Function at 0x140001ab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov qword [rsp + 0x40], 0
cmp qword [rsp + 0xa0], 0
je 0x140001b33
mov rax, qword [rsp + 0xa0]
movzx eax, word [rax]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov r8d, 0x67666e43
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001b18
mov eax, 0xc0000017
jmp 0x140001d09
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rcx + 8]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x140001b44
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x80000005
je 0x140001ba2
cmp dword [rsp + 0x38], 0xc0000023
je 0x140001ba2
jmp 0x140001cbd
mov eax, dword [rsp + 0x34]
cmp rax, 0x10
jae 0x140001bb1
jmp 0x140001cbd
mov eax, dword [rsp + 0x34]
mov r8d, 0x67666e43
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001bd7
jmp 0x140001cbd
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jge 0x140001c17
jmp 0x140001cbd
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x90]
cmp dword [rax + 4], ecx
je 0x140001c2d
jmp 0x140001cbd
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
je 0x140001c46
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0xffff
jbe 0x140001c48
jmp 0x140001cbd
cmp qword [rsp + 0x48], 0
je 0x140001c60
mov edx, 0x67666e43
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov r8d, 0x67666e43
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001ca4
mov edx, 0x67666e43
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc0000017
jmp 0x140001d09
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
add rcx, 0xc
mov rdi, qword [rsp + 0x48]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x40], 0
je 0x140001cd5
mov edx, 0x67666e43
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x98]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x98]
movzx ecx, word [rsp + 0x30]
mov word [rax + 2], cx
xor eax, eax
add rsp, 0x68
pop rdi
pop rsi
ret