Function at 0x140001840
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x638]
sub rsp, 0x738
mov rax, qword [0x140013008]
xor rax, rsp
mov qword [rbp + 0x620], rax
xor r13d, r13d
lea rax, [rbp + 0x220]
mov rdi, rcx
mov qword [rbp - 8], rax
xor eax, eax
mov r12d, edx
lea r8d, [r13 + 0x4c]
lea rcx, [rbp - 0x64]
xor edx, edx
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x78], r13
mov dword [rsp + 0x50], 0x200
mov esi, r13d
mov dword [rsp + 0x60], 0x200
mov dword [rsp + 0x64], 0x100
mov dword [rbp - 0x10], 2
mov qword [rbp - 0x70], 1
mov dword [rbp - 0x68], r13d
call fcn.140004080
mov qword [rsp + 0x40], r13
lea rax, str.SOFTWAREQStar_Technologies__Inc.QStar_SoftwareSecurityFsi_Passwd
lea rbx, str.SOFTWAREQStar_Technologies__Inc.QStar_SoftwareSecurityFsi_Group
test r12d, r12d
lea r9, [0x140010fbc]
cmovne rbx, rax
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], 0x20119
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14000194a
lea r8, str.Registry_node_not_found
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [r13 + 3]
jmp 0x140001db0
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x220]
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140001da3
mov qword [rsp + 0x780], r14
mov qword [rsp + 0x730], r15
lea rbx, str.S_1_1_0
lea r15, [0x140011100]
lea r14, str.EVERYONE
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x78]
lea rdx, [rbp + 0x220]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001d3a
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x50]
lea rdx, [0x140011104]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
test r12d, r12d
cmovne rdx, r15
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140001d31
mov rcx, qword [0x14001afe0]
lea r9, [rbp - 0x10]
or r8, 0xffffffffffffffff
mov edx, 0x1053
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp - 0x6c], eax
cmp eax, 0xffffffff
jne 0x140001c6d
mov rcx, qword [0x14001afe0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
mov dword [rbp - 0x70], 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x14001afe0]
test r12d, r12d
mov dword [rbp - 0x6c], eax
mov eax, r13d
sete al
mov dword [rbp - 0x4c], eax
lea rax, [rbp + 0x220]
lea r9, [rbp - 0x70]
xor r8d, r8d
mov edx, 0x104d
mov dword [rbp - 0x68], r13d
mov qword [rbp - 0x58], rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x220]
mov dword [rsp + 0x64], 0x100
mov dword [rsp + 0x60], 0x100
mov dword [rbp - 0x6c], eax
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x140001c6d
mov rdx, qword [rsp + 0x70]
lea rax, [rbp - 0x80]
lea r9, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
lea r8, [rbp + 0x420]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
xor ecx, ecx
mov word [rbp + 0x20], r13w
mov word [rbp + 0x420], r13w
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x140001b39
lea r8, [0x140011108]
lea rcx, [rbp + 0x20]
mov edx, 0x100
call fcn.1400036f0
lea r8, [rbp + 0x420]
lea rcx, [rbp + 0x20]
mov edx, 0x100
call fcn.1400036f0
jmp 0x140001b8f
mov r9d, r13d
nop dword [rax]
mov r8d, r9d
lea rax, [rbp + 0x220]
shl r8, 0xa
add r8, rbx
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001b68
add rax, 2
test ecx, ecx
jne 0x140001b54
test edx, edx
je 0x140001b77
inc r9d
cmp r9d, 0x12
jb 0x140001b40
jmp 0x140001b8f
mov r8d, r9d
lea rcx, [rbp + 0x20]
mov edx, 0x100
shl r8, 0xa
add r8, r14
call fcn.1400037a4
cmp word [rbp + 0x20], r13w
jne 0x140001c3e
lea rdx, str.S_1_5_5_
lea rcx, [rbp + 0x220]
mov r8d, 8
call fcn.140003778
test eax, eax
jne 0x140001bcc
lea r8, str.LOGON_ID
lea rcx, [rbp + 0x20]
mov edx, 0x100
call fcn.1400037a4
cmp word [rbp + 0x20], r13w
jne 0x140001c3e
lea rdx, str.S_1_5_80_
lea rcx, [rbp + 0x220]
mov r8d, 9
call fcn.140003778
test eax, eax
jne 0x140001c05
lea r8, str.NT_SERVICE
lea rcx, [rbp + 0x20]
mov edx, 0x100
call fcn.1400037a4
cmp word [rbp + 0x20], r13w
jne 0x140001c3e
lea rdx, str.S_1_5_82_
lea rcx, [rbp + 0x220]
mov r8d, 9
call fcn.140003778
test eax, eax
jne 0x140001c3e
lea r8, str.IIS_AppPool
lea rcx, [rbp + 0x20]
mov edx, 0x100
call fcn.1400037a4
mov rcx, qword [0x14001afe0]
lea rax, [rbp + 0x20]
lea r9, [rbp - 0x70]
xor r8d, r8d
mov edx, 0x104c
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x70], 1
mov dword [rbp - 0x68], 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [rsp + 0x54]
lea r8, [0x1400111a4]
lea rcx, [rbp + 0x420]
mov edx, 0x100
mov dword [rbp - 0x70], 1
call fcn.140003110
mov rcx, qword [0x14001afe0]
lea r11, [rbp + 0x420]
lea r9, [rbp - 0x70]
xor r8d, r8d
mov edx, 0x104c
mov qword [rbp - 0x58], r11
mov dword [rbp - 0x68], 2
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x1400111b0]
lea r9, [0x1400111b8]
test r12d, r12d
cmovne r9, rax
mov eax, dword [rsp + 0x54]
lea r8, str._s__d
lea rcx, [rbp + 0x420]
mov edx, 0x100
mov dword [rsp + 0x20], eax
call fcn.140003110
mov rcx, qword [0x14001b010]
lea r9, [rbp + 0x420]
or r8, 0xffffffffffffffff
mov edx, 0x158
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x54], eax
cmp eax, 0xffffffff
je 0x140001d54
mov rcx, qword [0x14001b010]
mov r8d, eax
xor r9d, r9d
mov edx, 0x144
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140001d54
lea r8, str.Registry_ID_value_not_found
jmp 0x140001d41
lea r8, str.Registry_open_key_error
lea rdx, [rbp + 0x220]
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
inc esi
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x220]
mov edx, esi
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400019a4
mov r15, qword [rsp + 0x730]
mov r14, qword [rsp + 0x780]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.1400030f0
add rsp, 0x738
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret