Function at 0x14000f540
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rdi
push r13
push r14
sub rsp, 0xc90
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0xc60], rax
xor edi, edi
test rcx, rcx
mov rbx, r9
mov r14, rdx
mov rbp, rcx
mov qword [rsp + 0x80], rbx
mov r13d, edi
je 0x14000f9a2
test rdx, rdx
je 0x14000f9a2
mov rcx, qword [r14]
mov eax, r8d
xor edx, edx
mov r8d, r8d
mov qword [rsp + 0x78], rax
call fcn.14004c980
lea rcx, str.MfeEnumDependentServices:_n
call fcn.1400154e0
mov qword [rsp + 0x30], rdi
lea rcx, str..WGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov qword [rsp + 0x60], rdi
mov dword [rbx], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000f622
mov qword [rsp + 0x30], rdi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000f622
mov rbx, rdi
jmp 0x14000f659
test rbx, rbx
je 0x14000f659
cmp rbx, 0xffffffffffffffff
je 0x14000f659
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rax, [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetServices
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test rbx, rbx
mov edi, eax
je 0x14000f696
cmp rbx, 0xffffffffffffffff
je 0x14000f696
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000f98a
cmp qword [rsp + 0x60], r13
je 0x14000f98a
call fcn.140006600
test rax, rax
mov rbx, rax
je 0x14000f6f0
cmp rax, 0xffffffffffffffff
je 0x14000f6ec
xor edi, edi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x14000f6f2
xor edi, edi
jmp 0x14000f6f2
xor edi, edi
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14000f771
lea rcx, str.MfeEnumDependentServices:_could_not_get_info_for_services_key_n
call fcn.1400154e0
mov rcx, qword [rsp + 0x60]
call fcn.140039380
test rbx, rbx
je 0x14000f9ae
cmp rbx, 0xffffffffffffffff
je 0x14000f9ae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f9ae
test rbx, rbx
mov qword [rsp + 0xc88], rsi
mov qword [rsp + 0xc80], r12
mov qword [rsp + 0xc78], r15
je 0x14000f79d
cmp rbx, 0xffffffffffffffff
je 0x14000f79d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, rdi
mov dword [rsp + 0x6c], 0x200
call fcn.140006600
mov rcx, rax
mov rsi, rax
call fcn.140006680
cmp dword [rsp + 0x68], r13d
mov r12b, 1
mov ebx, edi
jbe 0x14000f931
nop
nop
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x90]
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov dword [rsp + 0x6c], 0x200
je 0x14000f925
test eax, eax
jne 0x14000f912
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x90]
call fcn.1400394c0
test rax, rax
mov rdi, rax
jne 0x14000f853
lea rdx, [rsp + 0x90]
lea rcx, str.MfeEnumDependentServices:_Warning:_Could_not_open_subkey__S_n
call fcn.1400154e0
xor ecx, ecx
call fcn.140039380
jmp 0x14000f8fe
lea rcx, [rsp + 0x490]
xor edx, edx
mov r8d, 0x3e8
call fcn.14004c980
lea r8, [rsp + 0x490]
lea rdx, str.DependOnService
mov r9d, 0x3e8
mov rcx, rdi
call fcn.140006b50
test al, al
je 0x14000f8f6
lea rcx, [rsp + 0x490]
xor r8d, r8d
mov rdx, rbp
call fcn.140006a30
test al, al
je 0x14000f8f6
lea rdx, [rsp + 0x90]
lea rcx, str.MfeEnumDependentServices:__S_depends_on__S_n
mov r8, rbp
call fcn.1400154e0
lea rcx, [rsp + 0x90]
call fcn.140036f80
mov rdx, qword [rsp + 0x78]
lea r8, [rsp + 0x90]
mov r9, rax
mov rax, qword [r14]
lea rcx, [rax + r15*2]
call fcn.1400382c0
lea rcx, [rsp + 0x90]
call fcn.140036f80
add r13d, 1
lea r15, [r15 + rax + 1]
mov rcx, rdi
call fcn.140039380
add ebx, 1
mov edi, 0
cmp ebx, dword [rsp + 0x68]
jb 0x14000f7d0
jmp 0x14000f931
lea rcx, str.MfeEnumDependentServices:_ERROR__RegEnumKeyEx_returned_System_Error_Code_d_n
mov edx, eax
call fcn.1400154e0
xor r12b, r12b
jmp 0x14000f931
lea rcx, str.MfeEnumDependentServices:_No_more_dependent_services_n
call fcn.1400154e0
test rsi, rsi
mov r15, qword [rsp + 0xc78]
je 0x14000f94d
cmp rsi, 0xffffffffffffffff
je 0x14000f94d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x80]
lea rcx, str.MfeEnumDependentServices:_Found__u_dependent_services_on__S_n
mov r8, rbp
mov edx, r13d
mov dword [rax], r13d
call fcn.1400154e0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0xc88]
mov al, r12b
mov r12, qword [rsp + 0xc80]
jmp 0x14000f9b0
lea rcx, str.MfeEnumDependentServices:_could_not_open_services_key_n
call fcn.1400154e0
mov rcx, qword [rsp + 0x60]
call fcn.140039380
jmp 0x14000f9ae
lea rcx, str.MfeEnumDependentServices:_NULL_ptr_n
call fcn.1400154e0
xor al, al
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.14004c890
add rsp, 0xc90
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret