Function at 0x144e0
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x638
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov eax, 4
mov word [rsp + 0x40], ax
mov eax, 8
mov word [rsp + 0x1b8], ax
mov r8d, 0x4d6d4366
mov edx, 0xb0
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x5f0]
call fcn.0001b210
mov dword [rsp + 0x38], 0xffffffff
mov edx, 0x83c2
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x1ac], eax
mov rax, qword [0x00023598]
add rax, 0xfba
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.ntoskrnl.exe_KeQueryPriorityThread]
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x145b0
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x288
jge 0x14615
mov rax, qword [0x00023288]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1ac]
xor eax, 0xc0000013
add ecx, eax
mov rax, qword [rsp + 0x1d0]
mov byte [rax], cl
mov rax, qword [rsp + 0x1d0]
add rax, 1
mov qword [rsp + 0x1d0], rax
mov rax, qword [0x00023288]
add rax, 1
mov qword [0x00023288], rax
jmp 0x1459d
lea rcx, [0x000209c0]
call fcn.000128d0
mov r8b, 1
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlEqualUnicodeString]
mov rax, qword [0x00023598]
add rax, 0xeb3
mov qword [rsp + 0x1b0], rax
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x1466b
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x220
jge 0x146ec
mov rax, qword [0x00023290]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1ac]
xor eax, 0xc0000007
add ecx, eax
mov rax, qword [rsp + 0x1b0]
mov byte [rax], cl
lea r8, [0x00021110]
lea rdx, [0x00021130]
mov ecx, 0xef7a
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
mov rax, qword [rsp + 0x1b0]
add rax, 1
mov qword [rsp + 0x1b0], rax
mov rax, qword [0x00023290]
add rax, 1
mov qword [0x00023290], rax
jmp 0x14658
lea rcx, [0x0001bf70]
call fcn.00012f68
lea r8, [0x0001fe10]
lea rdx, [0x0001db80]
lea rcx, [0x0001ff70]
call fcn.000135ac
mov rax, qword [0x00023598]
add rax, 0x10ca
mov qword [rsp + 0x5e8], rax
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x14746
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x2a4
jge 0x147e3
lea rdx, [0x000210c0]
mov ecx, 0x8ee4
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov r11, qword [0x00023298]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x1ac], 0xc0000022
jne 0x14795
mov dword [rsp + 0x614], 0x3b
jmp 0x147a0
mov dword [rsp + 0x614], 0xbbd7
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x614]
mov rax, qword [rsp + 0x5e8]
mov byte [rax], cl
mov rax, qword [rsp + 0x5e8]
add rax, 1
mov qword [rsp + 0x5e8], rax
mov rax, qword [0x00023298]
add rax, 1
mov qword [0x00023298], rax
jmp 0x14733
mov dword [0x00023584], 0x79
call fcn.00013cb8
mov rax, qword [0x00023598]
add rax, 0xe1d
mov qword [rsp + 0x5e0], rax
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x14826
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x258
jge 0x148af
mov rax, qword [rsp + 0x640]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x1ac], 0xc0000022
jne 0x1485f
mov dword [rsp + 0x618], 0xcf
jmp 0x1486a
mov dword [rsp + 0x618], 0xa36f
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x618]
mov rax, qword [rsp + 0x5e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x5e0]
add rax, 1
mov qword [rsp + 0x5e0], rax
mov rax, qword [rsp + 0x640]
add rax, 1
mov qword [rsp + 0x640], rax
jmp 0x14813
mov rax, qword [sym.imp.ntoskrnl.exe_IoRemoveShareAccess]
mov qword [0x00023570], rax
mov dword [0x00023580], 0x72
call fcn.00013f88
mov rax, qword [0x00023598]
add rax, 0xf3b
mov qword [rsp + 0x1c8], rax
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x14900
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x1fc
jge 0x14965
mov rax, qword [0x000232a0]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1ac]
xor eax, 0xc0000085
add ecx, eax
mov rax, qword [rsp + 0x1c8]
mov byte [rax], cl
mov rax, qword [rsp + 0x1c8]
add rax, 1
mov qword [rsp + 0x1c8], rax
mov rax, qword [0x000232a0]
add rax, 1
mov qword [0x000232a0], rax
jmp 0x148ed
mov dword [rsp + 0x20], 0
mov r9d, 8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5f0]
call qword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
mov rax, qword [0x00023598]
add rax, 0x105c
mov qword [rsp + 0x1a0], rax
xor eax, eax
mov word [rsp + 0x610], ax
jmp 0x149ba
movzx eax, word [rsp + 0x610]
add eax, 4
mov word [rsp + 0x610], ax
movzx eax, word [rsp + 0x610]
cmp eax, 0x1b8
jge 0x14a1f
mov rax, qword [0x000232a8]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1ac]
xor eax, 0xc00000bf
add ecx, eax
mov rax, qword [rsp + 0x1a0]
mov byte [rax], cl
mov rax, qword [rsp + 0x1a0]
add rax, 1
mov qword [rsp + 0x1a0], rax
mov rax, qword [0x000232a8]
add rax, 1
mov qword [0x000232a8], rax
jmp 0x149a7
cmp qword [rsp + 0x30], 0
je 0x14a37
mov edx, 0x4d6d4366
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x638
ret