Function at 0x7fff25d41f04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
and dword [rcx + 0x1c], 0
lea rax, [rbp + 0x60]
mov rdx, qword [rcx + 0x10]
lea r9, [rbp + 0x58]
and dword [rbp + 0x50], 0
lea r8, [rbp + 0x50]
and dword [rbp + 0x58], 0
mov rsi, rcx
mov rcx, qword [rcx + 8]
and dword [rbp + 0x60], 0
mov qword [rsp + 0x30], rax
call fcn.7fff25d4221c
test eax, eax
js 0x7fff25d4213c
mov r14d, dword [rbp + 0x58]
add r14d, dword [rbp + 0x50]
mov dword [rbp - 0x20], r14d
je 0x7fff25d4213a
mov rcx, qword gs:[0x60]
xor edx, edx
mov eax, r14d
mov ebx, r14d
shl rbx, 3
mov rcx, qword [rcx + 0x30]
mov r8, rbx
mov qword [rbp - 0x18], rax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x7fff25ddb196
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor edx, edx
mov rdi, rax
test rax, rax
je 0x7fff25ddb17a
mov r8, rbx
mov rcx, rax
call sub.ntdll.dll_memset
mov eax, dword [rbp + 0x60]
xor ebx, ebx
add eax, 0x10
mov dword [rbp - 0x28], eax
test r14d, r14d
je 0x7fff25d42022
mov r13d, eax
mov r12, rdi
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [r12], rax
test rax, rax
je 0x7fff25ddb1a0
inc ebx
add r12, 8
cmp ebx, r14d
jb 0x7fff25d41fec
mov r8, qword [rsi + 0x28]
test r8, r8
jne 0x7fff25ddb1d6
mov r14, qword [rsi + 8]
xor ebx, ebx
mov r12d, dword [rbp + 0x50]
mov qword [rsi + 0x28], r15
lea r13d, [rbx + 1]
xor r15d, r15d
test r12d, r12d
je 0x7fff25d420a5
mov esi, dword [rbp - 0x28]
mov r9, qword [rdi + rbx*8]
lea rcx, [rbp - 0x24]
and dword [rbp - 0x24], 0
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov edx, r15d
mov rcx, r14
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
test eax, eax
js 0x7fff25d42099
mov rax, qword [rdi + rbx*8]
mov edx, ebx
mov rcx, rdi
mov dword [rax], r15d
mov rax, qword [rdi + rbx*8]
mov dword [rax + 4], r13d
call fcn.7fff25d42164
test eax, eax
je 0x7fff25d42099
inc ebx
inc r15d
cmp r15d, r12d
jb 0x7fff25d4204c
mov rsi, qword [rbp + 0x48]
test r13d, r13d
jne 0x7fff25d4214e
mov r14d, dword [rbp - 0x20]
xor r8d, r8d
mov dword [rsi + 0x1c], ebx
test ebx, ebx
je 0x7fff25d420e3
mov rax, qword [rdi + r8*8]
mov rcx, qword [rsi + 0x28]
mov eax, dword [rax]
mov dword [rcx + r8*8], eax
mov rax, qword [rdi + r8*8]
mov rcx, qword [rsi + 0x28]
mov eax, dword [rax + 4]
mov dword [rcx + r8*8 + 4], eax
inc r8d
cmp r8d, dword [rsi + 0x1c]
jb 0x7fff25d420bc
test r14d, r14d
je 0x7fff25d4211c
mov rsi, qword [rbp - 0x18]
mov rbx, rdi
mov r8, qword [rbx]
test r8, r8
je 0x7fff25d42112
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
add rbx, 8
sub rsi, 1
jne 0x7fff25d420ef
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r14, qword [rsi + 0x10]
xor r13d, r13d
mov r12d, dword [rbp + 0x58]
jmp 0x7fff25d42041
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor edx, edx
mov rcx, qword gs:[0x60]
mov r8, r15
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, 0xc0000017
jmp 0x7fff25d4213c
or r14d, 0xffffffff
add ebx, r14d
je 0x7fff25ddb15a
lea rsi, [rdi + rbx*8]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsi]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rsi, [rsi - 8]
add ebx, r14d
jne 0x7fff25ddb1ad
jmp 0x7fff25ddb15a
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25d4202f