Function at 0x12d70
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x218
mov rax, qword [0x00017108]
mov qword [rsp + 0x1e0], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 - 8], rdi
mov rdi, qword [rcx + 0x38]
mov qword [r11 - 0x10], r12
mov rbx, rcx
mov qword [r11 - 0x20], r14
xor r14d, r14d
lea rcx, [r11 - 0x178]
xor r8d, r8d
xor edx, edx
xor bpl, bpl
mov r12d, r14d
mov dword [r11 - 0x128], r14d
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
lea r11, [rsp + 0xc8]
lea rax, [rsp + 0xa0]
lea ecx, [r14 + 0x1b]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_IoBuildSynchronousFsdRequest]
test rax, rax
je 0x12e61
mov rdx, qword [rax + 0xb8]
sub rdx, 0x48
je 0x12e61
mov dword [rax + 0x30], 0xc00000bb
lea rcx, [rsp + 0xe0]
mov byte [rdx], 0x1b
mov qword [rdx + 0x10], rcx
mov byte [rdx + 1], 0xf
mov dword [rdx + 0x20], 0x40
mov dword [rdx + 8], r14d
mov dword [rdx + 0x18], r14d
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x12e61
lea rcx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
lea rdx, [0x00015150]
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x200], r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov edx, 0x20019
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x78], 0x40
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
mov r13d, eax
js 0x13097
mov qword [rsp + 0x1f0], r15
mov r15d, 1
mov qword [rsp + 0x238], rsi
nop
nop
nop
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, r15d
mov edx, r12d
mov dword [rsp + 0x20], r14d
xor dil, dil
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov edx, dword [rsp + 0x40]
mov r8d, 0x206b6444
mov ecx, r15d
add rdx, 8
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, dword [rsp + 0x40]
mov r8d, r15d
mov rsi, rax
lea rax, [rsp + 0x40]
mov edx, r12d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x48]
mov r9, rsi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
test eax, eax
mov r13d, eax
jns 0x12f66
movzx ebp, r15b
jmp 0x1306e
test bpl, bpl
jne 0x1306e
cmp dword [rsi + 4], 8
jne 0x1306e
lea rdx, [rsi + 0x14]
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
movzx r8d, r15b
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x00015140]
call qword [sym.imp.ntoskrnl.exe_strstr]
test rax, rax
je 0x13060
mov rcx, qword [rsp + 0x58]
lea rdx, [0x00015130]
call qword [sym.imp.ntoskrnl.exe_strstr]
test rax, rax
je 0x13060
mov r8d, dword [rsi + 8]
add r8, rsi
cmp dword [r8 + 4], 5
jne 0x13060
mov r10d, dword [r8 + 0x10]
test r10d, r10d
je 0x13060
mov r9d, dword [rsp + 0xf0]
lea rcx, [r8 + 0x14]
mov rdx, r10
nop
cmp byte [rcx], 3
jne 0x13019
cmp dword [rcx + 4], r9d
jne 0x13019
movzx eax, dil
test dil, dil
cmove eax, r15d
movzx edi, al
add rcx, 0x14
dec rdx
jne 0x13000
cmp dil, r15b
jne 0x13060
test r10d, r10d
mov edx, r14d
je 0x1305d
lea rcx, [r8 + 0x18]
cmp byte [rcx - 4], 2
jne 0x13051
mov eax, dword [rcx + 4]
mov dword [rbx + 0xc], eax
movzx eax, byte [rcx]
mov byte [rbx + 8], al
mov rax, qword [rcx + 8]
mov dword [rbx + 0x18], r14d
mov qword [rbx + 0x10], rax
inc edx
add rcx, 0x14
cmp edx, dword [r8 + 0x10]
jb 0x13033
mov bpl, r15b
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
inc r12d
test rsi, rsi
je 0x1307e
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test bpl, bpl
je 0x12ef0
mov r15, qword [rsp + 0x1f0]
mov rsi, qword [rsp + 0x238]
mov rcx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x1f8]
mov r12, qword [rsp + 0x208]
test rcx, rcx
mov rdi, qword [rsp + 0x210]
mov rbp, qword [rsp + 0x230]
mov rbx, qword [rsp + 0x228]
je 0x130cf
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, r13d
mov r13, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1e0]
call fcn.00014710
add rsp, 0x218
ret