Function at 0x7fff25d70300
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x198]
sub rsp, 0x298
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x208]
xor r12d, r12d
mov qword [rbp - 0x68], rax
mov rdi, rcx
mov rcx, qword [rbp + 0x220]
mov rbx, rdx
mov rax, qword [rbp + 0x210]
mov rsi, rcx
mov qword [rbp - 0x70], rax
mov r13, r9
mov rax, qword [rbp + 0x218]
mov r15, r8
mov qword [rsp + 0x78], rdx
mov rdx, qword [rbp + 0x200]
test rdx, rdx
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x228]
mov r14, rdx
cmove r14, r12
mov qword [rbp - 0x48], r9
test rcx, rcx
mov qword [rbp - 0x50], r8
mov qword [rbp - 0x28], rcx
cmove rsi, r12
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x20], r14
cmp rdi, 0xffffffff80000050
je 0x7fff25d70797
cmp rdi, 0xffffffff80000004
je 0x7fff25d70797
cmp rdi, 0xffffffff80000060
je 0x7fff25d70797
mov r15, qword [rbx + 8]
test r15, r15
jne 0x7fff25d7057b
test r14, r14
jne 0x7fff25d7057b
movzx eax, word [rbx + 2]
lea r14d, [r12 + 4]
mov dword [rsp + 0x64], 0x28
mov dword [rsp + 0x60], eax
mov r9d, dword [rsp + 0x64]
lea rax, [rsp + 0x70]
lea r13, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
mov qword [rsp + 0x68], r13
mov edx, r14d
lea rbx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x80000005
je 0x7fff25de7034
mov ecx, 0x80000000
lea eax, [rsi + rcx]
test ecx, eax
je 0x7fff25d70503
mov r15, qword [rsp + 0x78]
cmp r14d, 2
je 0x7fff25d705a9
test esi, esi
js 0x7fff25d70646
test dil, 2
jne 0x7fff25d70668
test esi, esi
js 0x7fff25d70646
cmp qword [rbp - 0x30], r12
jne 0x7fff25d70519
mov rcx, qword [rbp - 0x50]
cmp r14d, 4
jne 0x7fff25d705ba
mov eax, dword [rbx + 0xc]
mov dword [rcx], eax
mov eax, dword [rbx + 0x10]
mov rcx, qword [rbp - 0x48]
mov dword [rcx], eax
mov eax, dword [rbx + 0x14]
mov rcx, qword [rbp - 0x68]
mov dword [rcx], eax
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbp - 0x70]
mov dword [rcx], eax
mov eax, dword [rbx + 0x1c]
mov rcx, qword [rbp - 0x78]
mov dword [rcx], eax
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbx]
mov qword [rcx], rax
lea rax, [rbp + 0x20]
cmp rbx, rax
jne 0x7fff25de7165
lea rax, [rbp + 0xd0]
cmp r13, rax
jne 0x7fff25de718d
mov eax, r12d
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp esi, 0x80000005
je 0x7fff25d7044b
mov r15, qword [rsp + 0x78]
jmp 0x7fff25d7045a
mov rsi, qword [rbp - 0x28]
lea r8, [rbp - 0x10]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rcx, rdi
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQuerySecurityObject]
nop dword [rax + rax]
cmp eax, 0xc0000023
jne 0x7fff25d70630
xor r9d, r9d
lea rax, [rsp + 0x74]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 + 0xf]
call qword [sym.imp.ntdll.dll_NtQuerySecurityObject]
nop dword [rax + rax]
cmp eax, 0xc0000023
jne 0x7fff25d7047e
jmp 0x7fff25de7141
movzx eax, word [rbx + 2]
mov r14d, 2
mov dword [rsp + 0x60], eax
lea ebx, [rax + 0x2c]
mov dword [rsp + 0x64], ebx
cmp ebx, 0xb0
jb 0x7fff25d70638
mov dword [rsp + 0x64], 0xb0
jmp 0x7fff25d703f5
movzx eax, word [rbx + 0x10]
add ax, 2
mov word [r15], ax
jmp 0x7fff25d7045a
mov eax, dword [rbx + 0x14]
mov dword [rcx], eax
cmp qword [rbp - 0x20], r12
je 0x7fff25d705ce
mov rcx, qword [rbp - 0x18]
mov eax, dword [rbx + 0x1c]
mov dword [rcx], eax
mov eax, dword [rbx + 0x18]
mov rcx, qword [rbp - 0x48]
mov dword [rcx], eax
mov eax, dword [rbx + 0x20]
mov rcx, qword [rbp - 0x68]
mov dword [rcx], eax
mov eax, dword [rbx + 0x24]
mov rcx, qword [rbp - 0x70]
mov dword [rcx], eax
mov eax, dword [rbx + 0x28]
mov rcx, qword [rbp - 0x78]
mov dword [rcx], eax
mov rcx, qword [rbp - 0x80]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x7fff25d704bf
movzx eax, word [r15 + 2]
cmp word [r15], ax
ja 0x7fff25de714c
mov eax, dword [rbx + 0x10]
test eax, eax
jne 0x7fff25d7077f
shr rax, 1
mov word [rcx + rax*2], r12w
jmp 0x7fff25d704bf
mov dword [rsi], r12d
jmp 0x7fff25d7047e
cmp ebx, 0x2c
jae 0x7fff25d703f9
jmp 0x7fff25d7059c
cmp esi, 0x80000005
je 0x7fff25de715a
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov r12d, eax
jmp 0x7fff25d704bf
lea rax, [rbp - 0x58]
mov r8d, 0x2000000
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov rdx, rdi
xor ecx, ecx
call fcn.7fff25da7558
mov esi, eax
test eax, eax
js 0x7fff25d70646
mov rax, qword [rbp - 0x58]
test rax, rax
je 0x7fff25d7046c
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x7fff25d7046c
mov r9d, dword [rsp + 0x64]
lea r8, [rsp + 0x68]
cmp rax, rdi
mov r13, rax
movzx eax, word [r15 + 2]
mov edx, r14d
cmove r13, rcx
mov word [rsp + 0x28], ax
mov rcx, r13
mov dword [rsp + 0x20], r12d
call fcn.7fff25d41eb4
mov esi, eax
test eax, eax
js 0x7fff25d706f5
mov r8, qword [rbp - 0x60]
lea rax, [rsp + 0x60]
mov rdx, qword [rbp - 0x58]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.7fff25d41b8c
mov esi, eax
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test esi, esi
js 0x7fff25de70b7
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.7fff25da6400
mov esi, eax
test eax, eax
js 0x7fff25de7137
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x7fff25de70d8
mov ecx, dword [rdx + 0x1c]
mov eax, dword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
cmp r14d, 4
jne 0x7fff25de70f8
mov dword [rbx + 0xc], eax
mov dword [rbx + 0x14], ecx
mov eax, dword [r13 + 0x10]
cmp eax, dword [rbx + 0x10]
ja 0x7fff25de70e0
mov eax, dword [r13 + 0x18]
cmp eax, dword [rbx + 0x18]
ja 0x7fff25de70e8
mov eax, dword [r13 + 0x1c]
cmp eax, dword [rbx + 0x1c]
ja 0x7fff25de70f0
mov rcx, rdx
call fcn.7fff25d436cc
jmp 0x7fff25d7046c
mov r8, rax
lea rdx, [rbx + 0x2c]
call sub.ntdll.dll_memmove
mov eax, dword [rbx + 0x10]
mov rcx, qword [r15 + 8]
jmp 0x7fff25d70623
test r14, r14
je 0x7fff25d707fe
test rsi, rsi
je 0x7fff25d70804
call fcn.7fff25dcefc8
test al, al
je 0x7fff25de71b3
mov rcx, qword [rbp - 0x80]
mov r9, r15
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov rcx, qword [rbp - 0x78]
mov rdx, rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], rcx
mov rcx, rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.ext_ms_win_advapi32_registry_l1_1_0.dll_PerfRegQueryInfoKey]
nop dword [rax + rax]
jmp 0x7fff25d704df
lea r14, [rbp - 0x40]
jmp 0x7fff25d7079c
lea rsi, [rbp - 0x3c]
jmp 0x7fff25d707a1
test r15, r15
je 0x7fff25de704e
mov ecx, dword [rbp + 0x30]
movzx eax, word [rsp + 0x60]
add rcx, 2
cmp rax, rcx
jb 0x7fff25d7043b
mov rcx, qword gs:[0x60]
xor edx, edx
mov esi, dword [rsp + 0x70]
mov r8d, esi
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x7fff25de7087
mov r13, qword [rsp + 0x68]
mov esi, 0xc0000017
jmp 0x7fff25d70652
lea rax, [rsp + 0x70]
mov r9d, esi
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 2
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov r13, qword [rsp + 0x68]
mov esi, eax
jmp 0x7fff25d7043b
mov r13, qword [rsp + 0x68]
cmp esi, 0xc0000034
mov eax, r12d
cmovne eax, esi
mov esi, r12d
cmp eax, 0x80000005
cmovne esi, eax
jmp 0x7fff25d7046c
mov ecx, r12d
jmp 0x7fff25d70732
mov dword [rbx + 0x10], eax
jmp 0x7fff25d70758
mov dword [rbx + 0x18], eax
jmp 0x7fff25d70765
mov dword [rbx + 0x1c], eax
jmp 0x7fff25d70772
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x20], ecx
mov eax, dword [r13 + 0x18]
cmp eax, dword [rbx + 0x18]
jbe 0x7fff25de710a
mov dword [rbx + 0x18], eax
mov eax, dword [r13 + 0x1c]
cmp eax, dword [rbx + 0x1c]
jbe 0x7fff25de7116
mov dword [rbx + 0x1c], eax
mov eax, dword [r13 + 0x24]
cmp eax, dword [rbx + 0x24]
jbe 0x7fff25de7122
mov dword [rbx + 0x24], eax
mov eax, dword [r13 + 0x28]
cmp eax, dword [rbx + 0x28]
jbe 0x7fff25d70772
mov dword [rbx + 0x28], eax
jmp 0x7fff25d70772
mov r13, qword [rsp + 0x68]
jmp 0x7fff25d70646
mov eax, dword [rsp + 0x74]
mov dword [rsi], eax
jmp 0x7fff25d7047e
mov word [r15], ax
mov ecx, 0xc0000023
jmp 0x7fff25d70654
mov r12d, 0xea
jmp 0x7fff25d704bf
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r13, qword [rsp + 0x68]
jmp 0x7fff25d704cc
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25d704dc
mov eax, 0x57
jmp 0x7fff25d704df