Function at 0x12968
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x930
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x920], rax
xor r13d, r13d
mov rbx, rcx
lea rcx, [rsp + 0x120]
xor edx, edx
mov r8d, 0x800
mov edi, 0xc0000001
mov dword [rsp + 0x38], r13d
mov ebp, r13d
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x50], r13
call fcn.00091d10
lea rcx, [0x00092860]
call fcn.0004505c
cmp rbx, r13
jne 0x129e7
lea rcx, [0x00092880]
call fcn.0004505c
jmp 0x12ea9
call fcn.000133ac
call qword [sym.imp.ntoskrnl.exe_KeQueryTimeIncrement]
mov ecx, eax
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
imul rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
lea rcx, [rsp + 0x38]
sar rdx, 0xb
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movabs rax, 0x20c49ba5e353f7cf
imul rdx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbx + 0x869d4], rdx
lea rdx, [rbx + 0x869cc]
call fcn.00037450
mov r15d, 0xc0000000
mov ecx, eax
mov edi, eax
and ecx, r15d
cmp ecx, r15d
jne 0x12a73
mov edx, eax
lea rcx, [0x00092890]
jmp 0x12ea4
mov edi, dword [rsp + 0x38]
cmp edi, 0x601
jne 0x12a8b
mov dword [rbx + 0x869c8], 1
jmp 0x12ace
cmp edi, 0x602
je 0x12ac4
cmp edi, 0x603
je 0x12ac4
cmp edi, 0xa00
jne 0x12abb
cmp dword [rbx + 0x869cc], 0x55f0
jb 0x12ac4
mov dword [rbx + 0x869c8], 4
jmp 0x12ace
mov dword [rbx + 0x869c8], r13d
jmp 0x12ace
mov dword [rbx + 0x869c8], 2
mov r8d, dword [rbx + 0x869cc]
lea rcx, [0x000928c0]
mov edx, edi
call fcn.0004505c
mov edx, dword [rbx + 0x869c8]
mov r12, qword [rbx + 0xcc]
mov dword [rbx + 0x86a08], edx
lea rcx, [rsp + 0x70]
mov r8d, 0xa8
xor edx, edx
mov dword [rbx + 0x869c4], edi
mov dword [rbx + 0x869d0], 1
lea rsi, [rbx + 0x862cc]
mov dword [rsp + 0x30], r13d
call fcn.00091d10
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov edi, eax
and eax, r15d
cmp eax, r15d
je 0x12c2b
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, 0x20
lea rdx, [0x000962c0]
mov qword [rsp + 0x80], rdx
lea edx, [rcx - 0x1c]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x98], rax
lea rax, [0x000962d0]
mov dword [rsp + 0xc8], edx
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0xb0], ecx
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0xd8], edx
lea r8, [rsp + 0x70]
xor r9d, r9d
mov rdx, r12
xor ecx, ecx
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0x90], 1
mov dword [rsp + 0xa0], 0x64
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
mov edi, eax
and eax, r15d
cmp eax, r15d
je 0x12c2b
movzx eax, word [rsp + 0x40]
cmp ax, r13w
je 0x12c2b
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
je 0x12c2b
lea rcx, [rsp + 0x120]
movzx r8d, ax
call fcn.00091720
cmp rsi, r13
je 0x12c28
movzx eax, word [rsp + 0x30]
mov word [rsi], ax
mov edi, r13d
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, edi
mov qword [rsp + 0x48], r13
and eax, r15d
cmp eax, r15d
jne 0x12c53
mov edx, edi
lea rcx, [0x000928f0]
jmp 0x12ea4
movzx r8d, word [rsi]
lea rdx, [rsp + 0x120]
lea rcx, [0x00092920]
call fcn.0004505c
lea rcx, [rsp + 0x120]
call fcn.00031628
mov dword [rbx + 0x862c8], eax
cmp eax, r13d
jne 0x12c8f
lea rcx, [0x00092940]
jmp 0x129dd
cmp word [rsi], r13w
jbe 0x12e9a
mov eax, 0xffff
cmp word [rsi], ax
jae 0x12e9a
lea rdx, [rsp + 0x34]
lea rcx, [rbx + 0x86360]
mov dword [rsp + 0x34], 0x80
call fcn.00037754
cmp eax, r13d
mov edi, eax
jge 0x12d03
inc ebp
lea rcx, [0x000929b0]
mov r8d, eax
mov edx, ebp
call fcn.0004505c
lea r8, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x58], 0xfffffffffff0bdc0
call qword [sym.imp.ntoskrnl.exe_KeDelayExecutionThread]
mov edx, edi
and edx, r15d
cmp edx, r15d
jne 0x12d1d
cmp ebp, 0x32
jae 0x12d1d
jmp 0x12ca7
lea rdx, [rbx + 0x86360]
lea rcx, [0x00092980]
call fcn.0004505c
mov byte [rbx + 0x862c3], 1
mov r12d, 0x6c616e41
mov ebp, 0x258
xor ecx, ecx
mov r8d, r12d
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r13
jne 0x12d4a
lea rcx, [0x000929f0]
jmp 0x129dd
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00091d10
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov dword [rsp + 0x34], 0x12c
call fcn.00038ad4
cmp eax, r13d
jl 0x12dcc
mov rcx, rsi
call fcn.00031628
xor edx, edx
mov rcx, rsi
mov dword [rbx + 0x862dc], eax
call fcn.00036988
mov rbp, rax
cmp rax, r13
je 0x12dbe
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasb al, byte [rdi]
mov rdx, rbp
not rcx
lea r8, [rcx - 1]
lea rcx, [rbx + 0x862e0]
call fcn.00091720
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, r12d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x12dda
lea rcx, [0x00092a20]
mov edx, eax
call fcn.0004505c
lea rcx, [rbx + 0x869c0]
call fcn.00039654
cmp eax, r13d
mov edi, eax
jl 0x12e17
cmp dword [rbx + 0x869c0], r13d
je 0x12e00
mov dword [rbx + 0x869bc], 1
mov edx, dword [rbx + 0x869bc]
lea rcx, [0x00092a50]
mov r8d, edx
call fcn.0004505c
jmp 0x12e25
lea rcx, [0x00092a90]
mov edx, eax
call fcn.0004505c
mov esi, 0x80
mov r8d, r12d
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x862d0], rax
cmp rax, r13
jne 0x12e50
lea rcx, [0x00092ac0]
jmp 0x129dd
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov rcx, qword [rbx + 0x862d0]
xor edx, edx
lea r9d, [rdx + 0xa]
lea r8d, [rdx + 6]
call fcn.000341d8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rbx + 0x869e4]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov edi, r13d
jmp 0x12ea9
movzx edx, word [rsi]
lea rcx, [0x00092960]
call fcn.0004505c
lea rcx, [0x00092af0]
call fcn.0004505c
mov eax, edi
mov rcx, qword [rsp + 0x920]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x930]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret