Function at 0x180001120
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
and dword [rbp + 0x6f], 0
mov r12, rcx
and qword [rbp - 0x71], 0
xor esi, esi
and qword [rcx], rsi
xor edi, edi
and qword [rbp - 0x79], 0
lea rcx, [rbp - 0x59]
and dword [rbp + 0x67], 0
xor edx, edx
mov r8d, 0x80
mov qword [rbp - 0x69], rdi
xor r15b, r15b
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rax, [rbp - 0x79]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSet
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1800011a5
mov ebx, 0xa9c
jmp 0x180001572
mov rcx, qword [rbp - 0x79]
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x59]
call qword [sym.imp.JoinUtil.dll_NetpLoadFullJoinState]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1800011fa
cmp eax, 0xa95
jne 0x1800011e2
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea eax, [rbx + 5]
jmp 0x18000161d
call fcn.1800084e0
mov edx, ebx
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_ODJ_data_present_but_load_failed:_0x_1x_n
call fcn.180008608
jmp 0x180001549
call fcn.1800084e0
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate_n
mov r15b, 1
call fcn.180008608
test dword [rbp + 0x1f], 0x40000000
je 0x18000122d
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_Boot_time_blob_processing_but_detected_online_caller_blob_n
call fcn.180008608
mov ebx, 0xa96
jmp 0x180001572
mov eax, dword [rbp + 0x6f]
test eax, eax
je 0x18000156d
sub eax, 1
jne 0x180001223
mov rcx, qword [rbp - 0x79]
lea rax, [rbp - 0x71]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ServicesTcpipParameters
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x18000127b
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_Unable_to_match_expected_hostnames__Tcpip_parameters_are_missing_or_cant_be_accessed._n
call fcn.180008608
jmp 0x18000119b
mov rcx, qword [rbp - 0x71]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x77]
and qword [rsp + 0x20], rsi
lea rdx, str.NV_Hostname
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1800012b2
cmp eax, 0xea
jne 0x1800012b8
cmp dword [rbp + 0x77], 1
je 0x1800012c1
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_Unable_to_match_expected_hostnames__Tcpip_parameter_NV_Hostname_is_missing_or_cant_be_accessed._n
jmp 0x180001271
mov edx, dword [rbp + 0x67]
mov r14d, 0x40
mov ecx, r14d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x1800012eb
mov ebx, 8
jmp 0x180001572
mov rcx, qword [rbp - 0x71]
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.NV_Hostname
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x18000119b
mov rdx, qword [rbp - 0x51]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x18000134e
mov r8, qword [rbp - 0x51]
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_Unable_to_match_expected_hostnames.__Configured_hostname_is__ws__expected_hostname_is__ws._n
mov rdx, rsi
call fcn.180008608
jmp 0x18000119b
mov rax, qword [rbp - 0x51]
lea rdx, str._NULL_
xor ebx, ebx
lea rcx, [0x18000bcb0]
test rax, rax
cmovne rdx, rax
call fcn.180008608
call fcn.180008674
call qword [sym.imp.JoinUtil.dll_NetpDoDomainJoinLicensingCheck]
nop dword [rax + rax]
test eax, eax
jns 0x18000138e
mov ecx, eax
call fcn.180008c24
mov ebx, eax
jmp 0x1800013d7
lea rcx, [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
nop dword [rax + rax]
test al, al
jne 0x1800013b2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1800013c9
cmp dword [rbp + 0x7f], 2
jne 0x1800013c9
lea rcx, str.NetpMachineValidToJoinPhase3:_the_specified_machine_is_a_domain_controller._n
mov ebx, 0xa85
call fcn.180008608
mov edx, ebx
lea rcx, str.NetpMachineValidToJoinPhase3:_status:_0x_lx_n
call fcn.180008608
test ebx, ebx
jne 0x180001572
lea edx, [rbx + 0x48]
mov ecx, r14d
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rbp - 0x69], rax
mov rdi, rax
test rax, rax
je 0x1800012e1
mov rax, qword [rbp - 0x41]
mov ecx, r14d
movzx edx, word [rax + 2]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1800012e1
mov rdx, qword [rbp - 0x41]
mov rcx, rax
movzx r8d, word [rdx]
mov rdx, qword [rdx + 8]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp - 0x41]
lea ecx, [rbx + 0x40]
movzx edx, word [rax + 0x12]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1800012e1
mov rdx, qword [rbp - 0x41]
mov rcx, rax
movzx r8d, word [rdx + 0x10]
mov rdx, qword [rdx + 0x18]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
lea rcx, [rdi + 0x10]
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp - 0x41]
lea ecx, [rbx + 0x40]
movzx edx, word [rax + 0x22]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1800012e1
mov rdx, qword [rbp - 0x41]
mov rcx, rax
movzx r8d, word [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
lea rcx, [rdi + 0x20]
mov rdx, r14
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp - 0x41]
movups xmm0, xmmword [rax + 0x30]
movdqu xmmword [rdi + 0x30], xmm0
mov rcx, qword [rbp - 0x41]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
nop dword [rax + rax]
mov edx, eax
lea ecx, [rbx + 0x40]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x1800012e1
mov rcx, qword [rbp - 0x41]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.ntdll.dll_RtlLengthSid]
nop dword [rax + rax]
mov rdx, qword [rbp - 0x41]
mov rcx, r14
mov r8d, eax
mov rdx, qword [rdx + 0x40]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov qword [rdi + 0x40], r14
mov r15b, 1
test ebx, ebx
jne 0x180001572
mov r8, qword [rbp - 0x79]
lea edx, [rbx + 1]
lea rcx, [rbp - 0x59]
call qword [sym.imp.JoinUtil.dll_NetpSaveFullJoinStateInternal]
nop dword [rax + rax]
mov qword [r12], rdi
jmp 0x1800015b5
mov ebx, 0xa9a
test dword [rbp + 0x1f], 0x40000000
je 0x18000158b
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.JoinUtil.dll_NetpClearFullJoinState]
nop dword [rax + rax]
mov edx, dword [rbp + 0x6f]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.JoinUtil.dll_NetpMarkLastFullJoinAttempt]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_An_error_occured_while_completing_the_offline_join_action__the_action_can_be_tried_again.__The_error_code_was:_0x_lx._n
call fcn.180008608
lea rcx, [rbp - 0x69]
call sym.netprovfw.dll_NetpProvFreeLdapLsaDomainInfo
mov rcx, qword [rbp - 0x71]
test rcx, rcx
je 0x1800015ca
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x1800015df
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test rsi, rsi
je 0x1800015f3
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
lea rcx, [rbp - 0x59]
call qword [sym.imp.JoinUtil.dll_NetpFreeJoinStateContents]
nop dword [rax + rax]
mov edx, ebx
lea rcx, str.NetpProvCheckOfflineLsaPolicyUpdate:_status:_0x_lx_n
call fcn.180008608
test r15b, r15b
je 0x18000161b
call fcn.180008584
mov eax, ebx
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret