Function at 0x7ff74b03ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbp
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r13
sub rsp, 0x210
mov rax, qword [0x7ff74b58340]
xor rax, rsp
mov qword [rsp + 0x200], rax
lea rcx, [r11 - 0x178]
lea rdx, str.D:_A__0x00120001___WD__A__0x001C0002___PS_
mov r8d, 0x56
call sub.msvcrt.dll_memcpy
xor r9d, r9d
lea r8, [rsp + 0x48]
lea ebp, [r9 + 1]
lea rcx, [rsp + 0xa0]
mov edx, ebp
call sub.API_MS_Win_Security_SDDL_L1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
lea r13, [0x7ff74b58350]
test eax, eax
je 0x7ff74b1c2d7
mov rax, qword [rsp + 0x48]
and dword [rsp + 0x68], 0
lea r9, str.ScmCreatedEvent
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 0x18
call qword [sym.imp.KERNEL32.dll_CreateEventW]
test rax, rax
je 0x7ff74b1c262
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7ff74b03b8a
mov r8d, 0x100
lea rcx, [rsp + 0x100]
xor edx, edx
mov dword [rsp + 0x40], r8d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x100]
lea rdx, str.CLSID6C736DB0_BD94_11D0_8A23_00AA00B58E10EnableEvents
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 0xffff
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
test eax, eax
je 0x7ff74b1c328
call qword [sym.imp.RPCRT4.dll_RpcMgmtEnableIdleCleanup]
test eax, eax
jne 0x7ff74b1c3de
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.7ff74ae3090
lea r11, [rsp + 0x210]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
call sub.KERNEL32.dll_GetLastError
cmp eax, 5
jne 0x7ff74b1c287
lea r8, str.ScmCreatedEvent
lea ecx, [rbp + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
jne 0x7ff74b03b74
cmp dword [0x7ff74b582c8], 0
je 0x7ff74b03b7d
mov rax, qword [0x7ff74b58350]
cmp rax, r13
je 0x7ff74b03b7d
test byte [rax + 0x1c], bpl
je 0x7ff74b03b7d
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x7ff74b58350]
lea r8, [0x7ff74b51810]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x1c
call fcn.7ff74b25ec4
jmp 0x7ff74b03b7d
cmp dword [0x7ff74b582c8], 0
je 0x7ff74b03b8a
mov rax, qword [0x7ff74b58350]
cmp rax, r13
je 0x7ff74b03b8a
test byte [rax + 0x1c], bpl
je 0x7ff74b03b8a
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x7ff74b58350]
lea r8, [0x7ff74b51810]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x1d
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b03b8a
lea rsi, [rsp + 0x100]
lea rdi, [0x7ff74b51e64]
lea ecx, [rax + 2]
repe cmpsw word [rsi], word [rdi]
jne 0x7ff74b03be6
lea rcx, [rsp + 0x70]
lea rdx, [0x7ff74b51e68]
lea r8d, [rax + 0x2e]
call sub.msvcrt.dll_memcpy
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov edx, ebp
call sub.API_MS_Win_Security_SDDL_L1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x7ff74b03be6
mov rax, qword [rsp + 0x50]
and dword [rsp + 0x68], 0
lea r9, str.MSFT.VSA.IEC.STATUS.6c736db0
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov edx, ebp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], 0x18
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r8d, dword [0x7ff74b582d0]
mov qword [0x7ff74b5a030], rax
test r8b, 2
jne 0x7ff74b1c3cd
or r8d, 2
mov edx, 0x926
xor ecx, ecx
mov dword [0x7ff74b582d0], r8d
call sub.ntdll.dll_WinSqmSetDWORD
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
jmp 0x7ff74b03be6
cmp dword [0x7ff74b582c8], 0
je 0x7ff74b03bf4
mov rcx, qword [0x7ff74b58350]
cmp rcx, r13
je 0x7ff74b03bf4
test byte [rcx + 0x1c], bpl
je 0x7ff74b03bf4
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b51810]
mov edx, 0x1e
mov r9d, eax
call fcn.7ff74b25ec4
nop
jmp 0x7ff74b03bf4