Function at 0x1400213e0
Capabilities:
Access the windows event log
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4f0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x140093008]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor r12d, r12d
mov esi, r12d
mov dword [rsp + 0x50], r12d
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x40]
call fcn.1400426d0
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x1d0]
call fcn.1400426d0
mov r15d, 2
mov dword [rsp + 0x54], r15d
mov dword [rbp - 0x80], r12d
lea rbx, [0x140098af0]
mov r8, rbx
lea rdx, [0x140023660]
lea rcx, [0x140098b00]
call fcn.14003ec38
test eax, eax
je 0x140021be5
mov qword [rbp - 0x78], rbx
mov dword [rsp + 0x68], 1
mov dword [reloc.WS2_32.dll_accept], 1
mov dword [rsp + 0x74], 4
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400214f3
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
lea rcx, str.LogLevel_setting_not_found._Setting_to_release_prints_only.
call fcn.140003010
jmp 0x14002158a
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
xor r8d, r8d
lea rdx, str.JHI_LOG
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140021551
lea rdx, str.JHI_LOG
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.LogLevel_setting_not_found._Setting_to_release_prints_only.
call fcn.140003010
jmp 0x14002158a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x140021583
sub eax, 1
je 0x14002156e
cmp eax, 1
je 0x14002157a
mov dword [reloc.WS2_32.dll_accept], 1
jmp 0x14002158a
mov dword [reloc.WS2_32.dll_accept], r15d
jmp 0x14002158a
mov dword [reloc.WS2_32.dll_accept], r12d
mov dword [rsp + 0x6c], r12d
mov dword [0x140096680], r12d
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1400215f0
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
lea rcx, str.Log_target_setting_not_found._Defaulting_to_debugger.
call fcn.140003050
jmp 0x140021677
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.JHI_LOG_TARGET
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x14002164e
lea rdx, str.JHI_LOG_TARGET
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.Log_target_setting_not_found._Defaulting_to_debugger.
call fcn.140003050
jmp 0x140021677
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x140021670
cmp eax, 1
mov dword [0x140096680], 1
je 0x140021677
mov dword [0x140096680], r12d
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x140021690
lea rcx, str.JHI_service_release_prints_are_enabled_n
call fcn.140003010
jmp 0x1400216a1
cmp eax, r15d
jne 0x1400216a1
lea rcx, str.JHI_service_debug_trace_and_release_prints_are_enabled_n
call fcn.140003050
mov rbx, qword [0x140096698]
mov ecx, 0x40c
call fcn.14003de14
mov rdi, rax
mov r8, rax
lea rdx, str.APPLETSLOCALE
mov rcx, rbx
call fcn.140008a80
test al, al
jne 0x140021741
test rdi, rdi
je 0x1400216db
mov rdx, r15
mov rcx, rdi
call fcn.14003d794
lea rcx, str.unable_to_find_applets_repository_location_from_registry
call fcn.140003010
lea rdx, str.IntelDalJhi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbx, rax
test rax, rax
je 0x140021737
xor r8d, r8d
lea edx, [r8 + 1]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x28], r12w
mov qword [rsp + 0x20], r12
mov r9d, 0xc0000006
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edi, 0x501
jmp 0x140021bb3
mov r8d, 0x206
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test rdi, rdi
je 0x140021764
mov rdx, r15
mov rcx, rdi
call fcn.14003d794
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.140048518
test eax, eax
je 0x14002179c
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.1400232a0
mov esi, 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x68]
call fcn.140021120
test al, al
jne 0x14002179c
movzx ebx, sil
jmp 0x14002179e
xor bl, bl
mov edi, 0x1000
test sil, 1
je 0x1400217e5
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400217e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x1400217e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021beb
call fcn.14003d794
test bl, bl
je 0x140021809
lea rcx, str.Init_failed___cannot_find_applet_repository_directory._Searched_location:
call fcn.140003010
mov edx, 0xc0000008
mov ecx, 1
call fcn.14001eee0
jmp 0x140021bb3
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp - 0x40]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140021830
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x68]
call fcn.14000ca10
nop
call fcn.14000bb40
mov r14, rax
cmp qword [rbp - 0x58], 0
jne 0x14002185b
mov bl, 1
jmp 0x1400218b4
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rbx, [r14 + 0x30]
lea rax, [rbp - 0x68]
cmp rbx, rax
je 0x140021890
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, rbx
call fcn.14000ca10
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [rbx + 0x18], 8
jb 0x1400218a3
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.GlobalsManager___setAppletsFolder___s
call fcn.140003050
xor bl, bl
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1400218f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x1400218eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021bf1
call fcn.14003d794
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
test bl, bl
je 0x14002191b
lea rcx, str.Init_failed___setAppletsFolder_failed.
call fcn.140003050
mov edi, 0x601
jmp 0x140021bb3
mov rbx, qword [0x140096698]
mov ecx, 0x40c
call fcn.14003de14
mov r14, rax
mov r8, rax
lea rdx, str.FILELOCALE
mov rcx, rbx
call fcn.140008a80
test al, al
jne 0x14002197a
test r14, r14
je 0x140021955
mov rdx, r15
mov rcx, r14
call fcn.14003d794
lea rcx, str.unable_to_query_file_location_from_registry
call fcn.140003010
mov edx, 0xc0000006
mov ecx, 1
call fcn.14001eee0
mov edi, 0x501
jmp 0x140021bb3
mov r8d, 0x206
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test r14, r14
je 0x1400219a0
mov rdx, r15
mov rcx, r14
call fcn.14003d794
xor edx, edx
lea rcx, [rbp + 0x1d0]
call fcn.140048518
test eax, eax
je 0x1400219c8
lea rcx, str.Init_failed___the_service_file_location_does_not_exist
call fcn.140003010
mov edi, 0x601
jmp 0x140021bb3
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
lea rax, [rbp + 0x1d0]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1400219e0
mov r8, rsi
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x68]
call fcn.14000ca10
nop
call fcn.14000bb40
mov rsi, rax
cmp qword [rbp - 0x58], 0
jne 0x140021a11
mov bl, 1
jmp 0x140021a6a
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rbx, [rsi + 0x10]
lea rax, [rbp - 0x68]
cmp rbx, rax
je 0x140021a46
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, rbx
call fcn.14000ca10
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
cmp qword [rbx + 0x18], 8
jb 0x140021a59
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.GlobalsManager___setServiceFolder___s
call fcn.140003050
xor bl, bl
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x140021aa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, rdi
jb 0x140021aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140021bf7
call fcn.14003d794
test bl, bl
je 0x140021ac0
lea rcx, str.Init_failed___setServiceFolder_failed.
call fcn.140003010
mov edi, 0x601
jmp 0x140021bb3
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x50], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesjhi_service
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x140021b0b
mov edx, eax
lea rcx, str.Unable_to_open_Registry__0x_x__n
call fcn.140003050
jmp 0x140021b5b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.JHI_TRANSPORT_TYPE
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x140021b6e
lea rdx, str.JHI_TRANSPORT_TYPE
lea rcx, str.Registry_read_integer_key__S_failed._n
call fcn.140003050
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea rcx, str.Unable_to_query_transport_type_from_registry__keeping_default__TEE_LIB_.
call fcn.140003050
mov dword [rsp + 0x54], r15d
jmp 0x140021b7e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov r15d, dword [rsp + 0x54]
call fcn.14000bb40
mov rbx, rax
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov dword [rbx + 0x58], r15d
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
mov edx, r15d
lea rcx, str.GlobalsManager___setTransportType___d.
call fcn.140003050
mov edi, r12d
mov eax, edi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14003d770
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400471dc
int3
call fcn.140047164
int3
call fcn.140047164
int3
call fcn.140047164
int3