Function at 0x140006ce0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
sub rsp, 0xa08
lea rcx, [rsp + 0x80]
lea rdx, str.RegistryMachineSYSTEMSetupAllowStartceipCommon
mov r8d, 0x6a
xor bpl, bpl
call fcn.14000a930
xor r12d, r12d
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov qword [rsp + 0xa28], r12
mov dword [0x14000e8a8], r12d
mov dword [0x14000e8ac], r12d
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
test eax, eax
js 0x140006fbb
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x9f8], rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
mov edi, 1
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0xa28]
mov edx, edi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x58], 0x40
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x140006fb3
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x100
call fcn.14000aca0
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x800
call fcn.14000aca0
lea r8, [0x14000b8fc]
lea rcx, [rsp + 0xf0]
mov edx, 0x100
call section..text
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0xa28]
lea r11, [rsp + 0xa20]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x1f0]
lea r8d, [r12 + 2]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x140006fb3
mov qword [rsp + 0xa30], rbx
mov qword [rsp + 0xa00], rsi
mov qword [rsp + 0x9f0], r13
lea r13, [0x14000ea40]
mov esi, edi
lea rbx, [0x14000e8b0]
nop word [rax + rax]
lea r8, str.RHH_d
lea rcx, [rsp + 0xf0]
mov r9d, esi
mov edx, 0x100
call section..text
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0xa28]
lea r11, [rsp + 0xa20]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x1f0]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x140006ef1
mov eax, dword [rsp + 0x1fc]
inc dword [0x14000e8a8]
add rbx, 4
xor eax, 0xae2d61b7
inc esi
cmp rbx, r13
mov dword [rbx - 4], eax
movzx ebp, dil
jl 0x140006e60
mov r13, qword [rsp + 0x9f0]
lea rbx, [0x14000ea40]
lea rsi, [0x14000ebd0]
nop word [rax + rax]
lea r8, str.RHP_d
lea rcx, [rsp + 0xf0]
mov r9d, edi
mov edx, 0x100
call section..text
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0xa28]
lea r11, [rsp + 0xa20]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x1f0]
lea rdx, [rsp + 0x30]
mov r8d, 2
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x140006fa3
movzx eax, word [rsp + 0x1fc]
inc dword [0x14000e8ac]
add rbx, 4
rol ax, 8
inc edi
cmp rbx, rsi
movzx eax, ax
mov bpl, 1
mov dword [rbx - 4], eax
jl 0x140006f10
mov rsi, qword [rsp + 0xa00]
mov rbx, qword [rsp + 0xa30]
mov rdi, qword [rsp + 0x9f8]
mov rcx, qword [rsp + 0xa28]
test rcx, rcx
je 0x140006fce
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc0000001
test bpl, bpl
cmovne eax, r12d
add rsp, 0xa08
pop r12
pop rbp
ret