Function at 0x44b64
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x750
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x740], rax
xor r13d, r13d
mov qword [r11 - 0x6e8], r13
cmp byte [0x000b50f8], r13b
je 0x44f67
mov rax, qword [0x000be5f0]
cmp rax, r13
je 0x44f67
cmp byte [rax + 0x9c], r13b
jne 0x44f67
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
mov rcx, qword [0x000be5f0]
mov dl, 1
add rcx, 0x30
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rcx, qword [0x000be5f0]
add rcx, 0x20
call fcn.00044638
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x88]
mov rax, qword [rax]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x200
call fcn.00091d10
movsx ecx, word [rsp + 0x70]
movsx edx, word [rsp + 0x6e]
movsx r8d, word [rsp + 0x68]
movsx r11d, word [rsp + 0x74]
movsx eax, word [rsp + 0x72]
movsx r10d, word [rsp + 0x6c]
movsx r9d, word [rsp + 0x6a]
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
lea rcx, [rsp + 0x140]
lea r8, [0x00097c60]
mov edx, 0x1ff
mov dword [rsp + 0x20], r10d
call fcn.000183c0
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x90]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rcx, [rsp + 0x90]
call fcn.00044638
lea rcx, [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov rax, qword [0x000be5f0]
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x60]
mov edx, 0xf003f
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xe0], 0x30
mov qword [rsp + 0xe8], r13
mov dword [rsp + 0xf8], 0x240
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov r12d, 0xc0000000
and eax, r12d
cmp eax, r12d
jne 0x44d4f
mov rcx, qword [0x000be5f0]
jmp 0x44f57
mov rax, qword [0x000be5f0]
mov ebp, r13d
cmp dword [rax + 0x98], r13d
jbe 0x44f29
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x340]
xor edx, edx
mov r8d, 0x400
call fcn.00091d10
lea r8, [0x00093ae0]
lea rcx, [rsp + 0x340]
mov r9d, ebp
mov edx, 0x1ff
call fcn.00014458
lea rdx, [rsp + 0x340]
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [rsp + 0x60]
lea r8, [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x130]
lea rcx, [rsp + 0x58]
mov edx, 0xf003f
mov dword [rsp + 0xb0], 0x30
mov dword [rsp + 0xc8], 0x240
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x44f14
mov r12, qword [rsp + 0x58]
lea rdx, [0x00097b80]
lea rcx, [rsp + 0xa0]
mov rsi, r13
mov dword [rsp + 0x50], r13d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
lea r8d, [r9 + 1]
mov rcx, r12
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
cmp eax, 0x80000005
je 0x44e72
cmp eax, 0xc0000023
jne 0x44e95
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, 0x6c616e41
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rsi, rax
cmp rax, r13
jne 0x44f94
mov edi, 0xc000009a
mov r12d, 0xc0000000
mov eax, edi
and eax, r12d
cmp eax, r12d
jne 0x44eb8
cmp rsi, r13
je 0x44eb8
mov edx, 0x6c616e41
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp edi, r13d
jl 0x44ede
mov edx, dword [rbx + 8]
lea rcx, [rsp + 0x110]
add rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x110]
call fcn.00044638
cmp rbx, r13
je 0x44ef4
mov edx, 0x6c616e41
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, r13
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x44f14
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x58], r13
mov rax, qword [0x000be5f0]
inc ebp
cmp ebp, dword [rax + 0x98]
jb 0x44d6e
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x44f49
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [rsp + 0x60], r13
mov rcx, qword [0x000be5f0]
mov byte [rcx + 0x9c], 1
add rcx, 0x30
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
mov rcx, qword [rsp + 0x740]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov eax, dword [rsp + 0x50]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
lea rdx, [rsp + 0xa0]
mov r9, rsi
mov r8d, 1
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov r12d, 0xc0000000
mov edi, eax
and eax, r12d
cmp eax, r12d
cmovne rbx, rsi
jmp 0x44e9b