Function at 0x20948
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
xor eax, eax
xor r13d, r13d
lea rdx, [0x00025330]
lea rcx, [rsp + 0x68]
mov word [rsp + 0x68], r13w
mov qword [rsp + 0x6a], rax
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
mov word [rsp + 0x78], r13w
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov word [rsp + 0x88], r13w
mov qword [rsp + 0x8a], rax
mov dword [rsp + 0x92], eax
mov word [rsp + 0x96], ax
mov word [rsp + 0x38], r13w
mov qword [rsp + 0x3a], rax
mov dword [rsp + 0x42], eax
mov word [rsp + 0x46], ax
mov word [rsp + 0x48], r13w
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00025310]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00028590]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r14d, 0x400
mov r15d, 0x6020000
mov ecx, r15d
mov word [rsp + 0x38], r14w
mov word [rsp + 0x3a], r14w
call fcn.00024fc4
mov rcx, r14
call fcn.00012db4
mov qword [rsp + 0x40], rax
cmp rax, r13
jne 0x20a49
mov al, 1
jmp 0x21013
mov ecx, r15d
mov word [rsp + 0x48], r14w
mov word [rsp + 0x4a], r14w
call fcn.00024fc4
mov rcx, r14
call fcn.00012db4
mov qword [rsp + 0x50], rax
cmp rax, r13
jne 0x20a80
mov rcx, qword [rsp + 0x40]
mov edx, 0x4d746147
call fcn.00012ebc
jmp 0x20a42
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x120]
lea r8d, [rdx + 0x70]
call fcn.00025100
lea rax, [rsp + 0x1f0]
xor edx, edx
mov qword [rsp + 0x138], rax
mov eax, 4
lea rcx, [rsp + 0xc0]
mov dword [rsp + 0x140], eax
mov dword [rsp + 0x150], eax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x148], rax
lea rax, [0x000253d0]
lea r8d, [rdx + 0x28]
mov dword [rsp + 0x1f0], r13d
mov dword [rsp + 0x1f8], r13d
mov dword [rsp + 0x128], 0x20
mov qword [rsp + 0x130], rax
call fcn.00025100
lea rax, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0x30]
mov edx, 0x20019
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0xd0], 0x240
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x30], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x20fd9
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
lea rax, [rsp + 0x1e0]
lea edx, [r9 + 2]
xor r8d, r8d
mov dword [rsp + 0x1e0], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r13d
jge 0x20bfb
cmp eax, 0x80000005
je 0x20bfb
cmp eax, 0xc0000023
je 0x20bfb
mov rcx, qword [rsp + 0x40]
mov r11d, 0x4d746147
mov edx, r11d
call fcn.00012ebc
mov rcx, qword [rsp + 0x50]
mov edx, r11d
mov qword [rsp + 0x40], r13
call fcn.00012ebc
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], r13
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x20a42
mov eax, dword [rsp + 0x1e0]
cmp eax, r13d
je 0x20bc1
cmp eax, r14d
ja 0x20bc1
mov ecx, r15d
call fcn.00024fc4
mov r9d, dword [rsp + 0x1e0]
mov rcx, r9
cmp r9, r13
je 0x20c36
call fcn.00012db4
mov r9d, dword [rsp + 0x1e0]
mov rdi, rax
jmp 0x20c39
mov rdi, r13
cmp rdi, r13
je 0x20bc1
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r13d
jl 0x21027
cmp dword [rsp + 0x1e0], r13d
je 0x21027
mov r12b, r13b
mov ebp, r13d
cmp dword [rdi + 0x14], r13d
jbe 0x20fbb
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r13d
jge 0x20cc1
cmp eax, 0x80000005
je 0x20cc1
cmp eax, 0xc0000023
jne 0x20fbb
mov eax, dword [rsp + 0x1e0]
cmp eax, r13d
je 0x20fbb
cmp eax, r14d
ja 0x20fbb
mov ecx, r15d
call fcn.00024fc4
mov r11d, dword [rsp + 0x1e0]
mov rcx, r11
cmp r11, r13
je 0x20d04
call fcn.00012db4
mov r11d, dword [rsp + 0x1e0]
mov rsi, rax
jmp 0x20d07
mov rsi, r13
cmp rsi, r13
je 0x20fbb
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x1e0]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, ebp
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r13d
jl 0x20fae
cmp dword [rsp + 0x1e0], r13d
je 0x20fae
movzx ecx, word [rsi + 0xc]
mov word [rsp + 0xa8], cx
movzx eax, word [rsi + 0xc]
mov word [rsp + 0xaa], ax
lea rax, [rsi + 0x10]
mov qword [rsp + 0xb0], rax
cmp cx, 0x14
jbe 0x20f6f
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x120]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp word [rsp + 0x48], r13w
je 0x20f6f
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
xor edx, edx
lea rcx, [rsp + 0xf0]
lea r8d, [rdx + 0x28]
call fcn.00025100
lea rax, [rsp + 0x38]
lea r8, [rsp + 0xe8]
lea rcx, [rsp + 0x58]
mov edx, 0x20019
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x58], r13
mov dword [rsp + 0xe8], 0x30
mov qword [rsp + 0xf0], r13
mov dword [rsp + 0x100], 0x240
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x20f6f
mov rcx, qword [rsp + 0x58]
mov eax, 0x10
xor r9d, r9d
mov word [rsp + 0x98], ax
mov eax, 0x12
lea rdx, [rsp + 0x98]
mov word [rsp + 0x9a], ax
lea rax, [0x000285c0]
lea r8d, [r9 + 2]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1e8]
mov dword [rsp + 0x1e8], r13d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x20ec4
cmp eax, 0x80000005
je 0x20ec4
cmp eax, 0xc0000023
jne 0x20f64
mov ecx, r15d
mov r12b, 1
call fcn.00024fc4
mov r11d, dword [rsp + 0x1e8]
mov rcx, r11
cmp r11, r13
je 0x20ef1
call fcn.00012db4
mov r11d, dword [rsp + 0x1e8]
mov rbx, rax
jmp 0x20ef4
mov rbx, r13
cmp rbx, r13
je 0x20f5d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, 2
mov dword [rsp + 0x20], r11d
mov dword [rsp + 0x60], r13d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x20f47
cmp dword [rbx + 4], 4
jne 0x20f47
cmp dword [rbx + 8], 4
jb 0x20f47
cmp dword [rbx + 0xc], r13d
setne byte [0x0002b130]
jmp 0x20f4e
mov byte [0x0002b130], 1
mov edx, 0x52454749
mov rcx, rbx
call fcn.00012ebc
jmp 0x20f64
mov byte [0x0002b130], 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, 0x504249
mov rcx, rsi
call fcn.00012ebc
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
cmp r12b, r13b
jne 0x20fbb
inc ebp
cmp ebp, dword [rdi + 0x14]
jb 0x20c85
jmp 0x20fbb
mov edx, 0x504249
mov rcx, rsi
call fcn.00012ebc
mov edx, 0x504649
mov rcx, rdi
call fcn.00012ebc
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or qword [rsp + 0x30], 0xffffffffffffffff
cmp word [rsp + 0x38], r13w
jbe 0x21009
mov rcx, qword [rsp + 0x40]
mov r11d, 0x4d746147
mov edx, r11d
call fcn.00012ebc
cmp word [rsp + 0x38], r13w
jbe 0x21009
mov rcx, qword [rsp + 0x50]
mov edx, r11d
call fcn.00012ebc
cmp byte [0x0002b130], r13b
setne al
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, 0x504649
mov rcx, rdi
call fcn.00012ebc
jmp 0x20bc1