Function at 0x16c98
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
xor eax, eax
mov rsi, rcx
xor ecx, ecx
mov word [rsp + 0x40], cx
mov qword [r11 - 0x66], rax
lea r8d, [rcx + 0x28]
mov rbx, rcx
mov qword [r11 - 0x70], rcx
mov dword [rsp + 0x30], ecx
mov ebp, ecx
mov dword [r11 + 0x18], ecx
mov dword [rsp + 0xc8], ecx
mov dword [r11 + 0x10], ecx
lea rcx, [r11 - 0x50]
xor edx, edx
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
call fcn.000407c0
mov edi, 0xc000000d
test rsi, rsi
je 0x16d11
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.0001676c
mov rbx, qword [rsp + 0x38]
jmp 0x16d13
mov eax, edi
xor esi, esi
cmp eax, esi
jl 0x16f8e
cmp rbx, rsi
je 0x16d45
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.000167d0
mov rbx, qword [rsp + 0x38]
mov ebp, dword [rsp + 0xc0]
mov edi, eax
cmp edi, esi
jl 0x16f73
cmp ebp, esi
jbe 0x16f60
mov rax, qword [0x0006a688]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
cmp rax, rsi
je 0x16d81
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], esi
call rax
jmp 0x16d9b
lea rax, [rsp + 0xb8]
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov edi, eax
cmp eax, 0xc0000023
jne 0x16f5b
mov esi, dword [rsp + 0xb8]
mov edi, 0x20
mov r8d, 0x6e65654b
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x16ddc
add edi, 0xffffffff
jne 0x16db4
xor esi, esi
mov rbx, rsi
jmp 0x16deb
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.000407c0
xor esi, esi
cmp rbx, rsi
je 0x16f56
mov r10, qword [0x0006a688]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb8]
xor r8d, r8d
xor edx, edx
mov r9, rbx
mov dword [rsp + 0x20], eax
cmp r10, rsi
je 0x16e2a
call r10
jmp 0x16e30
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, esi
mov edi, eax
jl 0x16f29
mov rax, qword [rsp + 0xb0]
mov dword [rsp + 0xc0], 0x20
movzx eax, word [rax]
add eax, dword [rbx + 0xc]
add rax, 2
mov qword [rsp + 0x30], rax
mov r8d, 0x6e65654b
mov rdx, rax
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
test rax, rax
jne 0x16e89
add dword [rsp + 0xc0], 0xffffffff
mov rax, qword [rsp + 0x30]
jne 0x16e5c
jmp 0x16e98
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov qword [rsp + 0x48], rsi
test rsi, rsi
je 0x16f27
movzx eax, word [rbx + 0xc]
mov rdi, qword [rsp + 0xb0]
mov rcx, rsi
movzx r8d, word [rdi]
mov rdx, qword [rdi + 8]
add ax, r8w
add ax, 2
mov word [rsp + 0x42], ax
mov word [rsp + 0x40], ax
call fcn.00040300
mov rax, qword [rsp + 0x48]
movzx r11d, word [rdi]
mov ecx, 0x5c
mov word [r11 + rax], cx
movzx r9d, word [rdi]
mov rax, qword [rsp + 0x48]
mov r8d, dword [rbx + 0xc]
lea rdx, [rbx + 0x10]
lea rcx, [r9 + rax + 2]
call fcn.00040300
lea rcx, [rsp + 0x40]
call fcn.00016c98
mov rcx, qword [rsp + 0x48]
mov edx, 0x6e65654b
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor esi, esi
mov qword [rsp + 0x48], rsi
jmp 0x16f29
xor esi, esi
mov edx, 0x6e65654b
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0xc8]
mov rbx, qword [rsp + 0x38]
inc eax
mov dword [rsp + 0xc8], eax
cmp eax, ebp
jb 0x16d55
jmp 0x16f60
mov edi, 0xc000009a
mov rbx, qword [rsp + 0x38]
cmp edi, esi
jl 0x16f73
mov rcx, rbx
call fcn.00016c64
mov rbx, qword [rsp + 0x38]
mov edi, eax
mov rax, qword [0x0006a6e0]
mov rcx, rbx
cmp rax, rsi
je 0x16f86
call rax
jmp 0x16f8c
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, edi
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret