Function at 0x14000d150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push rbp
mov rbp, rsp
mov eax, 0x20668
call fcn.14000f5f0
sub rsp, rax
mov rbx, rcx
lea rdi, [rbp - 0x20626]
xor eax, eax
mov ecx, 0x1fffe
rep stosb byte [rdi], al
lea rdi, [rbp - 0x218]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rbp - 0x420]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rbp - 0x628]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000d2a3
mov rcx, rsi
lea rdx, [0x140022060]
mov r8d, 0x1020001
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rdi, rdi
jne 0x14000d1fe
mov rcx, rsi
lea rdx, [0x140022060]
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0x104
mov rcx, rdi
xor edx, edx
xor r8d, r8d
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x14000d236
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000d29a
mov r8d, dword [rbp - 4]
mov eax, r8d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000f5f0
sub rsp, rax
lea rax, [rsp + 0x40]
mov rsi, rax
mov rcx, rdi
mov rdx, rsi
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x14000d29a
mov qword [rbp - 0x10], 0
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x1f
xor r8, r8
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14000d2aa
xor r12, r12
jmp 0x14000d317
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000d8cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000d292
mov r9d, dword [rbp - 4]
mov eax, r9d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000f5f0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r12, rax
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x1f
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x14000d29a
mov qword [rsp + 0x20], 0
mov rcx, r12
mov edx, 1
mov r8d, 0x1f
lea r9, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
test eax, eax
je 0x14000d29a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsi]
cmp eax, 1
je 0x14000d366
cmp eax, 2
jne 0x14000d3a0
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.FS_driver_name:__ls
lea r9, [0x140022060]
call fcn.14000e950
jmp 0x14000d3bf
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Driver_name:__ls
lea r9, [0x140022060]
call fcn.14000e950
jmp 0x14000d3bf
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Service_name:__ls
lea r9, [0x140022060]
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfa7
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x38]
test r9, r9
je 0x14000d423
mov rdx, qword [rsi + 0x38]
lea r8, [0x14001c66e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000d409
add rcx, 2
test ax, ax
jne 0x14000d3f3
jmp 0x14000d423
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Display_name:__ls
call fcn.14000e950
jmp 0x14000d43b
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Display_name:_None
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfaa
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x30]
test r9, r9
je 0x14000d49f
mov rdx, qword [rsi + 0x30]
lea r8, [0x14001c66e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000d485
add rcx, 2
test ax, ax
jne 0x14000d46f
jmp 0x14000d49f
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Account_name:__ls
call fcn.14000e950
jmp 0x14000d4b7
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Account_name:_None
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfab
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14000d51b
mov rdx, qword [rsi + 0x10]
lea r8, [0x14001c66e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000d501
add rcx, 2
test ax, ax
jne 0x14000d4eb
jmp 0x14000d51b
lea rcx, [rbp - 0x20626]
mov edx, 0xffff
lea r8, str.Binary_path:__ls
call fcn.14000e950
jmp 0x14000d533
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Binary_path:_None
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfac
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rax, str.Parameters
mov qword [rsp + 0x28], rax
lea rax, [0x140022060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str._ls_ls_ls
lea r9, str.SYSTEMCurrentControlSetServices
call fcn.14000e950
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x218]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rdi, 0xffffffff80000002
mov rcx, rdi
lea rdx, [rbp - 0x20626]
lea r8, str.ServiceDll
mov r9d, 0xffff
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000d656
lea rax, [0x140022060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str._ls_ls
lea r9, str.SYSTEMCurrentControlSetServices
call fcn.14000e950
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x218]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
lea rdx, [rbp - 0x20626]
lea r8, str.ServiceDll
mov r9d, 0xffff
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000d656
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.ServiceDll_path:_None
call fcn.14000e950
jmp 0x14000d675
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.ServiceDll_path:__ls
lea r9, [rbp - 0x218]
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfad
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rsi + 0x28]
test rdx, rdx
je 0x14000d747
mov r8, qword [rsi + 0x28]
lea r9, [0x14001c66e]
xor ecx, ecx
mov ax, word [r8 + rcx]
cmp ax, word [r9 + rcx]
jne 0x14000d6c7
add rcx, 2
test ax, ax
jne 0x14000d6ad
jmp 0x14000d747
mov rdi, rdx
cmp word [rdi], 0
je 0x14000d726
lea r14, str._ls
cmp word [rdi], 0x2b
je 0x14000d6fd
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x420]
mov edx, 0x104
mov r8, r14
lea r9, [rbp - 0x420]
call fcn.14000e950
mov rax, 0xffffffffffffffff
nop dword [rax]
nop word [rax + rax]
add rax, 1
cmp word [rdi + rax*2], 0
jne 0x14000d710
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x14000d6d7
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Dependencies:__ls
lea r9, [rbp - 0x420]
call fcn.14000e950
jmp 0x14000d75f
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Dependencies:_None
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfae
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x18]
test r9, r9
je 0x14000d7c3
mov rdx, qword [rsi + 0x18]
lea r8, [0x14001c66e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x14000d7a9
add rcx, 2
test ax, ax
jne 0x14000d793
jmp 0x14000d7c3
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Order_group:__ls
call fcn.14000e950
jmp 0x14000d7db
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Order_group:_None
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfaf
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [rsi + 0x20]
test esi, esi
jne 0x14000d821
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Tag_Id:___ls__has_not_been_assigned_a_tag
lea r9, [0x140022060]
call fcn.14000e950
jmp 0x14000d850
mov ecx, esi
lea rdx, [rbp - 0x628]
mov r8d, 0xa
call fcn.14000ea10
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.Tag_Id:__ls
mov r9, rax
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfb0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
test r12, r12
je 0x14000d891
lea rcx, [rbp - 0x20626]
mov edx, 0xffff
lea r8, str.SDDL:__ls
mov r9, qword [rbp - 0x10]
call fcn.14000e950
jmp 0x14000d8a9
lea rcx, [rbp - 0x20626]
mov edx, 0x104
lea r8, str.SDDL:_The__SeSecurityPrivilege__is_disabled._Use_the_Privileges_and_Access_Rights_Manager.
call fcn.14000e950
mov rcx, rbx
mov edx, 0xfbc
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x20626]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov rsp, rbp
pop rbp
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret