Function at 0x1524c
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x328
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x1b0]
call fcn.0001b210
mov dword [rsp + 0x2f0], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x288], eax
lea rdx, [0x00021170]
mov ecx, 0xbd56
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov rax, qword [0x00023598]
add rax, 0x18d6
mov qword [rsp + 0x2e0], rax
xor eax, eax
mov word [rsp + 0x300], ax
jmp RtlCheckRegistryKey
movzx eax, word [rsp + 0x300]
add eax, 4
mov word [rsp + 0x300], ax
movzx eax, word [rsp + 0x300]
cmp eax, 0x28c
jge 0x15360
mov rax, qword [rsp + 0x330]
mov al, byte [rax]
mov byte [0x000235a4], al
mov rax, qword [sym.imp.ntoskrnl.exe_IoRemoveShareAccess]
mov qword [0x00023570], rax
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x288]
xor eax, 0xc0000088
add ecx, eax
mov rax, qword [rsp + 0x2e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x2e0]
add rax, 1
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x330]
add rax, 1
mov qword [rsp + 0x330], rax
jmp 0x152d4
mov rax, qword [0x00023598]
add rax, 0x1979
mov qword [rsp + 0x2d8], rax
xor eax, eax
mov word [rsp + 0x300], ax
jmp 0x15394
movzx eax, word [rsp + 0x300]
add eax, 4
mov word [rsp + 0x300], ax
movzx eax, word [rsp + 0x300]
cmp eax, 0x2a0
jge 0x15444
mov rax, qword [0x000232e0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x288], 0xc0000022
jne 0x153d0
mov dword [rsp + 0x304], 0xc4
jmp 0x153db
mov dword [rsp + 0x304], 0x7054
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x304]
mov rax, qword [rsp + 0x2d8]
mov byte [rax], cl
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.ntoskrnl.exe_IoSetHardErrorOrVerifyDevice]
mov rax, qword [rsp + 0x2d8]
add rax, 1
mov qword [rsp + 0x2d8], rax
xor r8d, r8d
mov edx, 4
mov ecx, 0xff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuerySetVolumeInformation]
mov rax, qword [0x000232e0]
add rax, 1
mov qword [0x000232e0], rax
jmp MmProtectMdlSystemAddress
mov rax, qword [0x00023598]
add rax, 0x1a21
mov qword [rsp + 0x2f8], rax
lea r8, [rsp + 0x2d0]
xor edx, edx
lea rcx, [rsp + 0x198]
call qword [sym.imp.ntoskrnl.exe_IoCheckEaBufferValidity]
xor eax, eax
mov word [rsp + 0x300], ax
jmp 0x15490
movzx eax, word [rsp + 0x300]
add eax, 4
mov word [rsp + 0x300], ax
movzx eax, word [rsp + 0x300]
cmp eax, 0x23c
jge 0x15516
mov rax, qword [0x000232e8]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x288], 0xc0000022
jne 0x154c8
mov dword [rsp + 0x308], 0x5d
jmp IoCheckQuotaBufferValidity
mov dword [rsp + 0x308], 0xe499
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x308]
mov rax, qword [rsp + 0x2f8]
mov byte [rax], cl
mov rax, qword [rsp + 0x2f8]
add rax, 1
mov qword [rsp + 0x2f8], rax
mov rax, qword [0x000232e8]
add rax, 1
mov qword [0x000232e8], rax
jmp KeBugCheckEx
mov qword [rsp + 0x30], 0
mov qword [rsp + ExQueryPoolBlockSizex28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x290]
call qword [sym.imp.ntoskrnl.exe_IoCsqInitialize]
mov rax, qword [0x00023598]
add rax, 0x1ab0
mov qword [rsp + 0x280], rax
xor eax, eax
mov word [rsp + 0x300], ax
jmp KeNumberProcessors
movzx eax, word [rsp + 0x300]
add eax, 4
mov word [rsp + 0x300], ax
movzx eax, word [rsp + 0x300]
cmp eax, 0x28c
jge 0x155e0
mov rax, qword [0x000232f0]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x288]
xor eax, 0xc00000ea
add ecx, eax
mov rax, qword [rsp + 0x280]
mov byte [rax], cl
mov rax, qword [rsp + 0x280]
add rax, 1
mov qword [rsp + 0x280], rax
mov rax, qword [0x000232f0]
add rax, 1
mov qword [0x000232f0], rax
jmp 0x15568
mov rax, qword [0x00023598]
add rax, 0x1b53
mov qword [rsp + 0x2e8], rax
xor eax, eax
mov word [rsp + 0x300], ax
jmp 0x15614
movzx eax, word [rsp + 0x300]
add eax, 4
mov word [rsp + 0x300], ax
movzx eax, word [rsp + 0x300]
cmp eax, 0x1fc
jge 0x1569a
mov rax, qword [0x000232f8]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x288], 0xc0000022
jne 0x1564c
mov dword [rsp + 0x30c], 0x17
jmp 0x15657
mov dword [rsp + 0x30c], 0xae8e
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x30c]
mov rax, qword [rsp + 0x2e8]
mov byte [rax], cl
mov rax, qword [rsp + 0x2e8]
add rax, 1
mov qword [rsp + 0x2e8], rax
mov rax, qword [0x000232f8]
add rax, 1
mov qword [0x000232f8], rax
jmp 0x15601
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x328
ret