Function at 0x140021290
Capabilities:
Access the windows event log
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4f0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x140092008]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor r12d, r12d
mov esi, r12d
mov dword [rsp + 0x50], r12d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x40]
call fcn.140041d80
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1d0]
call fcn.140041d80
mov r15d, 2
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x80], r12d
lea rbx, [0x140097ae8]
mov r8, rbx
lea rdx, [0x140023520]
lea rcx, [0x140097af8]
call fcn.14003e2e8
test eax, eax
je 0x140021a95
mov qword [rbp - 0x78], rbx
mov dword [rsp + 0x68], 1
mov dword [reloc.WS2_32.dll_accept], 1
mov dword [rsp + 0x74], 4
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400213a3
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
lea rcx, str.LogLevel_setting_not_found._Setting_to_release_prints_only.
call fcn.140003010
jmp 0x14002143a
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.JHI_LOG
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140021401
lea rdx, str.JHI_LOG
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.LogLevel_setting_not_found._Setting_to_release_prints_only.
call fcn.140003010
jmp 0x14002143a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140021433
sub eax, 1
je 0x14002141e
cmp eax, 1
je 0x14002142a
mov dword [reloc.WS2_32.dll_accept], 1
jmp 0x14002143a
mov dword [reloc.WS2_32.dll_accept], r15d
jmp 0x14002143a
mov dword [reloc.WS2_32.dll_accept], r12d
mov dword [rsp + 0x6c], r12d
mov dword [0x140095680], r12d
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400214a0
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
lea rcx, str.Log_target_setting_not_found._Defaulting_to_debugger.
call fcn.140003050
jmp 0x140021527
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.JHI_LOG_TARGET
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1400214fe
lea rdx, str.JHI_LOG_TARGET
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.Log_target_setting_not_found._Defaulting_to_debugger.
call fcn.140003050
jmp 0x140021527
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x140021520
cmp eax, 1
mov dword [0x140095680], 1
je 0x140021527
mov dword [0x140095680], r12d
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x140021540
lea rcx, str.JHI_service_release_prints_are_enabled_n
call fcn.140003010
jmp 0x140021551
cmp eax, r15d
jne 0x140021551
lea rcx, str.JHI_service_debug_trace_and_release_prints_are_enabled_n
call fcn.140003050
mov rbx, qword [0x140095698]
mov ecx, 0x40c
call fcn.14003d4c4
mov rdi, rax
mov r8, rax
lea rdx, str.APPLETSLOCALE
mov rcx, rbx
call fcn.140008a80
test al, al
jne 0x1400215f1
test rdi, rdi
je 0x14002158b
mov rdx, r15
mov rcx, rdi
call fcn.14003ce44
lea rcx, str.unable_to_find_applets_repository_location_from_registry
call fcn.140003010
lea rdx, str.IntelDalJhi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x1400215e7
xor r8d, r8d
lea edx, [r8 + 1]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r12
mov r9d, 0xc0000006
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edi, 0x501
jmp 0x140021a63
mov r8d, 0x206
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test rdi, rdi
je 0x140021614
mov rdx, r15
mov rcx, rdi
call fcn.14003ce44
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140047bc8
test eax, eax
je 0x14002164c
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.140023160
mov esi, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x68]
call fcn.140020fd0
test al, al
jne 0x14002164c
movzx ebx, sil
jmp 0x14002164e
xor bl, bl
mov edi, 0x1000
test sil, 1
je 0x140021695
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140021695
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x140021690
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021a9b
call fcn.14003ce44
test bl, bl
je 0x1400216b9
lea rcx, str.Init_failed___cannot_find_applet_repository_directory._Searched_location:
call fcn.140003010
mov edx, 0xc0000008
mov ecx, 1
call fcn.14001ed90
jmp 0x140021a63
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x1400216e0
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000c970
nop
call fcn.14000baa0
mov r14, rax
cmp qword [rbp - 0x58], 0
jne 0x14002170b
mov bl, 1
jmp 0x140021764
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rbx, [r14 + 0x30]
lea rax, [rbp - 0x68]
cmp rbx, rax
je 0x140021740
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, rbx
call fcn.14000c970
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [rbx + 0x18], 8
jb 0x140021753
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.GlobalsManager___setAppletsFolder___s
call fcn.140003050
xor bl, bl
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400217a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x14002179b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021aa1
call fcn.14003ce44
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
test bl, bl
je 0x1400217cb
lea rcx, str.Init_failed___setAppletsFolder_failed.
call fcn.140003050
mov edi, 0x601
jmp 0x140021a63
mov rbx, qword [0x140095698]
mov ecx, 0x40c
call fcn.14003d4c4
mov r14, rax
mov r8, rax
lea rdx, str.FILELOCALE
mov rcx, rbx
call fcn.140008a80
test al, al
jne 0x14002182a
test r14, r14
je 0x140021805
mov rdx, r15
mov rcx, r14
call fcn.14003ce44
lea rcx, str.unable_to_query_file_location_from_registry
call fcn.140003010
mov edx, 0xc0000006
mov ecx, 1
call fcn.14001ed90
mov edi, 0x501
jmp 0x140021a63
mov r8d, 0x206
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test r14, r14
je 0x140021850
mov rdx, r15
mov rcx, r14
call fcn.14003ce44
xor edx, edx
lea rcx, [rbp + 0x1d0]
call fcn.140047bc8
test eax, eax
je 0x140021878
lea rcx, str.Init_failed___the_service_file_location_does_not_exist
call fcn.140003010
mov edi, 0x601
jmp 0x140021a63
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp + 0x1d0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140021890
mov r8, rsi
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x68]
call fcn.14000c970
nop
call fcn.14000baa0
mov rsi, rax
cmp qword [rbp - 0x58], 0
jne 0x1400218c1
mov bl, 1
jmp 0x14002191a
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rbx, [rsi + 0x10]
lea rax, [rbp - 0x68]
cmp rbx, rax
je 0x1400218f6
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, rbx
call fcn.14000c970
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [rbx + 0x18], 8
jb 0x140021909
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.GlobalsManager___setServiceFolder___s
call fcn.140003050
xor bl, bl
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140021956
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x140021951
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021aa7
call fcn.14003ce44
test bl, bl
je 0x140021970
lea rcx, str.Init_failed___setServiceFolder_failed.
call fcn.140003010
mov edi, 0x601
jmp 0x140021a63
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400219bb
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
jmp 0x140021a0b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.JHI_TRANSPORT_TYPE
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140021a1e
lea rdx, str.JHI_TRANSPORT_TYPE
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.Unable_to_query_transport_type_from_registry__keeping_default__TEE_LIB_.
call fcn.140003050
mov dword [rsp + 0x54], r15d
jmp 0x140021a2e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r15d, dword [rsp + 0x54]
call fcn.14000baa0
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov dword [rbx + 0x58], r15d
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov edx, r15d
lea rcx, str.GlobalsManager___setTransportType___d.
call fcn.140003050
mov edi, r12d
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14003ce20
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14004688c
int3
call fcn.140046814
int3
call fcn.140046814
int3
call fcn.140046814
int3