Function at 0x1a174
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov r12d, 0x72647268
xor ebp, ebp
mov edx, 0x210
mov r8d, r12d
xor ecx, ecx
mov ebx, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14d, 0x400
mov r8d, r12d
lea edx, [r14 + 0x10]
xor ecx, ecx
mov dword [rsp + 0x30], ebp
mov rdi, rax
mov dword [rsp + 0x34], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], ebp
mov esi, ebp
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], r14w
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp rax, rbp
jne 0x1a1e6
xor eax, eax
jmp 0x1a42c
cmp rdi, rbp
jne 0x1a1f9
mov rcx, rax
mov edx, r12d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x1a1df
mov r13d, 0x200
xor edx, edx
mov rcx, rdi
mov r8, r13
call fcn.0003bc80
lea rdx, [0x0003c4f0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x100]
mov edx, 0x20019
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], rbp
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebp
jge 0x1a297
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1a1df
jmp 0x1a1ee
mov r8, r13
xor edx, edx
mov rcx, rdi
call fcn.0003bc80
mov rcx, qword [rsp + 0x100]
lea r11, [rsp + 0xf0]
mov qword [rsp + 0x28], r11
mov r9, rdi
xor r8d, r8d
mov edx, esi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, ebp
jl 0x1a3fd
mov rcx, qword [rsp + 0x48]
mov r8, r14
xor edx, edx
mov word [rsp + 0x40], bp
mov word [rsp + 0x42], r14w
call fcn.0003bc80
lea rdx, [0x0003c590]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
cmp eax, ebp
jl 0x1a3d5
lea rdx, [rdi + 0x10]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
cmp eax, ebp
jl 0x1a3d5
mov r8, r13
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0xf0], r13d
mov dword [rsp + 0xf8], 1
call fcn.0003bc80
lea rdx, [0x0003c640]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xf0]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r11
call fcn.00012d60
cmp eax, ebp
jne 0x1a3d5
lea rcx, [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, ebp
jne 0x1a3d5
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x3c]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [0x0003c660]
mov qword [rsp + 0x20], rax
call fcn.0003aac8
cmp eax, 4
je 0x1a3e4
inc esi
cmp esi, 0x80
jge 0x1a3fd
jmp 0x1a297
mov ebx, dword [rsp + 0x3c]
shl ebx, 8
or ebx, dword [rsp + 0x38]
shl ebx, 8
or ebx, dword [rsp + 0x34]
shl ebx, 8
or ebx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x1a42a
mov edx, r12d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret