Function at 0x18000b8d0
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x190
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edi, edi
mov qword [rsp + 0x78], rdi
mov r15d, edi
mov qword [rsp + 0x60], rdi
mov qword [r11 - 0x118], rdi
mov qword [r11 - 0xc8], rdi
mov qword [r11 - 0xb8], rdi
mov qword [rsp + 0x70], rdi
lea rdx, str.REGISTRYMACHINESYSTEMCurrentControlSetServices
lea rcx, [r11 - 0xa0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, str.Performance
lea rcx, [rsp + 0xf8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop
mov ebx, 1
mov dword [rsp + 0x50], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x180094ff0]
lea rcx, str.EventLogLevel
call fcn.180004cdc
mov dword [rsp + 0x50], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x180096840]
lea rcx, str.ExtCounterTestLevel
call fcn.180004cdc
mov dword [rsp + 0x50], 0x2710
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x180094ff8]
lea rcx, str.OpenProcedureWaitTime
call fcn.180004cdc
mov dword [rsp + 0x50], 0x1d4c0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x180094ff4]
lea rcx, str.Library_Unload_Time
call fcn.180004cdc
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000ba1e
call qword [sym.imp.ntdll.dll_NtClose]
cmp qword [0x180096360], 0
jne 0x18000ba3d
lea rdx, str.Perflib
xor ecx, ecx
call sym.ADVAPI32.dll_RegisterEventSourceW
mov qword [0x180096360], rax
mov word [rsp + 0x58], di
mov ecx, 0x202
movzx eax, word [rsp + 0xfa]
add ax, cx
movzx ecx, ax
mov word [rsp + 0x5a], cx
call fcn.18000618c
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xb0], 0x40
lea rax, [rsp + 0x108]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb8], xmm0
lea r8, [rsp + 0x98]
mov edx, 0x20019
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
mov ecx, 0x218
call fcn.18000618c
mov rsi, rax
mov qword [rsp + 0x90], rax
mov ecx, 0x200
mov word [rsp + 0xda], cx
call fcn.18000618c
mov r13, rax
mov qword [rsp + 0xe0], rax
mov ecx, 0x100
mov word [rsp + 0xea], cx
call fcn.18000618c
mov r12, rax
mov qword [rsp + 0xf0], rax
test ebx, ebx
js 0x18000be2f
cmp qword [rsp + 0x60], 0
je 0x18000be2f
test rsi, rsi
je 0x18000be2f
test r13, r13
je 0x18000be2f
test rax, rax
je 0x18000be2f
mov dword [rsp + 0x88], edi
nop dword [rax]
test ebx, ebx
js 0x18000be2f
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x218
mov r9, rsi
xor r8d, r8d
mov edx, edi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
inc edi
mov dword [rsp + 0x88], edi
test eax, eax
js 0x18000be2f
movzx eax, word [rsi + 0xc]
lea ecx, [rax + 2]
cmp word [rsp + 0x5a], cx
jb 0x18000bc63
mov word [rsp + 0x58], ax
movzx r8d, ax
lea rdx, [rsi + 0x10]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.msvcrt.dll_memmove]
movzx eax, word [rsp + 0x58]
shr eax, 1
mov dword [rsp + 0x68], eax
lea r14, [rax + rax]
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov word [r14 + rax], cx
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov dword [rsp + 0x98], 0x30
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xb0], 0x40
lea rax, [rsp + 0x58]
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb8], xmm0
lea r8, [rsp + 0x98]
mov edx, 0x2001f
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test eax, eax
jns 0x18000bc53
lea r8, [rsp + 0x98]
mov edx, 0x20019
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov ebx, eax
test ebx, ebx
jns 0x18000bc6c
cmp ebx, 0xc0000034
jne 0x18000bd3f
xor eax, eax
mov ebx, eax
jmp 0x18000bb40
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov word [r14 + rax], cx
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.18000c7a0
test rax, rax
je 0x18000bcff
cmp byte [rax + 0x214], 0
je 0x18000bd2c
mov rcx, qword [0x180096348]
test rcx, rcx
je 0x18000bcc8
test r15, r15
je 0x18000bcea
mov qword [r15], rax
mov r15, rax
mov qword [rsp + 0xd0], rax
inc dword [0x180096344]
jmp 0x18000bc63
mov qword [0x180096348], rax
mov r15, rax
mov qword [rsp + 0xd0], rax
mov eax, 1
mov dword [0x180096344], eax
jmp 0x18000bc63
mov qword [rax], rcx
mov qword [0x180096348], rax
inc dword [0x180096344]
jmp 0x18000bc63
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18000bd2c
cmp byte [rcx + 0x19], 2
jb 0x18000bd2c
mov edx, 0x1f
lea r9, [rsp + 0x58]
lea r8, [0x180071e60]
mov rcx, qword [rcx + 0x10]
call fcn.180047274
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x18000bc63
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18000bd64
cmp byte [rcx + 0x19], 2
jb 0x18000bd64
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x58]
mov rcx, qword [rcx + 0x10]
call fcn.18004b9d4
lea r8, [0x1800965e8]
xor edx, edx
mov ecx, 0x800007d1
call fcn.18004b234
test eax, eax
je 0x18000bc63
cmp dword [0x180094ff0], 2
jl 0x18000bc63
xor r14d, r14d
mov dword [rsp + 0x68], r14d
mov ecx, ebx
call fcn.18000dc0c
mov dword [rsp + 0x118], eax
mov r9d, 1
mov ecx, r9d
mov dword [rsp + 0x68], ecx
cmp dword [0x180094ff0], 2
jl 0x18000bdc8
mov dword [rsp + 0x11c], ebx
mov ecx, 2
mov dword [rsp + 0x68], ecx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x140], rax
mov r10, qword [0x180096360]
test r10, r10
je 0x18000bc63
lea eax, [rcx*4]
xor r8d, r8d
lea edx, [r8 + 2]
lea rcx, [rsp + 0x118]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov word [rsp + 0x28], r9w
mov qword [rsp + 0x20], r14
mov r9d, 0x800007d1
mov rcx, r10
call sym.ADVAPI32.dll_ReportEventW
jmp 0x18000bc63
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18000be3f
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000be4e
call fcn.18000940c
test rsi, rsi
je 0x18000be5b
mov rcx, rsi
call fcn.18000940c
test r13, r13
je 0x18000be68
mov rcx, r13
call fcn.18000940c
test r12, r12
je 0x18000be75
mov rcx, r12
call fcn.18000940c
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180017170
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret