Function at 0x1400332e0
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x1400335c5
mov rax, rsp
push rbx
push r12
sub rsp, 0x88
xor r12d, r12d
mov qword [rax - 0x18], rbp
mov rbx, rcx
mov dword [rcx], 0xffffffff
mov qword [rax - 0x20], rsi
lea r8d, [r12 + 0x34]
lea rcx, [rax - 0x5c]
xor edx, edx
mov qword [rax - 0x68], r12
mov qword [rax - 0x28], rdi
mov dword [rax - 0x60], r12d
call fcn.14007cd30
mov ebp, dword [0x1400df4cc]
lea rcx, str.GetSessionUserToken:_enter
call fcn.14000cbb0
cmp dword [0x1400df34c], 7
mov qword [rsp + 0xb8], r12
jb 0x140033396
mov ecx, ebp
call fcn.140067af0
test rax, rax
mov qword [rsp + 0xb8], rax
je 0x140033396
mov rcx, rax
call fcn.14002bb50
cmp eax, 4
jne 0x140033389
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xb8], r12
lea rsi, str.winlogon.exe
jmp 0x14003339d
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
jne 0x1400333f2
lea rsi, str.explorer.exe
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [rsp + 0xb8]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 0xf
call fcn.14002e800
test eax, eax
jne 0x1400333ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xb8]
jmp 0x1400333f2
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
je 0x140033446
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400311f0
test eax, eax
jne 0x140033446
xor eax, eax
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r12
mov rax, qword [rsp + 0x68]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareATIACESettingsGraphics
test rax, rax
mov r9d, 0x2001f
cmovne rcx, rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14003348b
lea rcx, str.GetACEPrbPath___ACE_PATH_is_OK
call fcn.14000cbb0
jmp 0x1400334ff
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareATIACESettingsGraphics
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400334c4
lea rcx, str.GetACEPrbPath___ACE_PATH_is_OK
call fcn.14000cbb0
jmp 0x1400334ff
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareWOW6432NodeATIACESettingsGraphics
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140033573
lea rcx, str.GetACEPrbPath___ACE_REMAP_PATH_is_OK
call fcn.14000cbb0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140033584
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0xb0]
lea rdx, str.Notification
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0xb0], 4
mov dword [rsp + 0xa0], r12d
mov dword [rsp + 0xa8], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140033566
mov eax, dword [rsp + 0xa0]
mov dword [rbx], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140033584
lea rcx, str.GetACEPrbPath___ACE_PATH_failed_n
call fcn.14000cbb0
mov qword [rsp + 0x30], r12
test rdi, rdi
je 0x1400335b6
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x14003359f
lea rcx, str.RevertToOriginalUser:_RevertToSelf_failed
call fcn.14000cbb0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x70]
add rsp, 0x88
pop r12
pop rbx
ret 0