Function at 0x119d0
Capabilities:
Get file attributes
Query or enumerate registry value
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
add eax, 2
movsxd rdx, eax
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePool
mov qword [0x00027700], rax
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
add eax, 2
movsxd rcx, eax
mov rdi, qword [0x00027700]
xor eax, eax
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x110]
movzx ecx, word [rax]
mov rsi, qword [rsp + 0x110]
mov rdi, qword [0x00027700]
mov rsi, qword [rsi + 8]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
mov word [0x000276f8], ax
mov rax, qword [rsp + 0x110]
movzx eax, word [rax]
add eax, 2
mov word [0x000276fa], ax
mov dword [rsp + 0x68], 0
lea rdx, [0x00023980]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
lea r8, [rsp + 0x80]
mov edx, 0xf003f
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x11bb4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0xc0000023
jne 0x11ba9
mov edx, dword [rsp + 0x68]
mov ecx, 1
call sub.ntoskrnl.exe_ExAllocatePool
mov qword [0x000276f0], rax
cmp qword [0x000276f0], 0
je 0x11ba9
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
mov r9, qword [0x000276f0]
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jge 0x11ba9
xor edx, edx
mov rcx, qword [0x000276f0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x000276f0], 0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp qword [0x000276f0], 0
je 0x11da7
mov rdx, qword [0x000276f0]
add rdx, 0xc
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rdx, qword [0x000276f0]
add rdx, 0xc
lea rcx, [0x00027b78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x98], 0x40
lea rax, [rsp + 0x70]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xd8]
lea r8, [rsp + 0x80]
mov edx, 0x80000000
lea rcx, [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x11da7
mov dword [rsp + 0x20], 5
mov r9d, 0x18
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jl 0x11d99
mov eax, dword [rsp + 0xc0]
mov dword [0x000276e0], eax
mov edx, dword [0x000276e0]
xor ecx, ecx
call sub.ntoskrnl.exe_ExAllocatePool
mov qword [0x000276e8], rax
cmp qword [0x000276e8], 0
je 0x11d99
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [0x000276e0]
mov dword [rsp + 0x30], eax
mov rax, qword [0x000276e8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [rsp + 0xb0], eax
cmp dword [rsp + 0xb0], 0
jge 0x11d99
mov dword [0x000276e0], 0
xor edx, edx
mov rcx, qword [0x000276e8]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x000276e8], 0
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xf8
pop rdi
pop rsi
ret