7ff74b58420]
mov qword [0x7ff74b5a008], rdi
mov dword [0x7ff74b5940c], ebx
lock add dword [rcx + 0x3c], 0xffffffff
mov dword [rcx + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x7ff74b001ad
cmp dword [rbp + 8], r13d
cmove r9d, dword [rbp + 4]
mov dword [0x7ff74b582ac], r9d
jmp 0x7ff74b001ee
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1a
call fcn.7ff74b25ec4
jmp 0x7ff74b00219
lea rdi, [0x7ff74b58350]
mov bl, 8
jmp 0x7ff74b00219
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1b
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b00284
cmp dword [rbp + 8], esi
jne 0x7ff74b002be
cmp dword [rbp], r12d
je 0x7ff74b002be
cmp word [rbp + 4], r14w
je 0x7ff74b0f062
cmp word [rbp + 4], r15w
jne 0x7ff74b002be
mov r9d, esi
mov dword [0x7ff74b582a4], esi
jmp 0x7ff74b002c5
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1c
call fcn.7ff74b262fc
nop
jmp 0x7ff74b002e3
cmp dword [rbp + 8], esi
jne 0x7ff74b0031d
cmp dword [rbp], r12d
je 0x7ff74b0031d
cmp word [rbp + 4], r14w
je 0x7ff74b0f0b0
cmp word [rbp + 4], r15w
jne 0x7ff74b0031d
mov dword [0x7ff74b582a0], esi
jmp 0x7ff74b00323
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1d
mov r9d, esi
call fcn.7ff74b262fc
nop
jmp 0x7ff74b00341
cmp dword [rbp + 8], r13d
jne 0x7ff74aff833
cmp dword [rbp], r12d
je 0x7ff74aff833
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b0f120
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b0f120
test byte [rcx + 0x1c], bl
je 0x7ff74b0f120
mov r9d, dword [rbp + 4]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1e
call fcn.7ff74b25ec4
mov ecx, dword [rbp + 4]
cmp cx, r12w
jbe 0x7ff74b0f14a
mov eax, 3
cmp cx, ax
ja 0x7ff74b0f14a
movzx eax, cx
shl ax, 2
add cx, ax
shl cx, 3
mov word [0x7ff74b58370], cx
jmp 0x7ff74b0f159
mov eax, 0x78
mov cx, ax
mov word [0x7ff74b58370], ax
movzx eax, cx
add ax, ax
add cx, ax
mov word [0x7ff74b58600], cx
jmp 0x7ff74aff84b
cmp dword [rbp + 8], r13d
jne 0x7ff74b0034e
cmp dword [rbp], r12d
je 0x7ff74b0034e
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b0f1b5
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b0f1b5
test byte [rcx + 0x1c], bl
je 0x7ff74b0f1b5
mov r9d, dword [rbp + 4]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x1f
call fcn.7ff74b25ec4
mov eax, dword [rbp + 4]
mov dword [0x7ff74b59b84], eax
jmp 0x7ff74b0034e
cmp dword [rbp + 8], r13d
jne 0x7ff74b00388
cmp dword [rbp], r12d
je 0x7ff74b00388
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b0f20a
mov rcx, qword [0x7ff74b58350]
cmp rcx, rdi
je 0x7ff74b0f20a
test byte [rcx + 0x1c], bl
je 0x7ff74b0f20a
mov r9d, dword [rbp + 4]
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b50000]
mov edx, 0x20
call fcn.7ff74b25ec4
mov eax, dword [rbp + 4]
mov dword [0x7ff74b59bf4], eax
jmp 0x7ff74b00388