Function at 0x1400b21e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r12d, r9d
mov r15, r8
mov rdi, rdx
mov dword [rbp + 0x1f8], r12d
lea rax, vtable.CSABByteString.0
mov qword [rsp + 0x68], rax
xor r13d, r13d
mov qword [rbp - 0x80], r13
lea ecx, [r13 + 1]
call fcn.140247068
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.14000af20
nop
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.14007d380
mov r9d, 1
mov r8d, r9d
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea rdx, [rsp + 0x58]
mov rcx, rdi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x1400b243b
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.140249b10
mov dword [rsp + 0x40], 0x208
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f8]
mov r8, r15
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov r14d, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14007d380
mov r9d, 1
mov r8d, r9d
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
lea r8, [rsp + 0x50]
lea rdx, str.S_1_5_18SoftwareMicrosoftIdentityCRLStoredIdentities
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400b243e
mov qword [rsp + 0x48], r13
mov ebx, r13d
xor edx, edx
mov r9d, 0x104
lea r8, [rbp - 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1400b241e
inc ebx
mov qword [rsp + 0x48], r13
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x60]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400b2399
lea r8, [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400b239d
mov edx, ebx
jmp 0x1400b2346
mov dword [rbp + 0x1f8], 0x104
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x140299d08]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b2413
mov rdx, r12
lea r8, [rbp - 0x60]
mov rcx, r15
call fcn.140251ec0
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14007d380
mov r9d, 1
mov r8d, r9d
mov rsi, qword [rsp + 0x70]
mov rdx, rsi
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140004a50
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400b242e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400b243e
mov r14d, r13d
mov edx, 1
mov rcx, rsi
call fcn.140247060
mov eax, r14d
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret