Function at 0x233ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x220
mov rax, qword [0x00028100]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, qword [rcx + 0x40]
mov r8, qword [rdx + 0xb8]
xor r14d, r14d
cmp byte [rbx + 1], r14b
mov r13, rcx
je 0x233f6
mov eax, 0xc0000056
jmp 0x23a70
cmp qword [r8 + 8], r14
jne 0x2340c
cmp qword [r8 + 0x10], r14
jne 0x2340c
mov eax, 0xc000009a
jmp 0x23a70
mov r12, qword [r8 + 8]
mov rdi, qword [r8 + 0x10]
mov esi, r14d
mov eax, dword [r12 + 4]
lea rbp, [r12 + 0x14]
mov r15d, 1
mov dword [rbx + 0x190], eax
mov rax, qword [r8 + 8]
mov ecx, dword [rax + 8]
mov dword [rbx + 0x188], ecx
cmp dword [r12 + 0x10], r14d
jbe 0x23553
add rdi, 0x18
movzx ecx, byte [rbp]
sub ecx, r15d
je 0x234ee
sub ecx, r15d
je 0x234cf
cmp ecx, r15d
jne 0x2353d
movzx eax, word [rdi - 2]
xor r8d, r8d
cmp dword [rdi + 8], 0x80
jne 0x234a1
mov dword [rbx + 0x3cc], eax
mov eax, dword [rdi]
mov qword [rbx + 0x468], rax
mov edx, dword [rdi + 8]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov qword [rbx + 0x3c0], rax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x3c8], eax
jmp 0x234c6
mov dword [rbx + 0x80], eax
mov eax, dword [rdi]
mov qword [rbx + 0x470], rax
mov edx, dword [rdi + 8]
mov rcx, qword [rdi]
call qword [sym.imp.ntoskrnl.exe_MmMapIoSpace]
mov qword [rbx + 0x58], rax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x60], eax
mov byte [rbx + 0x448], r15b
jmp 0x2353d
movzx eax, word [rdi - 2]
mov dword [rbx + 0x1bc], eax
mov al, byte [rdi]
mov byte [rbx + 0x68], al
mov eax, dword [rdi + 4]
mov dword [rbx + 0x64], eax
mov rax, qword [rdi + 8]
mov qword [rbx + 0x70], rax
jmp 0x2353d
cmp dword [rdi + 8], 0x20
movzx eax, word [rdi - 2]
jne 0x2351b
mov dword [rbx + 0x3cc], eax
mov eax, dword [rdi]
mov qword [rbx + 0x468], rax
mov eax, dword [rdi]
mov qword [rbx + 0x3c0], rax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x3c8], eax
jmp 0x23536
mov dword [rbx + 0x80], eax
mov eax, dword [rdi]
mov qword [rbx + 0x470], rax
mov eax, dword [rdi]
mov qword [rbx + 0x58], rax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x60], eax
mov byte [rbx + 0x448], r14b
add esi, r15d
add rbp, 0x14
add rdi, 0x14
cmp esi, dword [r12 + 0x10]
jb 0x23449
mov rcx, qword [rbx + 0x28]
mov esi, 2
lea r9, [rsp + 0x70]
mov edx, esi
mov r8d, 0x20019
call qword [sym.imp.ntoskrnl.exe_IoOpenDeviceRegistryKey]
cmp eax, r14d
jl 0x23a6b
lea rdx, [0x00024680]
lea rcx, [rsp + 0xb0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0xc0]
lea rdx, [rsp + 0xb0]
mov r8d, r15d
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r14d
jne 0x23a60
cmp dword [rsp + 0xcc], 4
ja 0x23a60
mov eax, dword [rsp + 0xc8]
mov r8d, dword [rsp + 0xcc]
lea rcx, [rsp + 0x78]
lea rdx, [rsp + rax + 0xc0]
call fcn.00022060
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [rsp + 0x78]
mov rcx, rbx
mov dword [rbx + 0x208], eax
mov dword [rbx + 0x20c], r14d
call fcn.00024328
cmp dword [rbx + 0x44c], esi
jne 0x23656
mov rax, qword [rbx + 0x30]
lea rcx, [rsp + 0x98]
mov dword [rsp + 0x98], esi
mov dword [rsp + 0x9c], r14d
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], rax
call fcn.00021ba4
jmp 0x23698
bt dword [rbx + 0x208], 0x19
jae 0x2367c
mov rax, qword [rbx + 0x3c0]
add rax, 0xf
cmp byte [rbx + 0x448], r15b
jne 0x23676
jmp 0x2368d
movzx edx, ax
in al, dx
jmp 0x23695
mov rax, qword [rbx + 0x58]
add rax, 0x3f
cmp byte [rbx + 0x448], r15b
jne 0x23691
mov al, byte [rax]
jmp 0x23695
movzx edx, ax
in al, dx
and eax, 0xf
mov dword [rbx + 0x194], eax
lea rax, [rsp + 0x140]
mov word [rsp + 0x80], r14w
mov word [rsp + 0x82], 0x64
mov qword [rsp + 0x88], rax
mov eax, dword [rbx + 0x208]
bt eax, 0x19
mov ecx, dword [rbx + 0x194]
lea r8, [rsp + 0x80]
mov edx, 0xa
jae 0x23757
cmp al, r14b
je 0x23720
lea ecx, [rcx + rcx + 0x11]
call qword [sym.imp.ntoskrnl.exe_RtlIntegerToUnicodeString]
cmp eax, r14d
jl 0x23a70
movzx eax, byte [rbx + 0x208]
mov edi, 8
mov rcx, rdi
test r15b, al
je 0x23714
add dword [rbx + 0x48], r15d
or dword [rbx + 0x50], 4
shr eax, 1
sub rcx, r15
jne 0x23707
jmp 0x237a9
lea ecx, [rcx + rcx + 0x12]
call qword [sym.imp.ntoskrnl.exe_RtlIntegerToUnicodeString]
cmp eax, r14d
jl 0x23a70
movzx eax, byte [rbx + 0x209]
mov edi, 8
mov rcx, rdi
test r15b, al
je 0x2374e
add dword [rbx + 0x4c], r15d
or dword [rbx + 0x50], edi
shr eax, 1
sub rcx, r15
jne 0x23742
jmp 0x237a9
add ecx, r15d
call qword [sym.imp.ntoskrnl.exe_RtlIntegerToUnicodeString]
cmp eax, r14d
jl 0x23a70
movzx eax, byte [rbx + 0x208]
mov edi, 8
mov rcx, rdi
test r15b, al
je 0x23785
add dword [rbx + 0x48], r15d
or dword [rbx + 0x50], r15d
shr eax, 1
sub rcx, r15
jne 0x23778
movzx eax, byte [rbx + 0x209]
mov rcx, rdi
test r15b, al
je 0x237a2
add dword [rbx + 0x4c], r15d
or dword [rbx + 0x50], esi
shr eax, 1
sub rcx, r15
jne 0x23796
mov rcx, rbx
call fcn.0002443c
lea rdx, [rsp + 0x80]
lea rcx, [rbx + 0x1f8]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
movzx eax, word [rbx + 0x1f8]
mov ecx, r15d
add ax, word [rbx + 0x1d8]
add ax, 0xa
movzx edx, ax
mov word [rsp + 0x62], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
cmp rax, r14
mov qword [rsp + 0x68], rax
je 0x23887
movzx r8d, word [rsp + 0x62]
xor edx, edx
mov rcx, rax
call fcn.00021f50
lea rdx, [0x00024670]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rbx + 0x1d8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [0x00024670]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rdx, [rbx + 0x1f8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rbx + 0x1c8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
cmp eax, r14d
jl 0x2387a
mov byte [rbx + 0x184], r15b
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r9d, dword [rbx + 0x194]
mov rcx, qword [rbx + 0x28]
lea rdx, [rbx + 0x1f8]
mov r8d, r15d
call fcn.00020ac8
mov dl, byte [rbx + 0x68]
mov rax, qword [rbx + 0x70]
mov byte [rsp + 0x50], r14b
mov qword [rsp + 0x48], rax
mov eax, dword [rbx + 0x1bc]
mov byte [rsp + 0x40], r15b
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x64]
mov byte [rsp + 0x30], dl
mov byte [rsp + 0x28], dl
lea rcx, [rbx + 0x78]
lea rdx, [0x0001f218]
xor r9d, r9d
mov r8, r13
mov dword [rsp + 0x20], eax
mov byte [rbx + 0x1b9], r15b
call qword [sym.imp.ntoskrnl.exe_IoConnectInterrupt]
cmp eax, r14d
jl 0x23a6b
mov dword [rbx + 0x2a0], r14d
mov dword [rbx + 0x35c], r15d
mov dword [rbx + 0x3e0], r15d
mov rax, qword [r13 + 8]
mov rdx, qword [rax + 8]
jmp 0x23933
mov rcx, qword [rdx + 0x40]
cmp rcx, rbx
je 0x2392f
mov rax, qword [rbx + 0x468]
cmp qword [rcx + 0x468], rax
je 0x2393b
mov rdx, qword [rdx + 0x10]
cmp rdx, r14
jne 0x23916
mov rcx, r14
cmp rcx, r14
mov qword [rbx + 0x3d0], rcx
je 0x2398e
mov rax, qword [rcx + 0x3d8]
cmp rax, r14
je 0x2395c
mov qword [rbx + 0x3d8], rax
jmp 0x2397e
mov edx, 0x100
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rcx, qword [rbx + 0x3d0]
mov qword [rbx + 0x3d8], rax
mov qword [rcx + 0x3d8], rax
mov rax, qword [rbx + 0x3d0]
mov qword [rax + 0x3d0], rbx
jmp 0x239a2
mov edx, 0x100
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [rbx + 0x3d8], rax
cmp dword [rbx + 0x50], 4
je 0x239cd
cmp dword [rbx + 0x50], edi
je 0x239cd
mov rax, qword [rbx + 0x58]
add rax, 0x3a
cmp byte [rbx + 0x448], r15b
jne 0x239c4
mov word [rax], r14w
jmp 0x23a3e
movzx edx, ax
xor eax, eax
out dx, ax
jmp 0x23a4b
mov rax, qword [rbx + 0x58]
add rax, 0x26
cmp byte [rbx + 0x448], r15b
jne 0x239e9
mov word [rax], r14w
lock or dword [rsp], r14d
jmp 0x239f0
movzx edx, ax
xor eax, eax
out dx, ax
cmp qword [rbx + 0x3d0], r14
jne 0x23a4b
mov rax, qword [rbx + 0x3c0]
add rax, 0x15
cmp byte [rbx + 0x448], r15b
jne 0x23a17
mov byte [rax], r14b
lock or dword [rsp], r14d
jmp 0x23a1d
movzx edx, ax
xor eax, eax
out dx, al
bt dword [rbx + 0x208], 0x1d
jae 0x23a4b
mov rax, qword [rbx + 0x3c0]
add rax, 0x40
cmp byte [rbx + 0x448], r15b
jne 0x23a45
mov dword [rax], r14d
lock or dword [rsp], r14d
jmp 0x23a4b
movzx edx, ax
xor eax, eax
out dx, eax
mov rcx, rbx
call fcn.00011478
mov ecx, 0xc000000e
cmp eax, r14d
cmovl eax, ecx
jmp 0x23a70
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, 0xc000000e
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.00021ef0
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret