Function at 0x7fff25d6f7f0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2e0
movaps xmmword [rsp + 0x2d0], xmm6
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov r13d, r9d
mov r12d, r8d
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x70], rdx
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x60], r9d
mov edx, r9d
mov dword [rsp + 0x58], edx
mov r15, qword [rsp + 0x340]
mov qword [rsp + 0xc8], r15
mov rsi, qword [rsp + 0x348]
mov qword [rsp + 0x78], rsi
xor ecx, ecx
movups xmm6, xmmword [rdi]
movups xmmword [rsp + 0x80], xmm6
movzx eax, word [rdi]
cmp ax, 2
jb 0x7fff25de6d36
test al, 1
jne 0x7fff25de6d36
cmp qword [rdi + 8], rcx
je 0x7fff25de6d36
test r15, r15
je 0x7fff25de6d36
mov qword [r15], rcx
jmp 0x7fff25d6f8db
test ecx, ecx
jne 0x7fff25de6c38
mov eax, 0xfffe
add word [rdi], ax
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], r14
test r12b, 8
jne 0x7fff25d6fc31
mov dword [rsp + 0xb0], 0x40
mov qword [rsp + 0xa8], rdi
xorps xmm2, xmm2
movdqu xmmword [rsp + 0xb8], xmm2
test r14b, 2
jne 0x7fff25d6fb00
test byte [0x7fff25fd28b0], 2
jne 0x7fff25de6c3f
test rsi, rsi
jne 0x7fff25d6fc41
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rsp + 0xd8], xmm0
movups xmm1, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0xe8], xmm1
movups xmmword [rsp + 0xf8], xmm2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xd8]
mov ecx, r13d
call fcn.7fff25d6fcd0
mov ebx, eax
test eax, eax
js 0x7fff25d6f9f0
mov r9d, r12d
and r9d, 0x1c
lea r8, [rsp + 0xd8]
mov edx, r13d
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtOpenKeyEx]
nop dword [rax + rax]
mov esi, eax
cmp qword [rsp + 0x70], 0
jne 0x7fff25d6fbd6
test esi, esi
js 0x7fff25d6f9ee
cmp byte [rsp + 0x40], 0
jne 0x7fff25d6fabc
mov rax, qword [rsp + 0x60]
mov qword [r15], rax
mov ebx, esi
cmp ebx, 0x40000016
je 0x7fff25d6fc67
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov esi, eax
mov ecx, 0xc0000034
cmp ebx, ecx
je 0x7fff25d6fa5d
mov eax, 0xc0000022
cmp ebx, eax
je 0x7fff25d6fc1f
test r14b, 2
jne 0x7fff25d6fa2c
test ebx, ebx
js 0x7fff25d6fa8c
movups xmmword [rdi], xmm6
mov eax, esi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.7fff25dce640
movaps xmm6, xmmword [rsp + 0x2d0]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp dword [0x7fff25fd2528], 0
je 0x7fff25d6fc00
mov eax, dword [0x7fff25fd252c]
test eax, eax
jne 0x7fff25de6c81
mov ebx, ecx
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov esi, eax
jmp 0x7fff25d6fa15
call fcn.7fff25dd0fbc
test al, al
je 0x7fff25d6fa2c
lea r8, [rsp + 0x98]
mov edx, r13d
mov rcx, r15
call qword [sym.imp.ext_ms_win_kernel32_registry_l1_1_0.dll_TermsrvOpenRegEntry]
nop dword [rax + rax]
test eax, eax
je 0x7fff25d6fa2c
jmp 0x7fff25de6d21
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x7fff25d6f9e6
and eax, 0xf01
mov dword [rsp + 0x48], eax
mov r9d, 4
lea r8, [rsp + 0x48]
lea edx, [r9 + 1]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtSetInformationKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x7fff25d6f9e6
jmp 0x7fff25de6c6a
xor edx, edx
mov r8d, 0x182
lea rcx, [rsp + 0x130]
call sub.ntdll.dll_memset
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x8c], 0x182
and dword [rsp + 0x80], 0xffffffdf
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, r14
call fcn.7fff25d70810
mov ebx, eax
test eax, eax
js 0x7fff25d6f9fc
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
mov r9d, r13d
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.7fff25d6d6a0
mov ebx, eax
test byte [rsp + 0x80], 0x20
je 0x7fff25d6f9fc
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x90]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r14, qword [rsp + 0x50]
jmp 0x7fff25d6f9fc
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r14, qword [rsp + 0x50]
jmp 0x7fff25d6f9d7
call fcn.7fff25db5bf0
mov dword [0x7fff25fd252c], eax
mov dword [0x7fff25fd2528], 1
mov ecx, 0xc0000034
jmp 0x7fff25d6fa70
test byte [0x7fff25fd28b0], 1
je 0x7fff25d6fa22
jmp 0x7fff25de6ca0
mov dword [rsp + 0xb0], 0x140
jmp 0x7fff25d6f913
mov r9d, r12d
and r9d, 0x1c
mov qword [rsp + 0x20], rsi
lea r8, [rsp + 0x98]
mov edx, r13d
mov rcx, r15
call fcn.7fff25d72648
mov ebx, eax
jmp 0x7fff25d6f9f0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rsp + 0x108]
lea edx, [r9 - 0x24]
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test ebx, ebx
js 0x7fff25d6f9fc
movsxd rax, dword [rsp + 0x11c]
mov qword [r15], rax
jmp 0x7fff25d6f9fc
mov eax, ecx
jmp 0x7fff25d6fa31
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call 0x7fff25e51af0
mov r14, qword [rsp + 0x50]
test eax, eax
jne 0x7fff25d6fb00
movdqu xmm2, xmmword [rsp + 0xb8]
jmp 0x7fff25d6f93e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d6f9f0
mov r8, r15
mov rdx, rdi
mov rcx, r14
call 0x7fff25e521ec
xor ebx, ebx
test eax, eax
mov eax, 0xc0000034
cmovs ebx, eax
jmp 0x7fff25d6fa7a
mov ecx, dword [rsp + 0x58]
and ecx, 0x1000300
bts ecx, 0x19
mov rax, qword [rsp + 0x78]
test r14b, 2
je 0x7fff25de6cd6
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, ecx
mov r8d, r12d
mov rdx, rdi
mov rcx, r14
call 0x7fff25e51790
jmp 0x7fff25de6d00
xor r9d, r9d
lea r8, [rsp + 0x98]
mov edx, ecx
mov rcx, r15
test rax, rax
je 0x7fff25de6cf2
mov qword [rsp + 0x20], rax
jmp 0x7fff25de6cfb
mov qword [rsp + 0x20], 0
call fcn.7fff25d72648
mov ebx, eax
test eax, eax
mov eax, 0xc0000022
cmovs ebx, eax
mov ecx, ebx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov esi, eax
jmp 0x7fff25d6fa22
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov esi, eax
jmp 0x7fff25d6fa2c
mov eax, 0x57
jmp 0x7fff25d6fa31