Function at 0x140009720
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push rbp
mov rbp, rsp
sub rsp, 0xa78
mov rbx, rcx
lea rdi, [rbp - 0xa38]
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
lea rdi, [rbp - 0x218]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rbp - 0x420]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rdi, [rbp - 0x628]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rsi, rsi
je 0x14000986d
mov rcx, rsi
lea rdx, [0x14001e060]
mov r8d, 0x1020001
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rdi, rdi
jne 0x1400097c8
mov rcx, rsi
lea rdx, [0x14001e060]
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0x104
mov rcx, rdi
xor edx, edx
xor r8d, r8d
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x140009800
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140009864
mov r8d, dword [rbp - 4]
mov eax, r8d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000bbc0
sub rsp, rax
lea rax, [rsp + 0x40]
mov rsi, rax
mov rcx, rdi
mov rdx, rsi
lea r9, [rbp - 4]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x140009864
mov qword [rbp - 0x10], 0
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x1f
xor r8, r8
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x140009874
xor r12, r12
jmp 0x1400098e1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140009e8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000985c
mov r9d, dword [rbp - 4]
mov eax, r9d
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.14000bbc0
sub rsp, rax
lea rax, [rsp + 0x40]
mov r12, rax
lea rax, [rbp - 4]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov edx, 0x1f
mov r8, r12
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
test eax, eax
je 0x140009864
mov qword [rsp + 0x20], 0
mov rcx, r12
mov edx, 1
mov r8d, 0x1f
lea r9, [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorW]
test eax, eax
je 0x140009864
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsi]
cmp eax, 1
je 0x140009930
cmp eax, 2
jne 0x14000996a
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.FS_driver_name:__ls
lea r9, [0x14001e060]
call fcn.14000b010
jmp 0x140009989
mov rcx, rbx
mov edx, 0xfbb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Driver_name:__ls
lea r9, [0x14001e060]
call fcn.14000b010
jmp 0x140009989
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Service_name:__ls
lea r9, [0x14001e060]
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfa7
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x38]
test r9, r9
je 0x1400099ed
mov rdx, qword [rsi + 0x38]
lea r8, [0x14001858e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x1400099d3
add rcx, 2
test ax, ax
jne 0x1400099bd
jmp 0x1400099ed
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Display_name:__ls
call fcn.14000b010
jmp 0x140009a05
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Display_name:_None
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfaa
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x30]
test r9, r9
je 0x140009a69
mov rdx, qword [rsi + 0x30]
lea r8, [0x14001858e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140009a4f
add rcx, 2
test ax, ax
jne 0x140009a39
jmp 0x140009a69
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Account_name:__ls
call fcn.14000b010
jmp 0x140009a81
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Account_name:_None
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfab
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140009ae5
mov rdx, qword [rsi + 0x10]
lea r8, [0x14001858e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140009acb
add rcx, 2
test ax, ax
jne 0x140009ab5
jmp 0x140009ae5
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Binary_path:__ls
call fcn.14000b010
jmp 0x140009afd
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Binary_path:_None
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfac
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rax, str.Parameters
mov qword [rsp + 0x28], rax
lea rax, [0x14001e060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str._ls_ls_ls
lea r9, str.SYSTEMCurrentControlSetServices
call fcn.14000b010
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x218]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rdi, 0xffffffff80000002
mov rcx, rdi
lea rdx, [rbp - 0xa38]
lea r8, str.ServiceDll
mov r9d, 0xffff
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140009c20
lea rax, [0x14001e060]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str._ls_ls
lea r9, str.SYSTEMCurrentControlSetServices
call fcn.14000b010
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x218]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, rdi
lea rdx, [rbp - 0xa38]
lea r8, str.ServiceDll
mov r9d, 0xffff
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140009c20
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.ServiceDll_path:_None
call fcn.14000b010
jmp 0x140009c3f
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.ServiceDll_path:__ls
lea r9, [rbp - 0x218]
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfad
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rsi + 0x28]
test rdx, rdx
je 0x140009d07
mov r8, qword [rsi + 0x28]
lea r9, [0x14001858e]
xor ecx, ecx
mov ax, word [r8 + rcx]
cmp ax, word [r9 + rcx]
jne 0x140009c8e
add rcx, 2
test ax, ax
jne 0x140009c77
jmp 0x140009d07
mov rdi, rdx
cmp word [rdi], 0
je 0x140009ce6
lea r14, str._ls
cmp word [rdi], 0x2b
je 0x140009cc4
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x420]
mov edx, 0x104
mov r8, r14
lea r9, [rbp - 0x420]
call fcn.14000b010
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
add rax, 1
cmp word [rdi + rax*2], 0
jne 0x140009cd0
lea rdi, [rdi + rax*2 + 2]
cmp word [rdi], 0
jne 0x140009c9e
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Dependencies:__ls
lea r9, [rbp - 0x420]
call fcn.14000b010
jmp 0x140009d1f
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Dependencies:_None
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfae
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r9, qword [rsi + 0x18]
test r9, r9
je 0x140009d83
mov rdx, qword [rsi + 0x18]
lea r8, [0x14001858e]
xor ecx, ecx
mov ax, word [rdx + rcx]
cmp ax, word [r8 + rcx]
jne 0x140009d69
add rcx, 2
test ax, ax
jne 0x140009d53
jmp 0x140009d83
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Order_group:__ls
call fcn.14000b010
jmp 0x140009d9b
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Order_group:_None
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfaf
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [rsi + 0x20]
test esi, esi
jne 0x140009de1
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Tag_Id:___ls__has_not_been_assigned_a_tag
lea r9, [0x14001e060]
call fcn.14000b010
jmp 0x140009e10
mov ecx, esi
lea rdx, [rbp - 0x628]
mov r8d, 0xa
call fcn.14000af40
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.Tag_Id:__ls
mov r9, rax
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfb0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
test r12, r12
je 0x140009e51
lea rcx, [rbp - 0xa38]
mov edx, 0x208
lea r8, str.SDDL:__ls
mov r9, qword [rbp - 0x10]
call fcn.14000b010
jmp 0x140009e69
lea rcx, [rbp - 0xa38]
mov edx, 0x104
lea r8, str.SDDL:_The__SeSecurityPrivilege__is_disabled._Use_the_Privileges_and_Access_Rights_Manager.
call fcn.14000b010
mov rcx, rbx
mov edx, 0xfbc
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0xa38]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, 1
mov rsp, rbp
pop rbp
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret