Function at 0x11478
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x100
and dword [rax + 8], 0
xor edx, edx
mov rbx, rcx
mov edi, 0x20000000
lea r8d, [rdx + 0x28]
mov dword [rcx + 0x2fc], edi
lea rcx, [rsp + 0x40]
call fcn.00021f50
mov eax, dword [rbx + 0x188]
mov rcx, qword [rbx + 0x28]
and dword [rsp + 0x40], 0
mov dword [rsp + 0x4c], eax
mov eax, dword [rbx + 0x190]
lea r8, [rbx + 0x2e0]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x54], eax
mov byte [rsp + 0x44], 1
mov byte [rsp + 0x45], 1
mov byte [rsp + 0x48], 1
mov byte [rsp + 0x4b], 0
mov byte [rsp + 0x4a], 0
mov dword [rsp + 0x60], edi
mov dword [rbx + 0x2e0], 0x20001
call qword [sym.imp.ntoskrnl.exe_IoGetDmaAdapter]
test rax, rax
mov qword [rbx + 0x38], rax
jne 0x11510
mov eax, 0xc0000001
jmp 0x11757
mov eax, dword [rbx + 0x2e0]
shl eax, 0xc
cmp eax, dword [rbx + 0x2fc]
jae 0x11527
mov dword [rbx + 0x2fc], eax
xor eax, eax
and qword [rbx + 0x480], rax
and dword [rbx + 0x488], eax
cmp qword [sym.imp.ntoskrnl.exe_Mm64BitPhysicalAddress], rax
mov qword [rsp + 0x138], rax
mov qword [rbx + 0x478], rax
je 0x11755
mov rcx, qword [rbx + 0x28]
lea r9, [rsp + 0x130]
lea edx, [rax + 2]
mov r8d, 0x20019
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
test eax, eax
js 0x11614
lea rdx, [0x00022490]
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x130]
lea r11, [rsp + 0x128]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x80]
lea rdx, [rsp + 0x68]
mov r8d, 1
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jne 0x11606
cmp dword [rsp + 0x8c], 4
ja 0x11606
mov eax, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x8c]
lea rcx, [rsp + 0x120]
lea rdx, [rsp + rax + 0x80]
call fcn.00022060
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [rsp + 0x120]
jmp 0x11668
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
call fcn.0001137c
lea rdx, [0x000224d0]
lea rcx, [rsp + 0x30]
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [rbx + 0x50], 4
je 0x11643
cmp dword [rbx + 0x50], 1
je 0x11643
mov dword [rsp + 0x28], 0xe0070006
jmp 0x1164b
mov dword [rsp + 0x28], 0xe0070002
mov r9, qword [rsp + 0x38]
movzx r8d, word [rsp + 0x30]
mov rcx, qword [rbx + 0x4b0]
xor edx, edx
mov dword [rsp + 0x20], edi
call fcn.00011768
test edi, edi
jne 0x11673
call fcn.0001137c
mov edi, eax
mov rcx, qword [rbx + 0x38]
lea r8, [rsp + 0x138]
xor r9d, r9d
mov rax, qword [rcx + 8]
mov edx, edi
mov r10, qword [rax + 0x10]
call r10
lea rcx, [rsp + 0x30]
test rax, rax
mov rsi, rax
je 0x11702
lea rdx, [0x00022510]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [rbx + 0x50], 4
je 0x116bf
cmp dword [rbx + 0x50], 1
je 0x116bf
mov dword [rsp + 0x28], 0x60070007
jmp 0x116c7
mov dword [rsp + 0x28], 0x60070003
mov r9, qword [rsp + 0x38]
movzx r8d, word [rsp + 0x30]
mov rcx, qword [rbx + 0x4b0]
xor edx, edx
mov dword [rsp + 0x20], edi
call fcn.00011768
mov rax, qword [rsp + 0x138]
mov qword [rbx + 0x480], rsi
mov qword [rbx + 0x478], rax
mov dword [rbx + 0x488], edi
jmp 0x1174a
lea rdx, [0x00022550]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [rbx + 0x50], 4
je 0x11725
cmp dword [rbx + 0x50], 1
je 0x11725
mov dword [rsp + 0x28], 0xe0070008
jmp 0x1172d
mov dword [rsp + 0x28], 0xe0070004
mov r9, qword [rsp + 0x38]
movzx r8d, word [rsp + 0x30]
mov rcx, qword [rbx + 0x4b0]
xor edx, edx
mov dword [rsp + 0x20], edi
call fcn.00011768
mov rcx, qword [rbx + 0x28]
mov edx, edi
call fcn.000113fc
xor eax, eax
add rsp, 0x100
pop rdi
pop rsi
pop rbx
ret