Function at 0x18df8
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x220
mov rax, qword [0x00065100]
xor rax, rsp
mov qword [rsp + 0x210], rax
xor r12d, r12d
lea rcx, [rsp + 0x68]
lea rdx, [0x000559f0]
lea r8d, [r12 + 0x22]
mov bpl, r12b
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
call fcn.000550e0
mov rax, qword [0x00055a20]
lea rdx, [rsp + 0x50]
lea r8d, [r12 + 0x7e]
lea rcx, [rsp + 0x92]
mov qword [rdx], rax
mov rax, qword [0x00055a28]
mov word [rsp + 0x90], r12w
mov qword [rdx + 8], rax
mov eax, dword [0x00055a30]
mov dword [rdx + 0x10], eax
xor edx, edx
call fcn.000554c0
mov edx, 0x800
xor ecx, ecx
mov r8d, 0x35353535
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r12
je 0x19105
lea r8, [rsp + 0x40]
lea rcx, str.RegistryMachineSYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
xor edx, edx
call fcn.0002ad00
cmp al, r12b
je 0x190fa
mov ebx, r12d
lea r13d, [r12 + 1]
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x190fa
lea rcx, [rsp + 0x48]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x190]
mov qword [rsp + 0x28], rcx
mov rcx, rdi
mov edx, ebx
mov dword [rsp + 0x20], eax
call fcn.0002aad4
cmp al, r12b
je 0x190fa
mov edi, 0x800
xor edx, edx
mov rcx, rsi
mov r8, rdi
call fcn.000554c0
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x190]
mov rdx, rdi
mov rcx, rsi
call fcn.00018aac
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, rsi
call fcn.000189dc
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.0002ad00
cmp al, r12b
jne 0x18f85
add ebx, r13d
jmp 0x18ece
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x110]
lea rdx, [0x00055a40]
mov r9d, 0x78
mov qword [rsp + 0x20], rax
call fcn.0002abd8
cmp al, r12b
je 0x18f7d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [rsp + 0x110]
lea rcx, [0x00055a60]
mov r8d, 0x12
mov qword [rsp + 0x38], r12
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0x12
je 0x19009
lea rdx, [rsp + 0x110]
lea rcx, [0x00055a80]
mov r8d, 0x28
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0x28
jne 0x18f7d
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.000554c0
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0x190]
mov rdx, rdi
mov rcx, rsi
call fcn.00018aac
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
call fcn.000189dc
mov rdx, qword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.0002ad00
cmp al, r12b
je 0x18f7d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x90]
lea rdx, [0x00055ab0]
mov r9d, 0x80
mov qword [rsp + 0x20], rax
call fcn.0002abd8
cmp al, r12b
je 0x190be
xor edx, edx
lea rcx, [0x00083290]
lea r8d, [rdx + 0x32]
call fcn.000554c0
lea rdx, [0x00083290]
lea rcx, [rsp + 0x90]
mov r8d, 0x32
call fcn.00018b8c
movzx ebp, bpl
cmp eax, r12d
cmovge ebp, r13d
mov rcx, qword [rsp + 0x38]
cmp rcx, r12
je 0x190d3
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x38], r12
add ebx, r13d
cmp bpl, r12b
je 0x18ece
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x00083290]
repne scasb al, byte [rdi]
not rcx
cmp rcx, r13
je 0x18ece
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
cmp rcx, r12
je 0x19115
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x40]
cmp rcx, r12
je 0x19125
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.00055060
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret