Function at 0x1400013e0
Capabilities:
Create process on windows
Set registry value

Disassembly:
sub rsp, 0x198
call fcn.140001120
test eax, eax
jne 0x140001403
lea rcx, str.No_configuration_required_on_this_operating_system_r_n
call fcn.140005008
xor eax, eax
jmp 0x14000188b
call fcn.1400011d0
test eax, eax
je 0x14000163a
lea r8, [rsp + 0x78]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPolicies_system
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14000144f
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_open_UAC_policy_registry_key_r_n
call fcn.140004c6c
mov eax, 1
jmp 0x14000188b
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.LocalAccountTokenFilterPolicy
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400014aa
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_set_UAC_policy_registry_key_value_r_n
call fcn.140004c6c
mov eax, 2
jmp 0x14000188b
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140004b80
mov dword [rsp + 0x80], 0x68
xor eax, eax
mov word [rsp + 0xc0], ax
mov dword [rsp + 0xbc], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.netsh_advfirewall_firewall_set_rule_group_File_and_Printer_Sharing__new_enableYes
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000155e
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_create_process_to_set_advanced_firewall_rule_r_n
call fcn.140004c6c
mov eax, 3
jmp 0x14000188b
mov edx, 0x1388
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400015aa
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_waiting_for_advanced_firewall_rule_process_to_complete_r_n
call fcn.140004c6c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 4
jmp 0x14000188b
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400015f6
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_getting_exit_code_of_advanced_firewall_rule_process_r_n
call fcn.140004c6c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
jmp 0x14000188b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x70], 0
je 0x140001635
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Could_not_set_advanced_firewall_rule_r_n
call fcn.140004c6c
mov eax, 6
jmp 0x14000188b
jmp 0x140001889
lea r8, [rsp + 0x118]
lea rdx, str.SYSTEMCurrentControlSetControlLsa
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x14000167c
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_open_LSA_registry_key_r_n
call fcn.140004c6c
mov eax, 1
jmp 0x14000188b
mov dword [rsp + 0xf0], 0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.forceguest
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400016e0
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_set_LSA_registry_key_value_r_n
call fcn.140004c6c
mov eax, 2
jmp 0x14000188b
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.140004b80
mov dword [rsp + 0x120], 0x68
xor eax, eax
mov word [rsp + 0x160], ax
mov dword [rsp + 0x15c], 1
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.netsh_firewall_set_service_type__FILEANDPRINT_mode__ENABLE
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000179a
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_to_create_process_to_set_basic_firewall_rules_r_n
call fcn.140004c6c
mov eax, 3
jmp 0x14000188b
mov edx, 0x1388
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400017ef
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_waiting_for_basic_firewall_rule_process_to_complete_r_n
call fcn.140004c6c
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 4
jmp 0x14000188b
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x140001844
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Failed_getting_exit_code_of_basic_firewall_rule_process_r_n
call fcn.140004c6c
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 5
jmp 0x14000188b
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x110], 0
je 0x140001889
call fcn.140004de4
mov rcx, rax
add rcx, 0x60
lea rdx, str.Could_not_set_basic_firewall_rule_r_n
call fcn.140004c6c
mov eax, 6
jmp 0x14000188b
xor eax, eax
add rsp, 0x198
ret