Function at 0x7fff25d6de90
Capabilities:
Access peb ldr_data
Get kernel32 base address
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x168
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, qword [rsp + 0x1d8]
xor eax, eax
mov r15, qword [rsp + 0x1e0]
mov rbx, r9
mov r12, qword [rsp + 0x1d0]
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov qword [rsp + 0x58], rbx
mov r13d, eax
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x7fff25d6df04
test r12, r12
je 0x7fff25d6e0f9
cmp rsi, 0xffffffff80000004
je 0x7fff25de661a
cmp rsi, 0xffffffff80000050
je 0x7fff25de661a
cmp rsi, 0xffffffff80000060
je 0x7fff25de661a
mov edx, ebp
test sil, 2
jne 0x7fff25d6e1aa
movzx ebp, word [r14 + 2]
xor ecx, ecx
test rdi, rdi
mov eax, 1
mov r15d, ecx
cmovne r15d, eax
je 0x7fff25d6df51
add ebp, dword [rdi]
cmp ebp, 0xc4
jbe 0x7fff25d6e0ea
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, ebp
add r8, 0x18
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x7fff25de65c4
mov r13, qword [rsp + 0x48]
mov rbx, rax
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, r15d
mov rcx, rsi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
mov ebp, eax
cmp eax, 0x80000005
je 0x7fff25d6e118
test r13, r13
jne 0x7fff25d6e22f
test ebp, ebp
js 0x7fff25d6e107
movzx eax, word [r14 + 2]
test r15d, r15d
je 0x7fff25de65e0
mov edx, dword [rbx + 0x10]
lea rcx, [rdx + 2]
cmp rax, rcx
jb 0x7fff25d6e1cd
mov word [r14], dx
movzx r8d, dx
lea rdx, [rbx + 0x14]
mov rcx, qword [r14 + 8]
call sub.ntdll.dll_memmove
movzx ecx, word [r14]
xor edx, edx
mov rax, qword [r14 + 8]
shr rcx, 1
mov word [rax + rcx*2], dx
add word [r14], 2
test r12, r12
je 0x7fff25d6e044
mov eax, dword [rbx + 0xc]
cmp dword [rdi], eax
jb 0x7fff25d6e1cd
mov edx, dword [rbx + 8]
mov r8d, eax
add rdx, rbx
mov rcx, r12
call sub.ntdll.dll_memmove
test r15d, r15d
je 0x7fff25de6602
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7fff25d6e05c
mov eax, dword [rbx + 4]
mov dword [rcx], eax
mov eax, dword [rbx + 0xc]
mov dword [rdi], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7fff25d6e07c
test ebp, ebp
js 0x7fff25d6e100
test rdi, rdi
je 0x7fff25d6e07c
mov eax, dword [rdi]
mov dword [rcx], eax
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x7fff25d6e08f
cmp rbx, r8
jne 0x7fff25d6e1d7
lea rax, [rsp + 0x70]
cmp rbx, rax
je 0x7fff25d6e0b7
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebp
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.7fff25dce640
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rbx, [rsp + 0x70]
mov ebp, 0xdc
jmp 0x7fff25d6df99
mov dword [rdi], eax
jmp 0x7fff25d6df04
xor eax, eax
jmp 0x7fff25d6e07a
cmp ebp, 0x80000005
jne 0x7fff25d6e061
jmp 0x7fff25d6e044
test r15d, r15d
je 0x7fff25de65a0
cmp r15d, 1
jne 0x7fff25d6dfc9
mov ecx, dword [rbx + 0x10]
movzx eax, word [r14 + 2]
add rcx, 2
cmp rax, rcx
jb 0x7fff25d6dfc9
test r12, r12
jne 0x7fff25d6e1f7
mov rcx, qword gs:[0x60]
xor edx, edx
mov ebp, dword [rsp + 0x50]
mov r8d, ebp
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25de65ba
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov r8d, r15d
mov dword [rsp + 0x20], ebp
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop dword [rax + rax]
mov r13, qword [rsp + 0x48]
mov ebp, eax
jmp 0x7fff25d6dfc9
lea r8, [rsp + 0x48]
call fcn.7fff25dbaacc
test eax, eax
js 0x7fff25d6e2a6
mov r13, qword [rsp + 0x48]
test r13, r13
jne 0x7fff25d6e210
mov edx, ebp
jmp 0x7fff25d6df37
mov ebp, 0x80000005
jmp 0x7fff25d6e044
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d6e08f
test rdi, rdi
je 0x7fff25d6dfc9
mov eax, dword [rbx + 0xc]
cmp dword [rdi], eax
jae 0x7fff25d6e149
jmp 0x7fff25d6dfc9
mov rax, qword [r13 + 0x28]
cmp dword [rax + rbp*8 + 4], 0
mov edx, dword [rax + rbp*8]
mov dword [rsp + 0x40], edx
jne 0x7fff25d6e2b9
mov rsi, qword [r13 + 0x10]
jmp 0x7fff25d6df37
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x7fff25d6e242
cmp rcx, qword [r13]
jne 0x7fff25de65ce
mov rcx, qword [r13 + 0x10]
test rcx, rcx
je 0x7fff25d6e25d
cmp rcx, qword [r13]
je 0x7fff25d6e25d
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x7fff25d6e281
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
jmp 0x7fff25d6dfd2
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
jmp 0x7fff25d6e0c5
mov rsi, qword [r13 + 8]
jmp 0x7fff25d6df37
mov edx, dword [rbx + 8]
movzx ecx, word [r14 + 2]
add rdx, 2
cmp rcx, rdx
jae 0x7fff25d6e149
jmp 0x7fff25d6dfc9
mov rcx, qword [rsp + 0x48]
call fcn.7fff25d436cc
mov eax, 0xe
jmp 0x7fff25d6e0c5
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
nop
jmp 0x7fff25d6e242
mov edx, dword [rbx + 8]
lea rcx, [rdx + 2]
cmp rax, rcx
jb 0x7fff25de65fd
mov word [r14], dx
movzx r8d, dx
lea rdx, [rbx + 0xc]
jmp 0x7fff25d6e004
mov ebp, 0x80000005
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x7fff25d6e061
mov eax, dword [rbx + 4]
mov dword [rcx], eax
jmp 0x7fff25d6e061
call fcn.7fff25dcefc8
test al, al
je 0x7fff25de6654
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov r8, r14
mov qword [rsp + 0x28], r12
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ext_ms_win_advapi32_registry_l1_1_0.dll_PerfRegEnumValue]
nop dword [rax + rax]
nop
jmp 0x7fff25d6e0c5
mov eax, 0x57
jmp 0x7fff25d6e0c5