Function at 0x21040
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
xor eax, eax
xor r13d, r13d
lea rdx, [0x00025330]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], r13w
mov qword [rsp + 0x6a], rax
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
mov word [rsp + 0x78], r13w
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov word [rsp + 0x88], r13w
mov qword [rsp + 0x8a], rax
mov dword [rsp + 0x92], eax
mov word [rsp + 0x96], ax
mov word [rsp + 0x38], r13w
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
mov word [rsp + 0x48], r13w
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00025310]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00028590]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r14d, 0x400
mov r15d, 0x6020000
mov ecx, r15d
mov word [rsp + 0x38], r14w
mov word [rsp + 0x3a], r14w
call fcn.00024fc4
mov rcx, r14
call fcn.00012db4
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x21141
mov al, 1
jmp 0x2170b
mov ecx, r15d
mov word [rsp + 0x48], r14w
mov word [rsp + 0x4a], r14w
call fcn.00024fc4
mov rcx, r14
call fcn.00012db4
mov qword [rsp + 0x50], rax
cmp rax, r13
jne 0x21178
mov rcx, qword [rsp + 0x40]
mov edx, 0x4d746147
call fcn.00012ebc
jmp 0x2113a
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x120]
lea r8d, [rdx + 0x70]
call fcn.00025100
lea rax, [rsp + 0x1f0]
xor edx, edx
mov qword [rsp + 0x138], rax
mov eax, 4
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x140], eax
mov dword [rsp + 0x150], eax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x148], rax
lea rax, [0x000253d0]
lea r8d, [rdx + 0x28]
mov dword [rsp + 0x1f0], r13d
mov dword [rsp + 0x1f8], r13d
mov dword [rsp + 0x128], 0x20
mov qword [rsp + 0x130], rax
call fcn.00025100
lea rax, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
mov edx, 0x20019
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0xd0], 0x240
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x30], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x216d1
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea rax, [rsp + 0x1e0]
lea edx, [r9 + 2]
xor r8d, r8d
mov dword [rsp + 0x1e0], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r13d
jge 0x212f3
cmp eax, 0x80000005
je 0x212f3
cmp eax, 0xc0000023
je 0x212f3
mov rcx, qword [rsp + 0x40]
mov r11d, 0x4d746147
mov edx, r11d
call fcn.00012ebc
mov rcx, qword [rsp + 0x50]
mov edx, r11d
mov qword [rsp + 0x40], r13
call fcn.00012ebc
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], r13
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x2113a
mov eax, dword [rsp + 0x1e0]
cmp eax, r13d
je 0x212b9
cmp eax, r14d
ja 0x212b9
mov ecx, r15d
call fcn.00024fc4
mov r9d, dword [rsp + 0x1e0]
mov rcx, r9
cmp r9, r13
je 0x2132e
call fcn.00012db4
mov r9d, dword [rsp + 0x1e0]
mov rdi, rax
jmp 0x21331
mov rdi, r13
cmp rdi, r13
je 0x212b9
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r13d
jl 0x2171f
cmp dword [rsp + 0x1e0], r13d
je 0x2171f
mov r12b, r13b
mov ebp, r13d
cmp dword [rdi + 0x14], r13d
jbe 0x216b3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r13d
jge 0x213b9
cmp eax, 0x80000005
je 0x213b9
cmp eax, 0xc0000023
jne 0x216b3
mov eax, dword [rsp + 0x1e0]
cmp eax, r13d
je 0x216b3
cmp eax, r14d
ja 0x216b3
mov ecx, r15d
call fcn.00024fc4
mov r11d, dword [rsp + 0x1e0]
mov rcx, r11
cmp r11, r13
je 0x213fc
call fcn.00012db4
mov r11d, dword [rsp + 0x1e0]
mov rsi, rax
jmp 0x213ff
mov rsi, r13
cmp rsi, r13
je 0x216b3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r13d
jl 0x216a6
cmp dword [rsp + 0x1e0], r13d
je 0x216a6
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0xa8], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0xaa], ax
lea rax, [rsi + 0x10]
mov qword [rsp + 0xb0], rax
cmp cx, 0x14
jbe 0x21667
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x120]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp word [rsp + 0x48], r13w
je 0x21667
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
xor edx, edx
lea rcx, [rsp + 0xf0]
lea r8d, [rdx + 0x28]
call fcn.00025100
lea rax, [rsp + 0x38]
lea r8, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov edx, 0x20019
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x58], r13
mov dword [rsp + 0xe8], 0x30
mov qword [rsp + 0xf0], r13
mov dword [rsp + 0x100], 0x240
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x21667
mov rcx, qword [rsp + 0x58]
mov eax, 0x16
xor r9d, r9d
mov word [rsp + 0x98], ax
mov eax, 0x18
lea rdx, [rsp + 0x98]
mov word [rsp + 0x9a], ax
lea rax, [0x000285e0]
lea r8d, [r9 + 2]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1e8]
mov dword [rsp + 0x1e8], r13d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x215bc
cmp eax, 0x80000005
je 0x215bc
cmp eax, 0xc0000023
jne 0x2165c
mov ecx, r15d
mov r12b, 1
call fcn.00024fc4
mov r11d, dword [rsp + 0x1e8]
mov rcx, r11
cmp r11, r13
je 0x215e9
call fcn.00012db4
mov r11d, dword [rsp + 0x1e8]
mov rbx, rax
jmp 0x215ec
mov rbx, r13
cmp rbx, r13
je 0x21655
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, 2
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x60], r13d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x2163f
cmp dword [rbx + 4], 4
jne 0x2163f
cmp dword [rbx + 8], 4
jb 0x2163f
cmp dword [rbx + 0xc], 1
sete byte [0x0186def4]
jmp 0x21646
mov byte [0x0186def4], r13b
mov edx, 0x52454749
mov rcx, rbx
call fcn.00012ebc
jmp 0x2165c
mov byte [0x0186def4], r13b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 0x504249
mov rcx, rsi
call fcn.00012ebc
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
cmp r12b, r13b
jne 0x216b3
inc ebp
cmp ebp, dword [rdi + 0x14]
jb 0x2137d
jmp 0x216b3
mov edx, 0x504249
mov rcx, rsi
call fcn.00012ebc
mov edx, 0x504649
mov rcx, rdi
call fcn.00012ebc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or qword [rsp + 0x30], 0xffffffffffffffff
cmp word [rsp + 0x38], r13w
jbe 0x21701
mov rcx, qword [rsp + 0x40]
mov r11d, 0x4d746147
mov edx, r11d
call fcn.00012ebc
cmp word [rsp + 0x38], r13w
jbe 0x21701
mov rcx, qword [rsp + 0x50]
mov edx, r11d
call fcn.00012ebc
cmp byte [0x0186def4], r13b
setne al
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, 0x504649
mov rcx, rdi
call fcn.00012ebc
jmp 0x212b9