Function at 0x1400e48b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov r15, rcx
mov rbx, r8
lea rcx, [rbp - 0x39]
xor r14d, r14d
mov qword [rsp + 0x28], rcx
lea r8, [0x140179408]
mov rcx, r15
mov dword [rbp + 0x7f], r14d
mov edi, r14d
mov dword [rsp + 0x20], 0x20019
call fcn.14000d810
mov edx, 0x6b6e
lea r8d, [rdx + 8]
test eax, eax
je 0x1400e4dbf
mov r13, qword [rbp - 0x39]
mov ecx, dword [r15]
mov qword [rbp - 0x31], r13
mov dword [rbp - 0x3d], r14d
mov dword [rbp - 0x49], r14d
test ecx, ecx
je 0x1400e4a43
cmp ecx, 1
jne 0x1400e4c62
mov esi, r14d
test r13, r13
jne 0x1400e494b
mov rax, qword [r15 + 8]
mov r13, qword [rax + 0x18]
cmp word [r13 + 4], dx
jne 0x1400e4a25
mov edx, dword [r13 + 0x28]
test edx, edx
je 0x1400e4a25
movsxd rcx, dword [r13 + 0x2c]
cmp ecx, 0xffffffff
je 0x1400e4a25
mov rax, qword [r15 + 8]
mov r12, rcx
add r12, qword [rax + 0x10]
test edx, edx
je 0x1400e4a25
test rsi, rsi
jne 0x1400e4a1f
mov eax, r14d
movsxd rbx, dword [r12 + rax*4 + 4]
mov rax, qword [r15 + 8]
add rbx, qword [rax + 0x10]
cmp word [rbx + 4], r8w
jne 0x1400e4a12
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e4a12
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e49c6
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e4a0c
jmp 0x1400e49ee
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e4a0c
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179404]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove rsi, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r8d, 0x6b76
inc r14d
cmp r14d, dword [r13 + 0x28]
jb 0x1400e4982
mov edi, dword [rbp - 0x3d]
xor r14d, r14d
mov r13, qword [rbp - 0x31]
test rsi, rsi
mov ebx, r14d
setne bl
test rsi, rsi
je 0x1400e4a7c
mov eax, dword [rsi + 8]
btr eax, 0x1f
mov dword [rbp - 0x49], eax
jmp 0x1400e4a7c
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rdx, [0x140179404]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, r14d
sete bl
test eax, eax
je 0x1400e4a7c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400e4c62
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x1400e4c6e
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 9], rax
mov r12, rax
test rax, rax
je 0x1400e4c72
mov ecx, dword [r15]
mov edi, r14d
test ecx, ecx
je 0x1400e4c06
cmp ecx, 1
jne 0x1400e4c3c
mov rsi, r14
test r13, r13
jne 0x1400e4ad3
mov rax, qword [r15 + 8]
mov r13, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r13 + 4], ax
jne 0x1400e4bb8
mov edx, dword [r13 + 0x28]
test edx, edx
je 0x1400e4bb8
movsxd rcx, dword [r13 + 0x2c]
cmp ecx, 0xffffffff
je 0x1400e4bb8
mov rax, qword [r15 + 8]
add rcx, qword [rax + 0x10]
mov qword [rbp - 0x29], rcx
test edx, edx
je 0x1400e4bb5
mov r12d, 0x6b76
test rsi, rsi
jne 0x1400e4bb1
mov eax, r14d
movsxd rbx, dword [rcx + rax*4 + 4]
mov rax, qword [r15 + 8]
add rbx, qword [rax + 0x10]
cmp word [rbx + 4], r12w
jne 0x1400e4ba4
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e4ba4
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e4b5a
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e4ba0
jmp 0x1400e4b82
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e4ba0
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179404]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove rsi, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
inc r14d
cmp r14d, dword [r13 + 0x28]
jb 0x1400e4b16
mov r12, qword [rbp - 9]
xor r14d, r14d
test rsi, rsi
mov edi, r14d
setne dil
test rsi, rsi
je 0x1400e4c3c
mov ecx, dword [rsi + 8]
mov edi, r14d
mov ebx, ecx
btr ebx, 0x1f
cmp dword [rbp - 0x49], ebx
setae dil
jb 0x1400e4c01
lea rdx, [rsi + 0xc]
test ecx, ecx
js 0x1400e4bf6
mov rax, qword [r15 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebx
mov rcx, r12
call fcn.14011b4a0
mov dword [rbp - 0x49], ebx
jmp 0x1400e4c3c
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140179404]
xor r8d, r8d
mov qword [rsp + 0x20], r12
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete dil
test eax, eax
je 0x1400e4c3c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1400e4c48
mov eax, dword [rbp - 0x49]
mov dword [rbp - 0x21], eax
jmp 0x1400e4c72
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r12, rax
jmp 0x1400e4c72
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___pre___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov r12, qword [rbp + 0x7f]
cmp dword [r15], 0
jne 0x1400e4c8e
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e4c8e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x1400e4cfb
lea rcx, str.Local_SID_:
call fcn.14000afb0
mov ecx, dword [rbp - 0x21]
lea rdx, [rbp - 0x31]
add rcx, 0xffffffffffffffe8
add rcx, r12
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x1400e4cd2
mov rdx, qword [rbp - 0x31]
lea rcx, [0x14015fc60]
call fcn.14000afb0
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400e4ce6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kull_m_string_displaySID___ConvertSidToStringSid__0x_08x__n
call fcn.14000afb0
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000afb0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [rbp + 0x7f]
mov rbx, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x6f]
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea r8, [0x140179408]
mov rcx, r15
mov dword [rsp + 0x20], 0x20019
call fcn.14000d810
test eax, eax
je 0x1400e5401
mov rdx, qword [rbp + 7]
lea r9, [rbp + 0xf]
mov r8, rbx
mov rcx, r15
call fcn.1400e5b10
test eax, eax
je 0x1400e53d3
mov rdx, qword [rbp + 7]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
lea r8, str.Users
mov rcx, r15
mov dword [rsp + 0x20], 0x20019
call fcn.14000d810
test eax, eax
je 0x1400e53df
mov ecx, dword [r15]
mov esi, r14d
mov dword [rbp + 0x7f], r14d
test ecx, ecx
je 0x1400e4dd0
cmp ecx, 1
jne 0x1400e4e27
mov rcx, qword [rbp - 0x19]
test rcx, rcx
jne 0x1400e4d9d
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x18]
mov edi, 0x6b6e
cmp word [rcx + 4], di
sete sil
mov dword [rbp + 0x7f], esi
jne 0x1400e4e2c
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x1d], eax
mov eax, dword [rcx + 0x38]
shr eax, 1
mov dword [rbp - 0x41], eax
jmp 0x1400e4e2c
lea rcx, str.ERROR_kull_m_registry_OpenAndQueryWithAlloc___kull_m_registry_RegOpenKeyEx_KO_n
call fcn.14000afb0
jmp 0x1400e4d02
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x58], r14
xor r9d, r9d
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov qword [rsp + 0x48], r14
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
sete sil
mov dword [rbp + 0x7f], esi
test eax, eax
je 0x1400e4e27
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, 0x6b6e
test esi, esi
je 0x1400e53a4
mov eax, dword [rbp - 0x41]
mov ecx, 0x40
inc eax
mov dword [rbp - 0x41], eax
lea edx, [rax + 1]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x29], rax
mov rbx, rax
test rax, rax
je 0x1400e53a4
cmp dword [rbp - 0x1d], 0
mov ecx, r14d
mov dword [rbp - 0x3d], ecx
jbe 0x1400e539b
nop dword [rax]
mov eax, dword [rbp - 0x41]
mov r8d, ecx
mov rdx, qword [rbp - 0x19]
mov r9, rbx
mov dword [rbp - 0x21], eax
mov rcx, r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
call fcn.14000de80
test eax, eax
je 0x1400e5385
lea rdx, str.Names
mov rcx, rbx
call fcn.14011ebc8
test eax, eax
je 0x1400e5385
lea r8, [rbp - 0x45]
mov rcx, rbx
lea rdx, [0x14017917c]
call fcn.140012090
cmp eax, 0xffffffff
je 0x1400e5385
mov r8d, dword [rbp - 0x45]
lea rcx, str._nRID__:__08x___u__n
mov edx, r8d
call fcn.14000afb0
mov rdx, qword [rbp - 0x19]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x28], rax
mov r8, rbx
mov rcx, r15
mov dword [rsp + 0x20], 0x20019
call fcn.14000d810
and esi, eax
mov dword [rbp + 0x7f], esi
je 0x1400e53c2
mov r13, qword [rbp - 0x11]
mov r12d, r14d
mov ecx, dword [r15]
mov qword [rbp - 9], r13
mov dword [rbp - 1], r14d
mov dword [rbp - 0x49], r14d
test ecx, ecx
je 0x1400e5124
cmp ecx, 1
jne 0x1400e526f
test r13, r13
jne 0x1400e4f3e
mov rax, qword [r15 + 8]
mov r13, qword [rax + 0x18]
cmp word [r13 + 4], di
jne 0x1400e501e
mov edx, dword [r13 + 0x28]
test edx, edx
je 0x1400e501e
movsxd rcx, dword [r13 + 0x2c]
cmp ecx, 0xffffffff
je 0x1400e501e
mov rax, qword [r15 + 8]
xor esi, esi
add rcx, qword [rax + 0x10]
mov qword [rbp - 0x31], rcx
test edx, edx
je 0x1400e501b
mov r12d, 0x6b76
nop
test r14, r14
jne 0x1400e5017
mov rax, qword [r15 + 8]
movsxd rbx, dword [rcx + rsi*4 + 4]
add rbx, qword [rax + 0x10]
cmp word [rbx + 4], r12w
jne 0x1400e500b
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e500b
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e4fc1
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e5007
jmp 0x1400e4fe9
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e5007
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179404]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove r14, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x31]
inc esi
cmp esi, dword [r13 + 0x28]
jb 0x1400e4f80
mov r12d, dword [rbp - 1]
mov esi, dword [rbp + 0x7f]
mov r13, qword [rbp - 9]
xor ebx, ebx
test r14, r14
setne bl
test r14, r14
je 0x1400e503a
mov eax, dword [r14 + 8]
btr eax, 0x1f
mov dword [rbp - 0x49], eax
xor r14d, r14d
test ebx, ebx
je 0x1400e526f
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x1400e527b
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x39], rax
mov rdi, rax
test rax, rax
je 0x1400e526a
mov ecx, dword [r15]
mov r12d, r14d
test ecx, ecx
je 0x1400e520e
cmp ecx, 1
jne 0x1400e5244
mov rsi, r14
test r13, r13
jne 0x1400e5094
mov rax, qword [r15 + 8]
mov r13, qword [rax + 0x18]
mov eax, 0x6b6e
cmp word [r13 + 4], ax
jne 0x1400e51c0
mov edx, dword [r13 + 0x28]
test edx, edx
je 0x1400e51c0
movsxd rcx, dword [r13 + 0x2c]
cmp ecx, 0xffffffff
je 0x1400e51c0
mov rax, qword [r15 + 8]
mov r12, rcx
add r12, qword [rax + 0x10]
test edx, edx
je 0x1400e51bd
test rsi, rsi
jne 0x1400e51b9
mov eax, r14d
movsxd rbx, dword [r12 + rax*4 + 4]
mov rax, qword [r15 + 8]
add rbx, qword [rax + 0x10]
mov eax, 0x6b76
cmp word [rbx + 4], ax
jne 0x1400e51ac
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400e51ac
test byte [rbx + 0x14], 1
mov edx, eax
je 0x1400e5166
lea rcx, [rbx + 0x18]
call fcn.140012170
mov rdi, rax
test rax, rax
je 0x1400e51ac
jmp 0x1400e518e
mov rcx, qword [rbp - 0x11]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rdx, [0x140179404]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, r14d
sete bl
test eax, eax
je 0x1400e503d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400e503d
add rdx, 2
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1400e51ac
movzx r8d, word [rbx + 6]
lea rdx, [rbx + 0x18]
mov rcx, rax
call fcn.14011b4a0
mov rdx, rdi
lea rcx, [0x140179404]
call fcn.14011ebc8
test eax, eax
mov rcx, rdi
cmove rsi, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc r14d
cmp r14d, dword [r13 + 0x28]
jb 0x1400e50d0
mov rdi, qword [rbp - 0x39]
xor r14d, r14d
test rsi, rsi
mov r12d, r14d
setne r12b
test rsi, rsi
je 0x1400e5244
mov ecx, dword [rsi + 8]
mov r12d, r14d
mov ebx, ecx
btr ebx, 0x1f
cmp dword [rbp - 0x49], ebx
setae r12b
jb 0x1400e5209
lea rdx, [rsi + 0xc]
test ecx, ecx
js 0x1400e51fe
mov rax, qword [r15 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.14011b4a0
mov dword [rbp - 0x49], ebx
jmp 0x1400e5244
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140179404]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete r12b
test eax, eax
je 0x1400e5244
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r12d, r12d
jne 0x1400e526a
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [rbp + 0x7f]
mov rdi, rax
mov qword [rbp - 0x39], rax
jmp 0x1400e527f
mov esi, dword [rbp + 0x7f]
jmp 0x1400e527b
lea rcx, str.ERROR_kull_m_registry_QueryWithAlloc___pre___kull_m_registry_RegQueryValueEx_KO_n
call fcn.14000afb0
mov rdi, qword [rbp - 0x39]
and esi, r12d
mov dword [rbp + 0x7f], esi
je 0x1400e5354
mov r8d, dword [rdi + 0xc]
lea rcx, str.User_:__.s_n
mov edx, dword [rdi + 0x10]
add r8, 0xcc
add r8, rdi
shr rdx, 1
call fcn.14000afb0
mov r9d, dword [rbp - 0x45]
lea rcx, [rdi + 0x9c]
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0xf]
lea rdx, [rdi + 0xcc]
mov dword [rsp + 0x20], r14d
call fcn.1400e5440
mov r9d, dword [rbp - 0x45]
lea rcx, [rdi + 0xa8]
lea r8, [rbp + 0xf]
mov dword [rsp + 0x28], r14d
lea rdx, [rdi + 0xcc]
mov dword [rsp + 0x20], 1
call fcn.1400e5440
mov r9d, dword [rbp - 0x45]
lea rcx, [rdi + 0xc0]
lea r8, [rbp + 0xf]
mov dword [rsp + 0x28], 1
lea rdx, [rdi + 0xcc]
mov dword [rsp + 0x20], r14d
call fcn.1400e5440
mov r9d, dword [rbp - 0x45]
lea rcx, [rdi + 0xb4]
lea r8, [rbp + 0xf]
mov dword [rsp + 0x28], 1
lea rdx, [rdi + 0xcc]
mov dword [rsp + 0x20], 1
call fcn.1400e5440
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, qword [rbp - 0x11]
lea r8, [rbp + 0xf]
mov rcx, r15
call fcn.1400e56b0
mov ecx, dword [r15]
test ecx, ecx
jne 0x1400e5381
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e5381
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rbp - 0x29]
mov ecx, dword [rbp - 0x3d]
mov edi, 0x6b6e
inc ecx
mov dword [rbp - 0x3d], ecx
cmp ecx, dword [rbp - 0x1d]
jb 0x1400e4e70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [r15], 0
jne 0x1400e53df
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e53df
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400e53df
mov rdx, rbx
lea rcx, str.ERROR_kuhl_m_lsadump_getUsersAndSamKey___kull_m_registry_RegOpenKeyEx_user___s__n
call fcn.14000afb0
jmp 0x1400e5385
lea rcx, str.ERROR_kuhl_m_lsadump_getUsersAndSamKey___kuhl_m_lsadump_getSamKey_KO_n
call fcn.14000afb0
mov edx, dword [r15]
test edx, edx
jne 0x1400e53fc
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1400e53fc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rbp + 0x7f]
jmp 0x1400e5417
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ERROR_kuhl_m_lsadump_getUsersAndSamKey___kull_m_registry_RegOpenKeyEx_SAM_Accounts__0x_08x__n
call fcn.14000afb0
mov eax, edi
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret