Function at 0x197b0
Capabilities:
Print debug messages
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x428
mov rax, qword [0x00023100]
xor rax, rsp
mov qword [rsp + 0x418], rax
mov eax, 4
mov word [rsp + 0x1a8], ax
mov eax, 8
mov word [rsp + 0x1b8], ax
mov r8d, 0x100
mov edx, 0xff
lea rcx, [rsp + 0x300]
call fcn.0001b210
mov r8d, 0x4d6d4366
mov edx, 0x36c
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x2f0], rax
mov r8d, 0xd0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.0001b210
mov r8d, 0x100
mov edx, 0xff
lea rcx, [rsp + 0x1f0]
call fcn.0001b210
mov dword [rsp + 0x40], 0xffffffff
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoCheckDesiredAccess]
mov dword [rsp + 0x1d0], eax
xor r8d, r8d
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.ntoskrnl.exe_RtlEqualString]
mov rax, qword [0x00023598]
add rax, 0x4055
mov qword [rsp + 0x1e0], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x198ae
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x258
jge 0x19934
mov rax, qword [0x000234e0]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x1d0], 0xc0000022
jne 0x198e6
mov dword [rsp + 0x404], 0xd8
jmp 0x198f1
mov dword [rsp + 0x404], 0xacd
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x404]
mov rax, qword [rsp + 0x1e0]
mov byte [rax], cl
mov rax, qword [rsp + 0x1e0]
add rax, 1
mov qword [rsp + 0x1e0], rax
mov rax, qword [0x000234e0]
add rax, 1
mov qword [0x000234e0], rax
jmp 0x1989b
mov rax, qword [0x00023598]
add rax, 0x40eb
mov qword [rsp + 0x1d8], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x19968
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x278
jge 0x19a8a
mov rax, qword [0x000234e8]
mov al, byte [rax]
mov byte [0x000235a4], al
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1d0]
xor eax, 0xc000002f
sub ecx, eax
mov rax, qword [rsp + 0x1d8]
mov byte [rax], cl
mov rax, qword [sym.imp.ntoskrnl.exe_KeNumberProcessors]
mov al, byte [rax]
movsx eax, al
mov dword [rsp + 0x408], eax
cmp dword [rsp + 0x408], 1
je 0x199f9
cmp dword [rsp + 0x408], 2
je 0x19a07
cmp dword [rsp + 0x408], 0x1000
je 0x19a1a
cmp dword [rsp + 0x408], 0x2000
je 0x19a27
cmp dword [rsp + 0x408], 0x4004
je 0x19a35
jmp 0x19a51
mov eax, dword [sym.imp.ntoskrnl.exe_NtGlobalFlag]
mov dword [0x000235a8], eax
jmp 0x19a51
mov rax, qword [sym.imp.ntoskrnl.exe_MmUserProbeAddress]
mov eax, dword [rax]
mov dword [0x000235a8], eax
jmp 0x19a51
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_DbgBreakPointWithStatus]
jmp 0x19a51
lea rcx, [0x00021220]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x19a51
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x7e
call qword [sym.imp.ntoskrnl.exe_KeBugCheckEx]
mov rax, qword [rsp + 0x1d8]
add rax, 1
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_RtlIsGenericTableEmptyAvl]
mov rax, qword [0x000234e8]
add rax, 1
mov qword [0x000234e8], rax
jmp 0x19955
xor edx, edx
lea rcx, [rsp + 0x300]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov rax, qword [0x00023598]
add rax, 0x4189
mov qword [rsp + 0x1c8], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x19ace
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x234
jge 0x19b48
mov rax, qword [0x000234f0]
mov al, byte [rax]
mov byte [0x000235a4], al
lea rdx, [0x000210c0]
mov ecx, 0xd504
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1d0]
xor eax, 0xc0000080
add ecx, eax
mov rax, qword [rsp + 0x1c8]
mov byte [rax], cl
mov rax, qword [rsp + 0x1c8]
add rax, 1
mov qword [rsp + 0x1c8], rax
mov rax, qword [0x000234f0]
add rax, 1
mov qword [0x000234f0], rax
jmp 0x19abb
mov rax, qword [0x00023598]
add rax, 0x4216
mov qword [rsp + 0x30], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x19b79
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x27c
jge 0x19be6
mov rax, qword [rsp + 0x430]
mov al, byte [rax]
mov byte [0x000235a4], al
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_RtlIsGenericTableEmptyAvl]
movzx ecx, byte [0x000235a4]
mov eax, dword [rsp + 0x1d0]
xor eax, 0xc0000088
add ecx, eax
mov rax, qword [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x30]
add rax, 1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x430]
add rax, 1
mov qword [rsp + 0x430], rax
jmp 0x19b66
mov rax, qword [0x00023598]
add rax, 0x42b5
mov qword [rsp + 0x38], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x19c17
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x298
jge 0x19cbe
mov edx, 0xc0000046
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoReuseIrp]
mov r11, qword [0x000234f8]
mov al, byte [r11]
mov byte [0x000235a4], al
lea r8, [rsp + 0x1a4]
xor edx, edx
mov ecx, 0x8c00ffff
call qword [sym.imp.ntoskrnl.exe_IoCheckQuotaBufferValidity]
cmp dword [rsp + 0x1d0], 0xc0000022
jne 0x19c79
mov dword [rsp + 0x40c], 0xe0
jmp 0x19c84
mov dword [rsp + 0x40c], 0xb166
movzx ecx, byte [0x000235a4]
add ecx, dword [rsp + 0x40c]
mov rax, qword [rsp + 0x38]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
add rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [0x000234f8]
add rax, 1
mov qword [0x000234f8], rax
jmp 0x19c04
mov rax, qword [0x00023598]
add rax, 0x435b
mov qword [rsp + 0x120], rax
xor eax, eax
mov word [rsp + 0x400], ax
jmp 0x19cf2
movzx eax, word [rsp + 0x400]
add eax, 4
mov word [rsp + 0x400], ax
movzx eax, word [rsp + 0x400]
cmp eax, 0x2bc
jge 0x19d8c
mov rax, qword [0x00023500]
mov al, byte [rax]
mov byte [0x000235a4], al
cmp dword [rsp + 0x1d0], 0xc0000022
jne 0x19d2e
mov dword [rsp + 0x410], 0x7f
jmp 0x19d39
mov dword [rsp + 0x410], 0x84c5
movzx ecx, byte [0x000235a4]
sub ecx, dword [rsp + 0x410]
mov rax, qword [rsp + 0x120]
mov byte [rax], cl
mov rax, qword [rsp + 0x120]
add rax, 1
mov qword [rsp + 0x120], rax
xor edx, edx
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.ntoskrnl.exe_MmProtectMdlSystemAddress]
mov rax, qword [0x00023500]
add rax, 1
mov qword [0x00023500], rax
jmp 0x19cdf
cmp qword [rsp + 0x2f0], 0
je 0x19daa
mov edx, 0x4d6d4366
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x418]
xor rcx, rsp
call fcn.0001ae60
add rsp, 0x428
ret