Function at 0x2a43c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov eax, 0x80
xor r15d, r15d
mov rdi, rcx
mov qword [rsp + 0xc8], rcx
mov rsi, rdx
lea rcx, [rsp + 0x170]
mov r8, rax
xor edx, edx
mov ebx, 0xc0000001
mov r14, r15
mov r12, r15
mov r13, r15
mov dword [rsp + 0xb0], eax
call fcn.00091d10
lea rcx, [rsp + 0x1f0]
xor edx, edx
mov r8d, 0x12c
call fcn.00091d10
cmp rdi, r15
je 0x2abf1
cmp rsi, r15
je 0x2abf1
mov rdi, r15
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
cmp rax, r15
je 0x2a4e6
jmp 0x2a4e1
add rdi, qword [rax + 8]
add rax, 0x10
cmp qword [rax], r15
jne 0x2a4d9
sar rdi, 0x14
lea rax, [rsp + 0xb0]
mov ebp, r15d
mov qword [rsp + 0xd0], rdi
cmp rax, r15
je 0x2a640
lea rcx, [rsp + 0xf0]
xor edx, edx
mov r8d, 0x80
call fcn.00091d10
mov ecx, 0x80000000
call fcn.00091684
mov ecx, 0x80000004
cmp rax, rcx
jl 0x2a640
mov ecx, 0x80000002
call fcn.00091684
mov rbx, rax
call fcn.0009168b
mov rdi, rax
call fcn.0009168f
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf4], rdi
mov qword [rsp + 0xf8], rax
call fcn.00091693
mov ecx, 0x80000003
mov qword [rsp + 0xfc], rax
call fcn.00091684
mov rbx, rax
call fcn.0009168b
mov rdi, rax
call fcn.0009168f
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x104], rdi
mov qword [rsp + 0x108], rax
call fcn.00091693
mov ecx, 0x80000004
mov qword [rsp + 0x10c], rax
call fcn.00091684
mov rbx, rax
call fcn.0009168b
mov rdi, rax
call fcn.0009168f
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x114], rdi
mov qword [rsp + 0x118], rax
call fcn.00091693
cmp byte [rsp + 0xf0], 0x20
mov qword [rsp + 0x11c], rax
jne 0x2a60c
lea rax, [rsp + 0xf0]
inc rax
inc ebp
cmp byte [rax], 0x20
je 0x2a602
or rcx, 0xffffffffffffffff
mov eax, ebp
lea rdx, [rsp + rax + 0xf0]
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp dword [rsp + 0xb0], ecx
jb 0x2a640
mov r8d, ecx
lea rcx, [rsp + 0x170]
call fcn.00091720
lea rax, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0x12c
mov ebp, r15d
test rax, rax
je 0x2a732
mov edx, 0x10000
mov ecx, 0xf0000
mov r8d, 1
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov rbx, rax
test rax, rax
je 0x2a732
mov r10d, dword [0x00096040]
xor r9b, r9b
mov rdx, rax
xor r8d, r8d
cmp dword [r8 + rbx], r10d
jne 0x2a6d8
mov edi, dword [rdx + 0x10]
lea rcx, [0x00096050]
cmp edi, dword [rcx]
jne 0x2a6b3
mov dil, byte [rdx + 0x14]
cmp dil, byte [rcx + 4]
jne 0x2a6b3
xor eax, eax
jmp 0x2a6b8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x2a6d8
movzx ecx, byte [rdx + 5]
test ecx, ecx
je 0x2a6d3
mov rax, rdx
add r9b, byte [rax]
inc rax
sub rcx, 1
jne 0x2a6c7
test r9b, r9b
je 0x2a6eb
add r8d, 0x10
add rdx, 0x10
cmp r8d, 0xfff1
jae 0x2a714
jmp 0x2a691
test rdx, rdx
je 0x2a714
mov ecx, dword [rdx + 0x18]
movzx ebp, word [rdx + 0x16]
test rcx, rcx
je 0x2a714
test ebp, ebp
je 0x2a714
mov edx, 0x10000
mov r8d, 1
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov r15, rax
mov edx, 0x10000
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
test r15, r15
je 0x2a732
mov edx, ebp
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_MmUnmapIoSpace]
lea rcx, [rsp + 0xd8]
call fcn.000374f4
mov ebp, 0xc0000000
mov edx, eax
and eax, ebp
cmp eax, ebp
jne 0x2a75a
lea rcx, [0x000953c0]
call fcn.0004505c
jmp 0x2a789
mov rcx, qword [rsp + 0xe0]
xor edx, edx
call fcn.00036988
lea rcx, [rsp + 0xd8]
mov r12, rax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [0x000953f0]
mov rdx, r12
call fcn.0004505c
xor edx, edx
lea rcx, [rsp + 0xf0]
lea r8d, [rdx + 0x70]
call fcn.00091d10
mov edi, 2
lea rdx, [0x000960e0]
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov ebx, eax
and eax, ebp
cmp eax, ebp
je 0x2a842
lea rcx, [rsp + 0xb8]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [0x00096120]
xor r15d, r15d
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0xb8]
lea r8, [rsp + 0xf0]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xb8]
lea rdx, [0x000960e0]
xor r9d, r9d
mov ecx, edi
mov dword [rsp + 0xf8], 0x20
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x110], 1
mov dword [rsp + 0x120], 0x80
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
mov ebx, eax
jmp 0x2a845
xor r15d, r15d
mov eax, ebx
and eax, ebp
cmp eax, ebp
jne 0x2a85d
lea rcx, [0x00095420]
mov edx, ebx
call fcn.0004505c
jmp 0x2a88c
mov rcx, qword [rsp + 0xc0]
xor edx, edx
call fcn.00036988
lea rcx, [rsp + 0xb8]
mov r13, rax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
lea rcx, [0x00095450]
mov rdx, r13
call fcn.0004505c
cmp byte [rsi + 0x862c3], r15b
jne 0x2a8e8
lea rdx, [rsp + 0xb0]
lea rcx, [rsi + 0x86360]
mov dword [rsp + 0xb0], 0x80
call fcn.00037754
mov ecx, eax
mov ebx, eax
and ecx, ebp
cmp ecx, ebp
jne 0x2a8ce
lea rcx, [0x00095480]
mov edx, eax
call fcn.0004505c
jmp 0x2a8e8
lea rdx, [rsi + 0x86360]
lea rcx, [0x00092980]
call fcn.0004505c
mov byte [rsi + 0x862c3], 1
cmp dword [rsi + 0x862dc], r15d
je 0x2a910
or rcx, 0xffffffffffffffff
xor eax, eax
lea rbp, [rsi + 0x862e0]
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x2a9f9
mov edi, 0x258
mov r8d, 0x6c616e41
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
cmp rax, r15
jne 0x2a93f
lea rcx, [0x000929f0]
call fcn.0004505c
jmp 0x2abff
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00091d10
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov dword [rsp + 0xb0], 0x12c
call fcn.00038ad4
mov ecx, 0xc0000000
mov ebx, eax
and eax, ecx
cmp eax, ecx
je 0x2abe8
cmp dword [rsp + 0xb0], 5
jb 0x2abe8
mov rcx, rbp
call fcn.00031628
xor edx, edx
mov rcx, rbp
mov dword [rsi + 0x862dc], eax
call fcn.00036988
mov rbx, rax
cmp rax, r15
je 0x2a9d5
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
mov rdx, rbx
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x862e0]
call fcn.00091720
mov edx, 0x6c616e41
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x6c616e41
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rbp, [rsi + 0x862e0]
lea rcx, [0x000954b0]
mov rdx, rbp
call fcn.0004505c
lea rcx, [rsi + 0x869c0]
call fcn.00039654
mov ecx, 0xc0000000
mov ebx, eax
and eax, ecx
cmp eax, ecx
jne 0x2aa22
lea rcx, [0x00092a90]
mov edx, ebx
call fcn.0004505c
jmp 0x2aa4a
cmp dword [rsi + 0x869c0], r15d
je 0x2aa35
mov dword [rsi + 0x869bc], 1
mov edx, dword [rsi + 0x869bc]
lea rcx, [0x00092a50]
mov r8d, edx
call fcn.0004505c
mov edi, 0x400
mov r8d, 0x6c616e41
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
cmp rax, r15
jne 0x2aa74
lea rcx, [0x000954e0]
jmp 0x2a935
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov r9d, dword [rsi + 0x869bc]
lea rax, [rsi + 0x86638]
mov qword [rsp + 0xa0], rax
lea rax, [0x00095510]
lea rcx, [rsi + 0x86360]
mov qword [rsp + 0x98], rax
mov rax, qword [rsi + 0x862d0]
lea r8, [0x00095530]
mov qword [rsp + 0x90], rax
mov rax, qword [rsi + 0x869d4]
mov rdx, rdi
mov qword [rsp + 0x88], rax
mov eax, dword [rsi + 0x862d8]
mov qword [rsp + 0x80], r15
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0xd0]
mov dword [rsp + 0x70], 0x3e8
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x170]
mov qword [rsp + 0x50], rax
mov eax, dword [rsi + 0x869d0]
mov dword [rsp + 0x48], eax
mov eax, dword [rsi + 0x869cc]
mov dword [rsp + 0x40], eax
mov eax, dword [rsi + 0x869c8]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov rcx, r14
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r13
call fcn.000183c0
inc dword [rsi + 0x862d8]
lea rcx, [0x00095640]
mov rdx, r14
call fcn.0004505c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
lea r8d, [rax + 2]
mov r9, r14
repne scasb al, byte [rdi]
mov dl, 1
not rcx
dec rcx
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xc8]
call fcn.0002ac6c
mov ecx, 0xc0000000
mov ebx, eax
and eax, ecx
cmp eax, ecx
jne 0x2aba6
lea rcx, [0x00095650]
jmp 0x2abf8
cmp r13, r15
je 0x2abbc
mov edx, 0x6c616e41
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r13, r15
cmp r12, r15
je 0x2abd2
mov edx, 0x6c616e41
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r12, r15
mov edx, 0x6c616e41
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r14, r15
mov ebx, r15d
jmp 0x2abff
lea rcx, [0x00092a20]
jmp 0x2abf8
lea rcx, [0x00095390]
mov edx, ebx
call fcn.0004505c
cmp r13, r15
je 0x2ac12
mov edx, 0x6c616e41
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r12, r15
je 0x2ac25
mov edx, 0x6c616e41
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r14, r15
je 0x2ac38
mov edx, 0x6c616e41
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.000916b0
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret