Function at 0x133d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov rax, qword [0x0002b100]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor esi, esi
mov rbx, rcx
cmp rcx, rsi
je 0x1372b
cmp word [rcx], 0x4c
mov qword [0x0186cb50], rcx
jbe 0x1372b
mov rcx, qword [rcx + 8]
mov eax, dword [rcx + 0x46]
mov dword [0x0002b208], eax
movzx eax, word [rcx + 0x4a]
mov word [0x0002b20c], ax
mov rdi, qword [rbx + 8]
cmp rdi, rsi
je 0x1344c
movzx edx, word [rbx]
mov rcx, rdi
shr edx, 1
call fcn.000122d8
jmp 0x1344e
mov eax, esi
cmp eax, 0x28
jle 0x1372b
add eax, eax
mov ebp, 2
mov ecx, eax
shr rcx, 1
add rcx, rcx
lea rdx, [rcx + rdi - 2]
cmp word [rdx], 0x5c
je 0x13481
cmp word [rdx], 0x2f
je 0x13481
sub rdx, rbp
cmp rdx, rdi
jbe 0x13484
jmp 0x1346b
add rdx, rbp
sub rcx, rdx
mov r13d, 1
lea rcx, [rcx + rdi - 2]
sar rcx, 1
add ecx, r13d
cmp rdx, rsi
je 0x1372b
lea eax, [rcx - 1]
cmp eax, 0x63
ja 0x1372b
mov r8d, ecx
mov dword [0x0186cb4c], ecx
lea rcx, [0x0186cb60]
add r8, r8
call fcn.00024c10
lea r8d, [r13 + 0x27]
lea rcx, [rsp + 0x58]
xor edx, edx
call fcn.00025100
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x1372b
lea eax, [r13 + 0x11]
lea rcx, [rsp + 0x81]
xor edx, edx
mov word [rsp + 0x40], ax
lea eax, [r13 + 0x13]
mov r8d, 0x3ff
mov word [rsp + 0x42], ax
lea rax, [0x00025550]
mov byte [rsp + 0x80], sil
mov qword [rsp + 0x48], rax
call fcn.00025100
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebp
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
je 0x13720
mov eax, dword [rsp + 0x3c]
cmp eax, esi
je 0x13720
cmp eax, 0x400
jae 0x13720
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x30]
mov r8d, ebp
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, esi
jl 0x13720
mov eax, dword [rsp + 0x38]
add eax, 0xfffffff4
cmp eax, 0x3d3
ja 0x13720
mov ecx, dword [rsp + 0x88]
cmp ecx, 0x3e0
ja 0x13720
cmp ecx, 0x206
ja 0x13720
mov eax, ecx
mov r8, rcx
lea r12, [0x0186cd70]
shr eax, 1
lea rdx, [rsp + 0x8c]
mov rcx, r12
mov dword [0x0186cb58], eax
call fcn.00024c10
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r8d, dword [0x0186cb58]
mov ecx, esi
cmp r8d, esi
jbe 0x13657
mov rax, r12
cmp word [rax], 0x3a
je 0x13657
add ecx, r13d
add rax, rbp
cmp ecx, r8d
jb 0x13646
cmp ecx, r8d
je 0x1372b
or r10d, 0xffffffff
mov edx, r8d
add ecx, r10d
sub edx, ecx
movsxd rax, ecx
cmp edx, esi
jbe 0x1368e
mov rcx, r12
lea rdi, [r12 + rax*2]
mov r9d, edx
movzx eax, word [rdi]
add rdi, rbp
mov word [rcx], ax
add rcx, rbp
sub r9, r13
jne 0x1367d
movsxd rax, edx
cmp edx, r8d
jae 0x136b9
lea rdi, [r12 + rax*2]
sub r8d, edx
movzx eax, si
mov ecx, r8d
rep stosw word [rdi], ax
jmp 0x136b9
dec edx
mov eax, edx
cmp word [r12 + rdx*2], 0x5c
je 0x136c3
mov word [r12 + rdx*2], si
mov dword [0x0186cb58], edx
cmp edx, esi
ja 0x136a8
lea rdi, [0x0186cf80]
mov qword [0x0186d198], rdi
movzx ecx, word [rbx]
shr ecx, 1
sub ecx, r13d
je 0x136f2
mov rdx, qword [rbx + 8]
cmp word [rdx + rcx*2], 0x5c
mov eax, ecx
je 0x136ef
add ecx, r10d
jne 0x136df
jmp 0x136f2
add ecx, r10d
add cx, r13w
add cx, cx
mov word [0x0186d190], cx
movzx r8d, cx
lea edx, [rbp + rcx]
mov rcx, rdi
mov word [0x0186d192], dx
mov rdx, qword [rbx + 8]
call fcn.00024c10
mov al, r13b
jmp 0x1372d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor al, al
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.00024bb0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret