Function at 0x140014f0c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rdx
mov r12, rcx
xor ebp, ebp
mov r14d, 0x118
mov edx, r14d
mov dword [rax + 0x18], ebp
mov r8d, 0x75417953
mov ecx, 0x400
mov esi, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140012180], bpl
mov rdi, rax
jne 0x140015032
test rax, rax
je 0x14001503b
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140009c00
mov r15d, ebp
lea rax, [rsp + 0x80]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, r15d
mov dword [rsp + 0x20], r14d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
je 0x140015176
cmp eax, 0xc0000023
je 0x140015045
cmp eax, 0x80000005
je 0x140015045
test eax, eax
js 0x140015157
mov ebx, dword [rdi + 0x10]
mov r8d, 0x75417953
mov ecx, 0x400
lea rdx, [rbx + 4]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140012180], bpl
mov rsi, rax
jne 0x140015001
test rax, rax
je 0x140015001
lea r8, [rbx + 4]
xor edx, edx
mov rcx, rax
call fcn.140009c00
mov edx, dword [rdi + 0x10]
mov r8d, 0x7ffffffe
lea rcx, [rdx + 4]
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, r8
ja 0x140015116
shr rdx, 1
cmp rdx, r8
jbe 0x1400150da
mov word [rsi], bp
jmp 0x140015116
test rax, rax
jne 0x140014f75
mov ebx, 0xc000009a
jmp 0x14001518b
mov ebx, 0x75417953
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r14d, dword [rsp + 0x80]
mov r8d, ebx
mov edx, r14d
mov ecx, 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140012180], 0
mov rbx, rax
mov rdi, rax
jne 0x1400150cc
test rax, rax
je 0x1400150cc
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.140009c00
xor ebp, ebp
lea rax, [rsp + 0x80]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, r15d
mov dword [rsp + 0x20], r14d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
jne 0x140014fc2
mov ebx, ebp
jmp 0x14001517d
xor ebp, ebp
test rbx, rbx
jne 0x140015091
mov ebx, 0xc000009a
jmp 0x140015157
sub rdx, rcx
mov r9, rdi
sub r9, rsi
mov r8, rsi
lea rax, [rdx + rcx]
test rax, rax
je 0x140015108
movzx eax, word [r9 + r8 + 0x14]
test ax, ax
je 0x140015108
mov word [r8], ax
add r8, 2
sub rcx, 1
jne 0x1400150e6
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
mov word [rax], bp
mov eax, dword [rdi + 0x10]
lea rcx, [rsp + 0x30]
shr rax, 1
mov rdx, rsi
mov word [rsi + rax*2], bp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [rdi + 8]
lea rdx, [rsp + 0x30]
mov eax, dword [rdi + 0xc]
add rcx, rdi
mov r9d, dword [rdi + 4]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test rsi, rsi
je 0x14001516a
mov edx, 0x75417953
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
js 0x140015178
inc r15d
jmp 0x140014f78
mov ebx, ebp
test rdi, rdi
je 0x14001518b
mov edx, 0x75417953
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret