Function at 0x14730
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
xor ebx, ebx
mov r14, rcx
lea rsi, [0x0001d240]
mov rcx, rsi
mov word [rsp + 0x30], bx
mov word [rsp + 0x32], bx
mov qword [rsp + 0x38], rbx
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
cmp qword [0x0001d238], rbx
je 0x147c2
movzx edx, word [0x0001d232]
mov r8d, dword [str.NxMm]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, rbx
mov qword [r14], rax
je 0x147ad
movzx r8d, word [0x0001d232]
mov rdx, qword [0x0001d238]
mov rcx, rax
call fcn.0001a620
jmp 0x147b2
mov ebx, 0xc000009a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov eax, ebx
jmp 0x14b93
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
lea rdx, [0x0001ac40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0xd0]
mov edx, 0x20019
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x78], 0x240
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov edi, eax
jl 0x14b91
mov r8d, dword [str.NxMm]
mov edi, 0x218
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, rbx
mov r12, rax
je 0x14b2c
lea rdx, [0x0001acc0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0xd0]
lea r11, [rsp + 0xc8]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0x40]
mov r9, r12
mov r8d, 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, ebx
mov edi, eax
jl 0x14b1f
cmp dword [r12 + 4], 1
je 0x148ae
cmp dword [r12 + 4], 2
jne 0x14b1f
lea r13, [0x0001ace0]
lea rcx, [rsp + 0x50]
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11d, dword [r12 + 8]
shr r11d, 1
mov eax, r11d
cmp rax, rbx
jl 0x148ef
lea rcx, [r12 + r11*2 + 0xc]
cmp word [rcx], 0x5c
je 0x148ef
sub rax, 1
sub r11d, 1
sub rcx, 2
cmp rax, rbx
jge 0x148d8
movzx eax, word [rsp + 0x50]
lea ebp, [r11 + r11 + 2]
lea rcx, [0x0001d240]
add eax, ebp
movsxd rsi, eax
add rsi, 2
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
mov r8d, dword [str.NxMm]
mov rdx, rsi
xor ecx, ecx
mov word [0x0001d232], si
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, rbx
mov qword [0x0001d238], rax
je 0x14b0a
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.0001a520
shr rsi, 1
mov edi, ebx
cmp rsi, rbx
mov r10d, 0xc000000d
je 0x1495e
cmp rsi, 0x7fffffff
jbe 0x14961
mov edi, r10d
cmp edi, ebx
mov r11d, 0x80000005
jl 0x14ae7
movsxd rdx, ebp
shr rdx, 1
cmp rdx, 0x7ffffffe
jbe 0x1498d
mov rax, qword [0x0001d238]
mov edi, r10d
mov word [rax], bx
jmp 0x149d8
cmp rsi, rbx
mov rcx, qword [0x0001d238]
lea r9, [r12 + 0xc]
mov r8, rsi
mov edi, ebx
je 0x149ce
sub rdx, rsi
lea rax, [rdx + r8]
cmp rax, rbx
je 0x149c9
movzx eax, word [r9]
cmp ax, bx
je 0x149c9
mov word [rcx], ax
add r9, 2
add rcx, 2
sub r8, 1
jne 0x149a6
cmp r8, rbx
jne 0x149d5
sub rcx, 2
mov edi, r11d
mov word [rcx], bx
cmp edi, ebx
jl 0x14ae7
cmp rsi, rbx
mov r9, qword [0x0001d238]
je 0x14a19
cmp rsi, 0x7fffffff
ja 0x14a19
mov rax, rsi
mov rcx, r9
mov edi, ebx
cmp word [rcx], bx
je 0x14a0c
add rcx, 2
sub rax, 1
jne 0x149fd
cmp rax, rbx
je 0x14a19
mov rdx, rsi
sub rdx, rax
jmp 0x14a1f
mov rdx, rbx
mov edi, r10d
cmp edi, ebx
jl 0x14aee
mov r8, rsi
lea rcx, [r9 + rdx*2]
mov edi, ebx
sub r8, rdx
je 0x14a6f
mov rax, r8
sub rax, rsi
lea r9, [rax + rdx + 0x7fffffff]
cmp r9, rbx
je 0x14a6a
movzx eax, word [r13]
cmp ax, bx
je 0x14a6a
sub r8, 1
mov word [rcx], ax
add r13, 2
add rcx, 2
sub r9, 1
cmp r8, rbx
jne 0x14a43
cmp r8, rbx
jne 0x14a76
sub rcx, 2
mov edi, r11d
cmp edi, ebx
mov word [rcx], bx
mov r9, qword [0x0001d238]
jl 0x14aee
movzx ecx, word [0x0001d232]
mov rax, rbx
shr rcx, 1
cmp r9, rbx
je 0x14acb
cmp rcx, 0x7fffffff
ja 0x14acb
cmp rcx, rbx
mov rdx, rcx
mov rax, r9
mov edi, ebx
je 0x14ac8
cmp word [rax], bx
je 0x14abb
add rax, 2
sub rdx, 1
jne 0x14aac
cmp rdx, rbx
je 0x14ac8
mov rax, rcx
sub rax, rdx
jmp 0x14ace
mov rax, rbx
mov edi, r10d
cmp edi, ebx
jl 0x14ad7
add rax, rax
jmp 0x14ada
mov rax, rbx
cmp edi, ebx
jl 0x14aee
mov word [0x0001d230], ax
jmp 0x14b0f
mov r9, qword [0x0001d238]
xor edx, edx
mov rcx, r9
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [0x0001d230]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jmp 0x14b0f
mov edi, 0xc000009a
lea rsi, [0x0001d240]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14b31
mov edi, 0xc000009a
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
jl 0x14b91
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
movzx edx, word [0x0001d232]
mov r8d, dword [str.NxMm]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp rax, rbx
mov qword [r14], rax
je 0x14b83
movzx r8d, word [0x0001d232]
mov rdx, qword [0x0001d238]
mov rcx, rax
call fcn.0001a620
jmp 0x14b88
mov edi, 0xc000009a
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
mov eax, edi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret