Function at 0x17160
Capabilities:
Print debug messages
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x688
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x678], rax
mov r8d, 0x4d6d4366
mov edx, 0xc4
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x650], rax
mov dword [rsp + 0x620], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x620]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x624], eax
mov rax, qword [0x00023598]
add rax, 0xa22
mov qword [rsp + 0x638], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x171f8
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x238
jge 0x1730c
mov rax, qword [0x000233a8]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x624]
xor eax, 0xc00000f8
xor ecx, eax
mov rax, qword [rsp + 0x638]
mov byte [rax], cl
mov rax, qword [rsp + 0x638]
add rax, 1
mov qword [rsp + 0x638], rax
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x65c], eax
cmp dword [rsp + 0x65c], 1
je 0x1729d
cmp dword [rsp + 0x65c], 2
je 0x172ab
cmp dword [rsp + 0x65c], 0x1000
je 0x172be
cmp dword [rsp + 0x65c], 0x2000
je 0x172cb
cmp dword [rsp + 0x65c], 0x4004
je 0x172d9
jmp 0x172f5
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x172f5
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x172f5
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x172f5
lea rcx, [0x000211e0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x172f5
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [0x000233a8]
add rax, 1
mov qword [0x000233a8], rax
jmp 0x171e5
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlIsGenericTableEmptyAvl]
mov rax, qword [0x00023598]
add rax, 0xab0
mov qword [rsp + 0x610], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x1734b
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx ecx, word [rsp + 0x658]
mov eax, dword [rsp + 0x690]
shl eax, 2
cmp ecx, eax
jae 0x173d8
mov rax, qword [0x000233b0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x624], 0xc0000022
jne 0x1738a
mov dword [rsp + 0x660], 3
jmp 0x17395
mov dword [rsp + 0x660], 0xa225
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x660]
mov rax, qword [rsp + 0x610]
mov byte [rax], cl
mov rax, qword [rsp + 0x610]
add rax, 1
mov qword [rsp + 0x610], rax
mov rax, qword [0x000233b0]
add rax, 1
mov qword [0x000233b0], rax
jmp 0x17338
mov rax, qword [0x00023598]
add rax, 0xb5e
mov qword [rsp + 0x630], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x1740c
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x24c
jge 0x174ac
mov rax, qword [rsp + 0x698]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x624], 0xc0000022
jne 0x17449
mov dword [rsp + 0x664], 0xf3
jmp 0x17454
mov dword [rsp + 0x664], 0x3566
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x664]
mov rax, qword [rsp + 0x630]
mov byte [rax], cl
mov edx, 0xaaa1
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.ntoskrnl.exe_IoWMIRegistrationControl]
mov rax, qword [rsp + 0x630]
add rax, 1
mov qword [rsp + 0x630], rax
mov rax, qword [rsp + 0x698]
add rax, 1
mov qword [rsp + 0x698], rax
jmp 0x173f9
lea rdx, [0x000210c0]
mov ecx, 0x915d
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov rax, qword [0x00023598]
add rax, 0xbf1
mov qword [rsp + 0x648], rax
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceToVerify]
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x17500
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x1d0
jge 0x17589
mov rax, qword [rsp + 0x6a0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x624], 0xc0000022
jne 0x17539
mov dword [rsp + 0x668], 0xa0
jmp 0x17544
mov dword [rsp + 0x668], 0x2b28
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x668]
mov rax, qword [rsp + 0x648]
mov byte [rax], cl
mov rax, qword [rsp + 0x648]
add rax, 1
mov qword [rsp + 0x648], rax
mov rax, qword [rsp + 0x6a0]
add rax, 1
mov qword [rsp + 0x6a0], rax
jmp 0x174ed
mov rax, qword [0x00023598]
add rax, 0xc65
mov qword [rsp + 0x618], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x175bd
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x25c
jge 0x17643
mov rax, qword [0x000233b8]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x624], 0xc0000022
jne 0x175f5
mov dword [rsp + 0x66c], 0xa
jmp 0x17600
mov dword [rsp + 0x66c], 0x4d65
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x66c]
mov rax, qword [rsp + 0x618]
mov byte [rax], cl
mov rax, qword [rsp + 0x618]
add rax, 1
mov qword [rsp + 0x618], rax
mov rax, qword [0x000233b8]
add rax, 1
mov qword [0x000233b8], rax
jmp 0x175aa
mov rax, qword [0x00023598]
add rax, 0xcfc
mov qword [rsp + 0x640], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x17677
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x1fc
jge 0x176fd
mov rax, qword [0x000233c0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x624], 0xc0000022
jne 0x176af
mov dword [rsp + 0x670], 0x9e
jmp 0x176ba
mov dword [rsp + 0x670], 0x2f9
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x670]
mov rax, qword [rsp + 0x640]
mov byte [rax], cl
mov rax, qword [rsp + 0x640]
add rax, 1
mov qword [rsp + 0x640], rax
mov rax, qword [0x000233c0]
add rax, 1
mov qword [0x000233c0], rax
jmp 0x17664
mov rax, qword [0x00023598]
add rax, 0xd7b
mov qword [rsp + 0x628], rax
xor eax, eax
mov word [rsp + 0x658], ax
jmp 0x17731
movzx eax, word [rsp + 0x658]
add eax, 4
mov word [rsp + 0x658], ax
movzx eax, word [rsp + 0x658]
cmp eax, 0x288
jge 0x17796
mov rax, qword [0x000233c8]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x624]
xor eax, 0xc00000b7
add ecx, eax
mov rax, qword [rsp + 0x628]
mov byte [rax], cl
mov rax, qword [rsp + 0x628]
add rax, 1
mov qword [rsp + 0x628], rax
mov rax, qword [0x000233c8]
add rax, 1
mov qword [0x000233c8], rax
jmp 0x1771e
cmp qword [rsp + 0x650], 0
je 0x177b4
mov edx, 0x4d6d4366
mov rcx, qword [rsp + 0x650]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x678]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x688
ret