Function at 0x140008898
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14, rcx
test rcx, rcx
jne 0x1400088c3
mov eax, 0xc0000001
jmp 0x140008ab8
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp - 0x28], 0
lea rax, [rbp - 0x40]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x30], 0x30
mov edx, 0xf003f
mov dword [rbp - 0x18], 0x240
lea rcx, [rbp + 0x38]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x140008a87
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea edi, [r9 + 2]
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov edx, dword [rbp + 0x30]
xor ecx, ecx
mov r8d, 0x746b734b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140008a7d
mov r8d, dword [rbp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.140018a40
mov r9d, dword [rbp + 0x30]
lea rax, [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
mov r8, rbx
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
xor edi, edi
cmp dword [rbx + 0x14], edi
jbe 0x140008a72
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
and dword [rsp + 0x20], 0
xor r8d, r8d
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov edx, dword [rbp + 0x30]
xor ecx, ecx
mov r8d, 0x746b734b
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
je 0x140008a67
mov ecx, dword [rbp + 0x30]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov r9, rsi
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, qword [rbp + 0x38]
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
movzx ecx, word [rbp - 0x40]
mov r8d, 0x746b734b
add ecx, 6
add ecx, dword [rsi + 0xc]
mov r12d, ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
test rax, rax
je 0x140008a5c
mov r8d, r12d
xor edx, edx
mov rcx, rax
call fcn.140018a40
shr r12, 1
mov r8, r14
mov rdx, r12
mov rcx, r15
call sub.ntoskrnl.exe_wcscpy_s
lea r8, [0x140019bf0]
mov rdx, r12
mov rcx, r15
call sub.ntoskrnl.exe_wcscat_s
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x10]
shr r9, 1
mov rdx, r12
mov rcx, r15
call sub.ntoskrnl.exe_wcsncat_s
mov rcx, r15
call fcn.140008898
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
inc edi
cmp edi, dword [rbx + 0x14]
jb 0x14000897f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r8, [rbp - 0x30]
mov edx, 0xf003f
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x140008ab6
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rbp + 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret