Function at 0x1600c4b70
Capabilities:
Acquire debug privileges
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
call fcn.1600c3d14
movups xmm0, xmmword [str.WSearch]
or dword [rbp - 9], 0xffffffff
lea rax, str.p__f_
xor r13d, r13d
mov qword [rbp - 1], rax
movdqu xmmword [rbp + 0x1f], xmm0
lea rcx, [rbp - 1]
mov r14d, r13d
xorps xmm0, xmm0
mov r15d, r13d
lea edx, [r13 + 0x20]
mov r12d, r13d
movdqu xmmword [rbp + 7], xmm0
call fcn.16005ea70
lea ebx, [r13 + 2]
test al, al
je 0x1600c4c2f
mov r8d, ebx
lea rdx, str.SeBackupPrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
mov r8d, ebx
movzx r14d, al
lea rdx, str.SeRestorePrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
mov r8d, ebx
movzx r15d, al
lea rdx, str.SeDebugPrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
movzx r12d, al
mov r8d, 1
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x1f]
call fcn.1600c38f4
mov esi, eax
test eax, eax
jne 0x1600c4f28
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__DisableService_returned_successfully.
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x369
call fcn.1600ecb60
call fcn.1600c31ac
mov esi, eax
test eax, eax
je 0x1600c4cf7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:MSSrch_SysPrep_Cleanup__CreateBlockingRegKey_failed.
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x36b
jmp 0x1600c4f1b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__CreateBlockingRegKey_returned_successfully.
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x36e
call fcn.1600ecb60
lea rcx, [rbp + 0x1f]
call fcn.1600c4824
mov esi, eax
cmp eax, 0x41d
jne 0x1600c4ecd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__StopWithDependentServices_returned_timeout__try_to_kill_it.
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x372
call fcn.1600ecb60
call fcn.1600c3dbc
mov esi, eax
test eax, eax
je 0x1600c4e0f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__KillSearchService_returned_error_0x_x.
mov r8d, esi
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x377
jmp 0x1600c4f1b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__KillSearchService_succeeded.
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xf0000
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x37b
call fcn.1600ecb60
mov ecx, 0xbb8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
lea rcx, [rbp + 0x1f]
call fcn.1600c4824
mov esi, eax
test eax, eax
je 0x1600c4f34
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:MSSrch_SysPrep_Cleanup_2nd__StopWithDependentServices_failed_with_0x_x
mov r8d, esi
mov ecx, 0x4000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x384
jmp 0x1600c4f1b
test esi, esi
je 0x1600c4f34
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:_MSSrch_SysPrep_Cleanup__StopWithDependentServices_returned_unhandled_error_0x_x.
mov r8d, esi
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x38a
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
cmp esi, 0x102
jne 0x1600c509b
call fcn.1600c29b0
mov esi, eax
test eax, eax
je 0x1600c4f8b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov rdi, qword [rbp + 0x5f]
lea rdx, str.MSS:MSSrch_SysPrep_Cleanup_Cleanup_failed.
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x393
jmp 0x1600c508e
lea r9, [rbp + 0x17]
mov r8d, 2
lea rdx, str.SOFTWAREMicrosoftWindows_Search
mov rcx, 0xffffffff80000002
call fcn.1600c4308
mov esi, eax
test eax, eax
jne 0x1600c5040
mov rcx, qword [rbp + 0x17]
lea r9d, [rax + 4]
lea rax, [rbp - 5]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SetupCompletedSuccessfully
mov dword [rbp - 5], r13d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x17]
mov esi, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0x1600c509b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, dword [rbp - 5]
lea rdx, str.MSS:MSSrch_SysPrep_Cleanup_Error_0x_X_occurred_while_setting_reg_valuey__ls.
mov rdi, qword [rbp + 0x5f]
mov r8d, esi
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x3a0
jmp 0x1600c508e
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9, qword [rbp + 0x17]
lea rdx, str.MSS:MSSrch_SysPrep_Cleanup_Error_0x_X_occurred_while_opening_reg_key__ls.
mov rdi, qword [rbp + 0x5f]
mov r8d, esi
mov ecx, 0x2000000
mov ebx, eax
call fcn.1600f0a4c
mov dword [rsp + 0x50], r13d
mov rcx, rax
mov qword [rsp + 0x48], r13
lea rax, [0x1601faab8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x3a4
xor r9d, r9d
mov edx, 0xf0000
call fcn.1600ecb60
test r14d, r14d
je 0x1600c50b3
xor r8d, r8d
lea rdx, str.SeBackupPrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
test r15d, r15d
je 0x1600c50cb
xor r8d, r8d
lea rdx, str.SeRestorePrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
test r12d, r12d
je 0x1600c50e3
xor r8d, r8d
lea rdx, str.SeDebugPrivilege
lea rcx, [rbp - 1]
call fcn.1600c28d0
cmp dword [rbp - 9], 0xffffffff
je 0x1600c50fe
xor r8d, r8d
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x1f]
call fcn.1600c38f4
test esi, esi
cmove esi, eax
mov rcx, qword [rbp + 7]
lea rax, str.p__f_
mov qword [rbp - 1], rax
test rcx, rcx
je 0x1600c5118
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rcx, qword [rbp + 0xf]
mov qword [rbp + 7], r13
test rcx, rcx
je 0x1600c512b
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov qword [rbp + 0xf], r13
call fcn.1600ec0a0
jmp 0x1600c513b
call fcn.1600f0a70
cmp dword [0x1602742e4], r13d
ja 0x1600c5136
call fcn.1600eb440
test eax, eax
jne 0x1600c5144
lea rcx, [0x160274148]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
mov eax, esi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret