Function at 0x18000bff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x18002a520]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x59], 0
mov rsi, rcx
and qword [rbp - 0x61], 0
and qword [rbp - 0x69], 0
mov byte [rcx], 0
lea rcx, [rbp - 0x6d]
call qword [sym.imp.ntdll.dll_RtlGetNtProductType]
nop dword [rax + rax]
test al, al
je 0x180014ea0
mov r9d, 0x58
lea rax, [rbp - 0x51]
lea r8, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov rcx, 0xfffffffffffffffa
lea edx, [r9 - 0x57]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000c185
mov rdi, qword [rbp - 0x19]
cmp byte [rdi + 1], 5
jne 0x18000c185
xorps xmm0, xmm0
mov byte [rdi + 1], 4
lea r9, [rbp - 0x59]
mov r8d, 1
lea rdx, [rbp - 0x49]
xor ecx, ecx
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaOpenPolicy]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000c185
mov rcx, qword [rbp - 0x59]
lea r8, [rbp - 0x61]
mov edx, 5
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaQueryInformationPolicy]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000c185
lea rax, [rbp - 0x69]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSetControlLsa
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x180014eaa
mov rcx, qword [rbp - 0x69]
lea rax, [rbp - 0x75]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x71]
lea rax, [rbp - 0x79]
mov dword [rbp - 0x75], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ProtectedUserLevel
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
cmp eax, 2
jne 0x180014eba
and dword [rbp - 0x79], 0
mov rcx, qword [rbp - 0x61]
mov rdx, rdi
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntdll.dll_RtlEqualSid]
nop dword [rax + rax]
test al, al
je 0x180014ecd
cmp dword [rbp - 0x6d], 2
je 0x180014ecd
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x18000c19a
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x61]
test rcx, rcx
je 0x18000c1af
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaFreeMemory]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x18000c1c4
call qword [sym.imp.api_ms_win_security_lsapolicy_l1_1_0.dll_LsaClose]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18000dc50
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ebx, 0xc0000001
jmp 0x18000c185
jle 0x180014f09
movzx ebx, ax
or ebx, 0xc0070000
jmp 0x18000c185
test eax, eax
jne 0x180014eaa
cmp dword [rbp - 0x71], 4
je 0x18000c15c
jmp 0x18000c158
test byte [rbp - 0x79], 1
je 0x180014edb
mov byte [rsi], 1
jmp 0x18000c185
movzx eax, byte [rdi + 1]
mov r9, rsi
mov r8d, 2
mov rdx, rdi
mov rcx, 0xfffffffffffffffa
mov dword [rdi + rax*4 + 8], 0x20d
inc byte [rdi + 1]
call qword [sym.imp.ntdll.dll_RtlCheckTokenMembershipEx]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18000c185