Function at 0x14001b3e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9e0
mov qword [r11 - 0x928], 0xfffffffffffffffe
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x9d0], rax
mov qword [rsp + 0xd8], rdx
mov r15, rcx
mov qword [rsp + 0x80], rcx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
xor r8d, r8d
lea rdx, str.GetSIDFromProfiles
lea rcx, [r11 - 0x7d8]
call fcn.14002de00
nop
mov r13d, 0x80070525
and qword [rsp + 0x48], r12
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.14001ac14
test eax, eax
jns 0x14001b469
mov ecx, eax
call fcn.140032390
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140014028
nop
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x48]
call fcn.140011c90
test eax, eax
sete dil
lea rcx, [rsp + 0x58]
call fcn.140015058
test dil, dil
je 0x14001b4b7
lea r8, str.Local_user__the_SID_must_be_resolved_by_LookupAccountName...
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140030824
mov ecx, r13d
call fcn.140032390
lea rcx, [rsp + 0x320]
call fcn.140003f94
nop
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.1400143a4
nop
mov rdx, r15
lea rcx, [rsp + 0x108]
call fcn.1400149d8
nop
cmp qword [rax + 0x20], 8
jb 0x14001b4f3
mov rdx, qword [rax + 8]
jmp 0x14001b4f7
lea rdx, [rax + 8]
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rax + 8]
call fcn.140011c90
test eax, eax
sete dil
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x108]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x108]
call fcn.140011434
and qword [rsp + 0x108], 0
test dil, dil
je 0x14001b580
mov rax, qword [rsp + 0xc8]
xor r8d, r8d
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x1b0]
call fcn.140003e7c
nop
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.1400159c0
nop
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
xor edi, edi
cmp byte [rsp + 0x36c], dil
je 0x14001b5a2
lea rcx, [rsp + 0x328]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x14001b73a
lea r8, str.Not_a_primary_domain...
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140030824
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.140014550
nop
mov dword [rsp + 0x88], edi
cmp edi, dword [rsp + 0xa8]
jae 0x14001b723
mov eax, edi
lea r15, [rax + rax*2]
mov rax, qword [rsp + 0xb8]
lea rsi, [rax + r15*8]
test rsi, rsi
jne 0x14001b5f8
jmp 0x14001b71c
lea rax, vtable._mem_alloc_t_wchar_t__class__heap_allocator_.0
mov qword [rsp + 0x90], rax
and qword [rsp + 0x98], 0
movzx eax, word [rsi + 2]
lea r14, [rax*2 + 4]
mov rcx, r14
call fcn.1400331f0
test rax, rax
jne 0x14001b633
mov ecx, 0x8007000e
call fcn.140032390
mov qword [rsp + 0x98], rax
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140034b00
nop
lea rax, vtable._auto_heap_mem_wchar_t_.0
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x130]
call fcn.1400149d8
nop
cmp qword [rax + 0x20], 8
jb 0x14001b67b
mov rdx, qword [rax + 8]
jmp 0x14001b67f
lea rdx, [rax + 8]
mov rcx, qword [rsi + 8]
call fcn.140011c90
test eax, eax
sete sil
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x130]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x130]
call fcn.140011434
and qword [rsp + 0x130], 0
test sil, sil
je 0x14001b70f
cmp edi, dword [rsp + 0xa8]
jae 0x14001b6dd
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rax + r15*8 + 0x10]
jmp 0x14001b6df
xor edx, edx
xor r8d, r8d
lea rcx, [rsp + 0x1b0]
call fcn.140003e7c
nop
mov rdx, rax
lea rcx, [rsp + 0x320]
call fcn.1400159c0
nop
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x90]
call fcn.140015058
inc edi
jmp 0x14001b5c8
lea rcx, [rsp + 0xa0]
call fcn.1400157c8
mov r15, qword [rsp + 0x80]
xor edi, edi
lea rcx, [rsp + 0x320]
call fcn.14001dfd4
mov r9, rax
lea r8, str.Domain_SID__ls
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140030824
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0xb0], rdi
mov r9d, 0x2001f
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xa0]
call fcn.14000bad4
test eax, 0x1fff0000
je 0x14001b7ad
cmp eax, 0x80000000
jb 0x14001b7c4
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001b7c4
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x3a0]
call fcn.140034b00
mov dword [rsp + 0x50], 0x104
mov r14d, edi
mov dword [rsp + 0x8c], edi
mov rsi, qword [rsp + 0xa0]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x3a0]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001bcfd
inc r14d
mov dword [rsp + 0x8c], r14d
mov dword [rsp + 0x50], 0x104
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x2a0]
call fcn.140014468
nop
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_GetWindowsAccountDomainSid]
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14001b88c
lea rcx, [rsp + 0x2a0]
call fcn.14000501c
jmp 0x14001b7f3
lea rcx, vtable._mem_alloc_t_struct__SID__class__heap_allocator_.0
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
test rax, rax
je 0x14001b8c6
lea rcx, [rax + rax*2]
shl rcx, 2
call fcn.1400331f0
mov rdi, rax
test rax, rax
jne 0x14001b8c1
mov ecx, 0x8007000e
call fcn.140032390
mov qword [rsp + 0x60], rax
lea rax, vtable._auto_heap_mem_struct__SID_.0
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_GetWindowsAccountDomainSid]
test eax, eax
jne 0x14001b90b
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
lea rcx, [rsp + 0x2a0]
call fcn.14000501c
xor edi, edi
jmp 0x14001b7f3
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x1b0]
call fcn.140003e7c
nop
lea rcx, [rsp + 0x1b0]
call fcn.14001dfd4
mov r9, rax
lea r8, str.User_Domain_SID__ls
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140030824
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x320]
call fcn.140005318
xor edi, edi
test al, al
jne 0x14001b97e
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
jmp 0x14001b87a
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x78], rdi
mov r9d, 0x2001f
lea r8, [rsp + 0x3a0]
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.14000bad4
test eax, eax
je 0x14001b9e2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001b9c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
jmp 0x14001b87a
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x7c0]
call fcn.140034b00
mov dword [rsp + 0x80], 0x104
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x7c0]
lea rdx, str.ProfileImagePath
lea rcx, [rsp + 0x68]
call fcn.14000cb1c
test eax, eax
je 0x14001ba5e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001ba3c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
jmp 0x14001b87a
mov qword [rsp + 0xd0], rdi
lea r8, [rsp + 0xd0]
lea rdx, [0x140054958]
lea rcx, [rsp + 0x7c0]
call fcn.14003b1cc
mov rdi, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x5b0]
call fcn.140034b00
test rdi, rdi
je 0x14001bad4
lea r8, [rsp + 0xd0]
lea rdx, [0x140054958]
xor ecx, ecx
call fcn.14003b1cc
mov rdi, rax
test rax, rax
je 0x14001bad2
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x5b0]
call fcn.140037e50
jmp 0x14001ba9a
mov rdx, r15
lea rcx, [rsp + 0x180]
call fcn.140014bbc
nop
or r12d, 1
mov dword [rsp + 0x44], r12d
cmp qword [rax + 0x20], 8
jb 0x14001bafb
mov rdx, qword [rax + 8]
jmp 0x14001baff
lea rdx, [rax + 8]
lea rcx, [rsp + 0x5b0]
call fcn.140011c90
test eax, eax
je 0x14001bb51
mov rdx, r15
lea rcx, [rsp + 0x158]
call fcn.140014a58
nop
or r12d, 2
mov dword [rsp + 0x44], r12d
cmp qword [rax + 0x20], 8
jb 0x14001bb37
mov rdx, qword [rax + 8]
jmp 0x14001bb3b
lea rdx, [rax + 8]
lea rcx, [rsp + 0x5b0]
call fcn.140011c90
test eax, eax
je 0x14001bb51
xor dil, dil
jmp 0x14001bb54
mov dil, 1
test r12b, 2
je 0x14001bb95
and r12d, 0xfffffffd
mov dword [rsp + 0x44], r12d
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x158]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x158]
call fcn.140011434
and qword [rsp + 0x158], 0
test r12b, 1
je 0x14001bbd6
and r12d, 0xfffffffe
mov dword [rsp + 0x44], r12d
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x180]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x180]
call fcn.140011434
and qword [rsp + 0x180], 0
test dil, dil
je 0x14001bcc4
lea r8, str.It_looks_like_we_got_the_SID___
xor edx, edx
lea rcx, [rsp + 0x230]
call fcn.140030824
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x3a0]
call fcn.1400179e4
mov edi, eax
mov rcx, qword [rsp + 0x68]
xor r14d, r14d
test rcx, rcx
je 0x14001bc24
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x70], r14d
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
lea rcx, [rsp + 0x2a0]
call fcn.14000501c
nop
test rsi, rsi
je 0x14001bc66
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], r14
mov dword [rsp + 0xa8], r14d
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xc0]
call fcn.140014f40
nop
lea rcx, [rsp + 0x320]
call fcn.14000501c
nop
cmp qword [rsp + 0x48], r14
je 0x14001bcb0
mov rcx, qword [rsp + 0x48]
call fcn.140009640
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x230]
call fcn.14002e7a8
mov eax, edi
jmp 0x14001bd8b
mov rcx, qword [rsp + 0x68]
xor edi, edi
test rcx, rcx
je 0x14001bcdb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
lea rcx, [rsp + 0x1b0]
call fcn.14000501c
nop
lea rcx, [rsp + 0x58]
call fcn.140014f68
nop
jmp 0x14001b87a
test rsi, rsi
je 0x14001bd13
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], edi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0xc0]
call fcn.140014f40
nop
lea rcx, [rsp + 0x320]
call fcn.14000501c
nop
cmp qword [rsp + 0x48], rdi
je 0x14001bd5c
mov rcx, qword [rsp + 0x48]
call fcn.140009640
mov qword [rsp + 0x48], rdi
jmp 0x14001bd63
mov r8d, r13d
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0x230]
call fcn.140030b9c
nop
lea rcx, [rsp + 0x230]
call fcn.14002e7a8
mov eax, r13d
mov rcx, qword [rsp + 0x9d0]
xor rcx, rsp
call fcn.140033cb0
mov rsi, qword [rsp + 0xa20]
add rsp, 0x9e0
pop r15
pop r14
pop r13
pop r12
pop rdi
ret