Function at 0x110c8
Capabilities:
Delete registry value
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x608
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x5f8], rax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.0001b210
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x590]
call fcn.0001b210
mov r8d, 0x100
mov edx, 0xff
lea rcx, [rsp + 0x70]
call fcn.0001b210
mov r8d, 0x4d6d4366
mov edx, 0x230
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x5e0], rax
mov r8d, 0x20
xor edx, edx
lea rcx, [rsp + 0x5a8]
call fcn.0001b210
mov dword [rsp + 0x178], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x178]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x5d8], eax
mov rax, qword [0x00023598]
mov qword [rsp + 0x180], rax
xor eax, eax
mov word [rsp + 0x5e8], ax
jmp 0x111a2
movzx eax, word [rsp + 0x5e8]
add eax, 4
mov word [rsp + 0x5e8], ax
movzx eax, word [rsp + 0x5e8]
cmp eax, 0x208
jge 0x112b6
mov rax, qword [0x00023110]
mov al, byte [rax]
mov byte [0x000235a4], al
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x5ec], eax
cmp dword [rsp + 0x5ec], 1
je 0x11214
cmp dword [rsp + 0x5ec], 2
je 0x11222
cmp dword [rsp + 0x5ec], 0x1000
je 0x11235
cmp dword [rsp + 0x5ec], 0x2000
je 0x11242
cmp dword [rsp + 0x5ec], 0x4004
je 0x11250
jmp 0x1126c
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x1126c
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x1126c
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x1126c
lea rcx, [0x00021040]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1126c
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x5d8]
xor eax, 0xc000003a
add ecx, eax
mov rax, qword [rsp + 0x180]
mov byte [rax], cl
mov rax, qword [rsp + 0x180]
add rax, 1
mov qword [rsp + 0x180], rax
mov rax, qword [0x00023110]
add rax, 1
mov qword [0x00023110], rax
jmp 0x1118f
mov rax, qword [0x00023598]
add rax, 0x82
mov qword [rsp + 0x5d0], rax
xor eax, eax
mov word [rsp + 0x5e8], ax
jmp 0x112ea
movzx eax, word [rsp + 0x5e8]
add eax, 4
mov word [rsp + 0x5e8], ax
movzx eax, word [rsp + 0x5e8]
cmp eax, 0x1b8
jge 0x11386
mov dword [rsp + 0x20], 0
mov r9d, 0xa
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoAcquireRemoveLockEx]
mov r11, qword [rsp + 0x610]
mov al, byte [r11]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x5d8]
xor eax, 0xc00000c7
add ecx, eax
mov rax, qword [rsp + 0x5d0]
mov byte [rax], cl
mov rax, qword [rsp + 0x5d0]
add rax, 1
mov qword [rsp + 0x5d0], rax
lea rcx, [rsp + 0x590]
call qword [sym.imp.ntoskrnl.exe_CcGetFileObjectFromSectionPtrs]
mov rax, qword [rsp + 0x610]
add rax, 1
mov qword [rsp + 0x610], rax
jmp 0x112d7
mov rax, qword [0x00023598]
add rax, 0xf0
mov qword [rsp + 0x38], rax
xor eax, eax
mov word [rsp + 0x5e8], ax
jmp 0x113b7
movzx eax, word [rsp + 0x5e8]
add eax, 4
mov word [rsp + 0x5e8], ax
movzx eax, word [rsp + 0x5e8]
cmp eax, 0x28c
jge 0x1142f
mov rax, qword [0x00023118]
mov al, byte [rax]
mov byte [0x000235a4], al
lea r8, [0x00021050]
lea rdx, [0x00021080]
mov ecx, 0xc1c8
call qword [sym.imp.ntoskrnl.exe_RtlDeleteRegistryValue]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x5d8]
xor eax, 0xc00000cb
sub ecx, eax
mov rax, qword [rsp + 0x38]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [0x00023118]
add rax, 1
mov qword [0x00023118], rax
jmp 0x113a4
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x8c00ffff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuotaBufferValidity]
mov rax, qword [0x00023598]
add rax, 0x193
mov qword [rsp + 0x5c8], rax
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x8c00ffff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuotaBufferValidity]
xor eax, eax
mov word [rsp + 0x5e8], ax
jmp 0x11487
movzx eax, word [rsp + 0x5e8]
add eax, 4
mov word [rsp + 0x5e8], ax
movzx eax, word [rsp + 0x5e8]
cmp eax, 0x1ec
jge 0x114ec
mov rax, qword [0x00023120]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x5d8]
xor eax, 0xc00000a7
sub ecx, eax
mov rax, qword [rsp + 0x5c8]
mov byte [rax], cl
mov rax, qword [rsp + 0x5c8]
add rax, 1
mov qword [rsp + 0x5c8], rax
mov rax, qword [0x00023120]
add rax, 1
mov qword [0x00023120], rax
jmp 0x11474
lea rcx, [rsp + 0x190]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
mov rax, qword [0x00023598]
add rax, 0x20e
mov qword [rsp + 0x170], rax
xor eax, eax
mov word [rsp + 0x5e8], ax
jmp 0x1152e
movzx eax, word [rsp + 0x5e8]
add eax, 4
mov word [rsp + 0x5e8], ax
movzx eax, word [rsp + 0x5e8]
cmp eax, 0x2c4
jge 0x115d9
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov r11, qword [0x00023128]
mov al, byte [r11]
mov byte [0x000235a4], al
cmp dword [rsp + 0x5d8], 0xc0000022
jne 0x11578
mov dword [rsp + 0x5f0], 0x37
jmp 0x11583
mov dword [rsp + 0x5f0], 0xdc70
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x5f0]
mov rax, qword [rsp + 0x170]
mov byte [rax], cl
mov rax, qword [rsp + 0x170]
add rax, 1
mov qword [rsp + 0x170], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5a8]
call qword [sym.imp.ntoskrnl.exe_IoReleaseRemoveLockEx]
mov rax, qword [0x00023128]
add rax, 1
mov qword [0x00023128], rax
jmp 0x1151b
cmp qword [rsp + 0x5e0], 0
je 0x115f7
mov edx, 0x4d6d4366
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x5f8]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x608
ret