Function at 0x1400019d0
Capabilities:
Decode data using base64 via winapi
Get process image filename
Get token privileges
List groups for user account
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x750]
sub rsp, 0x850
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rbp + 0x740], rax
mov rbx, rdx
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x60]
mov r15d, eax
lea rcx, [rsp + 0x50]
call fcn.140001420
mov r8d, r15d
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, 0x1f4
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov edi, eax
test eax, eax
je 0x140001a76
lea rdx, [rdi*2 + 2]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
lea rdx, [rdi + 1]
lea r8, [rsp + 0x70]
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x140001a7b
mov r14, qword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x68]
mov ecx, r15d
call fcn.1400017b0
mov rax, qword [rbx]
xor edi, edi
mov r12d, edi
cmp word [rax], 0x2d
sete r12b
mov dword [rsp + 0x58], r12d
test esi, esi
jne 0x140001ae1
mov rax, qword [rsp + 0x50]
mov r8, qword [rbx + 8]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001ad4
add rax, 2
test ecx, ecx
jne 0x140001ac0
test edx, edx
sete al
xor al, r12b
jmp 0x140002236
mov qword [rsp + 0x880], r13
cmp esi, 1
jne 0x140001be9
mov r13, qword [rbx + 8]
lea rax, [rsp + 0x60]
mov r15, qword [rbx + 0x10]
mov r9d, esi
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
mov rdx, r13
mov qword [rsp + 0x30], rax
xor ecx, ecx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.NETAPI32.dll_NetUserGetLocalGroups]
mov ebx, edi
cmp dword [rsp + 0x68], ebx
jbe 0x140001b60
mov r14, qword [rsp + 0x58]
nop
mov rcx, qword [r14]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002726
inc ebx
add r14, 8
cmp ebx, dword [rsp + 0x68]
jb 0x140001b40
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x68]
mov rdx, r13
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.NETAPI32.dll_NetUserGetGroups]
mov ebx, edi
cmp dword [rsp + 0x68], ebx
jbe 0x140001bd0
mov r14, qword [rsp + 0x58]
nop word [rax + rax]
mov rcx, qword [r14]
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140002726
inc ebx
add r14, 8
cmp ebx, dword [rsp + 0x68]
jb 0x140001bb0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov esi, edi
xor r12b, sil
movzx eax, r12b
jmp 0x14000222e
cmp esi, 2
jne 0x140001c21
mov rax, qword [rsp + 0x60]
mov r8, qword [rbx + 8]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001c14
add rax, 2
test ecx, ecx
jne 0x140001c00
test edx, edx
sete al
xor al, r12b
jmp 0x14000222e
cmp esi, 3
jne 0x140001c59
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
lea ecx, [rsi - 2]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__isatty]
cmp eax, ebx
sete al
xor al, r12b
jmp 0x14000222e
cmp esi, 4
jne 0x140001c7c
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov ebx, eax
call fcn.1400016a0
cmp eax, ebx
sete al
xor al, r12b
jmp 0x14000222e
cmp esi, 0x10
jne 0x140001cb7
mov rcx, qword [rbx + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0xffffffff
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
cmp dword [rsp + 0x60], ebx
sete al
xor al, r12b
jmp 0x14000222e
cmp esi, 6
jne 0x140001cd9
mov rdx, qword [rbx + 8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
setne al
xor al, r12b
jmp 0x14000222e
cmp esi, 7
jne 0x140001cf9
mov rdx, qword [rbx + 8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
setne al
xor al, r12b
jmp 0x14000222e
cmp esi, 8
jne 0x140001d74
mov rsi, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140001910
mov ebx, eax
test eax, eax
je 0x140002724
nop dword [rax]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rdi
mov ecx, ebx
call fcn.1400017b0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002724
mov rdx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140002702
mov ecx, ebx
call fcn.140001910
cmp eax, ebx
je 0x140002724
mov ebx, eax
test eax, eax
jne 0x140001d20
mov esi, edi
xor r12b, sil
movzx eax, r12b
jmp 0x14000222e
cmp esi, 9
jne 0x140001e3f
mov r13, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140001910
mov esi, eax
test eax, eax
je 0x140002724
nop dword [rax + rax]
mov r8d, esi
xor edx, edx
mov ecx, 0x1000
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, 0x1f4
lea rdx, [rsp + 0x70]
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
mov r14d, eax
test eax, eax
je 0x140001df9
lea rdx, [r14*2 + 2]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
lea rdx, [r14 + 1]
lea r8, [rsp + 0x70]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140002724
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140002702
mov ecx, esi
call fcn.140001910
mov esi, eax
test eax, eax
jne 0x140001da0
mov esi, edi
xor r12b, sil
movzx eax, r12b
jmp 0x14000222e
cmp esi, 0xa
jne 0x140001f60
mov rbx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [rsi - 2]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001e87
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._nOpen_Current_Process_Token_failed:_d
call fcn.140001080
xor r12b, dil
movzx eax, r12b
jmp 0x14000222e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [r9 + 0x27]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14000284f
mov edx, dword [rsp + 0x68]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
test rax, rax
je 0x14000284f
mov r9d, dword [rsp + 0x68]
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
mov r8, r14
mov edx, 0x27
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140001f4b
mov esi, edi
cmp dword [r14 + 4], edi
jbe 0x140001f4b
mov r15, 0xffffffffffffffff
nop dword [rax]
mov eax, esi
lea rcx, [rax + rax*4]
mov rax, qword [r14 + 8]
movzx r8d, word [rax + rcx*8]
lea rcx, [rax + rcx*8]
shr r8, 1
mov rax, r15
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x140001f20
cmp rax, r8
jne 0x140001f43
mov rcx, qword [rcx + 8]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x14000284a
inc esi
cmp esi, dword [r14 + 4]
jb 0x140001f00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r12b, dil
movzx eax, r12b
jmp 0x14000222e
cmp esi, 0xf
jne 0x140002261
mov rax, qword [rbx + 0x10]
mov r15, 0xffffffffffffffff
mov r14, qword [rbx + 8]
mov rdx, r15
mov r13, qword [rbx + 0x18]
mov r12, qword [rbx + 0x20]
mov qword [rsp + 0x48], rax
nop dword [rax + rax]
inc rdx
cmp word [r12 + rdx*2], di
jne 0x140001f90
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x68]
mov esi, 1
mov qword [rsp + 0x28], rdi
mov r8d, esi
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140002049
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140002049
nop dword [rax]
inc r15
cmp word [r12 + r15*2], di
jne 0x140001ff0
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rdi
mov rdx, r15
mov qword [rsp + 0x20], rcx
mov r9, rax
mov rcx, r12
mov r8d, esi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x140002033
mov ecx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x50]
mov byte [rcx + rax], dil
jmp 0x14000204e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsp + 0x50]
mov edx, esi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x50], rdi
mov rcx, rdi
lea r8, str.HKLM
nop dword [rax + rax]
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140002082
cmp rcx, 5
jne 0x140002060
mov rbx, 0xffffffff80000002
jmp 0x140002148
mov rcx, rdi
lea r8, str.HKCU
nop dword [rax]
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400020b2
cmp rcx, 5
jne 0x140002090
mov rbx, 0xffffffff80000001
jmp 0x140002148
mov rcx, rdi
lea r8, [0x140007888]
nop dword [rax]
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400020df
cmp rcx, 4
jne 0x1400020c0
mov rbx, 0xffffffff80000003
jmp 0x140002148
mov rcx, rdi
lea r8, str.HKCC
nop dword [rax]
movzx eax, word [r14 + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000210f
cmp rcx, 5
jne 0x1400020f0
mov rbx, 0xffffffff80000005
jmp 0x140002148
mov rax, rdi
lea rcx, str.HKCR
nop dword [rax]
movzx edx, word [r14 + rax*2]
inc rax
cmp dx, word [rcx + rax*2 - 2]
jne 0x14000213a
cmp rax, 5
jne 0x140002120
cmp dx, word [rcx + rax*2 - 2]
mov rbx, rdi
mov rax, 0xffffffff80000000
cmove rbx, rax
lea rdx, str._default_
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov r14, qword [rsp + 0x48]
mov r9d, 8
test eax, eax
mov rdx, r14
lea rax, [rsp + 0x60]
mov rcx, rbx
cmove r13, rdi
mov qword [rsp + 0x30], rax
mov r8, r13
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002220
mov edx, dword [rsp + 0x60]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r8, qword [rsp + 0x40]
mov r9d, 8
mov r13, rax
mov rdx, r14
lea rax, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000222c
mov eax, dword [rsp + 0x68]
mov ebx, edi
mov r14d, dword [rsp + 0x60]
mov r15d, eax
mov r12, qword [rsp + 0x50]
sub r14d, eax
nop
movsxd rdx, ebx
mov r8, r15
add rdx, r13
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140002215
inc ebx
cmp ebx, r14d
jbe 0x1400021f0
mov eax, dword [rsp + 0x58]
xor al, dil
jmp 0x14000222e
mov eax, dword [rsp + 0x58]
mov edi, esi
xor al, dil
jmp 0x14000222e
lea rcx, str.ERR:_Do_you_have_permissions_to_check_that_registry_entry__n
call fcn.140001020
xor al, al
mov r13, qword [rsp + 0x880]
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.140005220
lea r11, [rsp + 0x850]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
cmp esi, 0xc
jne 0x140002420
mov rdx, qword [rbx + 8]
lea r8, str.HKLM
mov r13, qword [rbx + 0x10]
mov rcx, rdi
mov r14, qword [rbx + 0x18]
mov r15, qword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400022b1
cmp rcx, 5
jne 0x140002290
mov rbx, 0xffffffff80000002
jmp 0x14000237a
mov rcx, rdi
lea r8, str.HKCU
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400022e1
cmp rcx, 5
jne 0x1400022c0
mov rbx, 0xffffffff80000001
jmp 0x14000237a
mov rcx, rdi
lea r8, [0x140007888]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000230e
cmp rcx, 4
jne 0x1400022f0
mov rbx, 0xffffffff80000003
jmp 0x14000237a
mov rcx, rdi
lea r8, str.HKCC
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000233e
cmp rcx, 5
jne 0x140002320
mov rbx, 0xffffffff80000005
jmp 0x14000237a
mov rax, rdi
lea rcx, str.HKCR
nop dword [rax + rax]
movzx r8d, word [rdx + rax*2]
inc rax
cmp r8w, word [rcx + rax*2 - 2]
jne 0x14000236c
cmp rax, 5
jne 0x140002350
cmp r8w, word [rcx + rax*2 - 2]
mov rbx, rdi
mov rax, 0xffffffff80000000
cmove rbx, rax
lea rdx, str._default_
mov dword [rsp + 0x60], edi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov r9d, 0x1000ffff
mov rdx, r13
test eax, eax
mov rcx, rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmove r14, rdi
mov r8, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002220
mov edx, dword [rsp + 0x60]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, 0x1000ffff
mov r8, r14
mov rsi, rax
mov rdx, r13
lea rax, [rsp + 0x60]
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000222c
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
setne al
xor al, r12b
jmp 0x14000222e
cmp esi, 0xd
jne 0x1400025c8
mov rcx, qword [rbx + 0x20]
mov rsi, qword [rbx + 8]
mov r13, qword [rbx + 0x10]
mov r14, qword [rbx + 0x18]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtol]
mov rdx, rdi
lea r8, str.HKLM
mov r15d, eax
nop dword [rax]
movzx ecx, word [rsi + rdx*2]
inc rdx
cmp cx, word [r8 + rdx*2 - 2]
jne 0x140002471
cmp rdx, 5
jne 0x140002450
mov rbx, 0xffffffff80000002
jmp 0x140002537
mov rcx, rdi
lea r8, str.HKCU
nop dword [rax + rax]
movzx eax, word [rsi + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400024a1
cmp rcx, 5
jne 0x140002480
mov rbx, 0xffffffff80000001
jmp 0x140002537
mov rcx, rdi
lea r8, [0x140007888]
nop dword [rax + rax]
movzx eax, word [rsi + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400024ce
cmp rcx, 4
jne 0x1400024b0
mov rbx, 0xffffffff80000003
jmp 0x140002537
mov rcx, rdi
lea r8, str.HKCC
nop dword [rax + rax]
movzx eax, word [rsi + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400024fe
cmp rcx, 5
jne 0x1400024e0
mov rbx, 0xffffffff80000005
jmp 0x140002537
mov rax, rdi
lea rcx, str.HKCR
nop dword [rax + rax]
movzx edx, word [rsi + rax*2]
inc rax
cmp dx, word [rcx + rax*2 - 2]
jne 0x140002529
cmp rax, 5
jne 0x140002510
cmp dx, word [rcx + rax*2 - 2]
mov rbx, rdi
mov rax, 0xffffffff80000000
cmove rbx, rax
lea rdx, str._default_
mov dword [rsp + 0x60], edi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov r9d, 0x10
mov rdx, r13
test eax, eax
mov rcx, rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
cmove r14, rdi
mov r8, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002220
lea rax, [rsp + 0x60]
mov r9d, 0x10
mov qword [rsp + 0x30], rax
mov r8, r14
lea rax, [rsp + 0x58]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000222c
cmp r15d, dword [rsp + 0x58]
sete al
xor al, r12b
jmp 0x14000222e
cmp esi, 0x11
jne 0x140002732
mov rdx, qword [rbx + 8]
lea r8, str.HKLM
mov r10, qword [rbx + 0x10]
mov rcx, rdi
mov r11, qword [rbx + 0x18]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140002611
cmp rcx, 5
jne 0x1400025f0
mov rbx, 0xffffffff80000002
jmp 0x1400026da
mov rcx, rdi
lea r8, str.HKCU
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140002641
cmp rcx, 5
jne 0x140002620
mov rbx, 0xffffffff80000001
jmp 0x1400026da
mov rcx, rdi
lea r8, [0x140007888]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000266e
cmp rcx, 4
jne 0x140002650
mov rbx, 0xffffffff80000003
jmp 0x1400026da
mov rcx, rdi
lea r8, str.HKCC
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14000269e
cmp rcx, 5
jne 0x140002680
mov rbx, 0xffffffff80000005
jmp 0x1400026da
mov rax, rdi
lea rcx, str.HKCR
nop dword [rax + rax]
movzx r9d, word [rdx + rax*2]
inc rax
cmp r9w, word [rcx + rax*2 - 2]
jne 0x1400026cc
cmp rax, 5
jne 0x1400026b0
cmp r9w, word [rcx + rax*2 - 2]
mov rbx, rdi
mov rax, 0xffffffff80000000
cmove rbx, rax
mov qword [rsp + 0x30], rdi
mov r9d, 0xffff
mov qword [rsp + 0x28], rdi
mov r8, r11
mov rdx, r10
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002713
mov esi, 1
xor r12b, sil
movzx eax, r12b
jmp 0x14000222e
cmp eax, 5
jne 0x140002724
lea rcx, str.ERR:_Access_to_registry_denied..._This_shouldnt_be_happening_n
call fcn.140001080
mov esi, edi
xor r12b, sil
movzx eax, r12b
jmp 0x14000222e
cmp esi, 0xe
jne 0x14000222c
mov r14, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x50]
lea edx, [rsi - 6]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000284f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edx, [rsi - 0xb]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9d, dword [rsp + 0x60]
mov edx, 3
mov rcx, qword [rsp + 0x50]
mov rsi, rax
lea rax, [rsp + 0x68]
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400027c7
lea rcx, str.GetTokenInformation__
call fcn.140001020
xor r12b, dil
movzx eax, r12b
jmp 0x14000222e
mov ebx, edi
cmp dword [rsi], ebx
jbe 0x14000284f
mov eax, ebx
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x58], 0x3e8
lea rcx, [rax*2 + 1]
add rcx, rax
lea rdx, [rsi + rcx*4]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
test eax, eax
jne 0x14000280e
lea rcx, str.LookupPrivilegeNameW__
call fcn.140001020
jmp 0x140002838
lea r8, [rsp + 0x70]
mov rax, r14
sub r8, r14
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002834
add rax, 2
test ecx, ecx
jne 0x140002820
test edx, edx
je 0x14000284a
inc ebx
cmp ebx, dword [rsi]
jb 0x1400027d1
xor r12b, dil
movzx eax, r12b
jmp 0x14000222e
mov edi, 1
xor r12b, dil
movzx eax, r12b
jmp 0x14000222e