Function at 0x22654
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
xor eax, eax
xor r14d, r14d
mov rsi, rcx
mov word [r11 - 0x180], r14w
mov qword [r11 - 0x17e], rax
mov word [r11 - 0x170], r14w
mov qword [r11 - 0x16e], rax
lea rcx, [rsp + 0x78]
lea rdx, [0x00025330]
mov word [rsp + 0x78], r14w
mov qword [rsp + 0x7a], rax
mov dword [rsp + 0x82], eax
mov word [rsp + 0x86], ax
mov dword [rsp + 0xa2], eax
mov word [rsp + 0xa6], ax
mov dword [rsp + 0xb2], eax
mov word [rsp + 0xb6], ax
mov word [rsp + 0x30], r14w
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov word [rsp + 0x48], r14w
mov qword [rsp + 0x4a], rax
mov dword [rsp + 0x52], eax
mov word [rsp + 0x56], ax
mov r12b, r14b
mov byte [rsp + 0x230], r14b
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00025310]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00028590]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ebp, 0x400
mov r13d, 0x6020000
mov ecx, r13d
mov word [rsp + 0x30], bp
mov word [rsp + 0x32], bp
call fcn.00024fc4
mov rcx, rbp
call fcn.00012db4
mov qword [rsp + 0x38], rax
cmp rax, r14
je 0x22f61
mov ecx, r13d
mov word [rsp + 0x48], bp
mov word [rsp + 0x4a], bp
call fcn.00024fc4
mov rcx, rbp
call fcn.00012db4
mov qword [rsp + 0x50], rax
cmp rax, r14
jne 0x2279f
mov rcx, qword [rsp + 0x38]
jmp 0x22f57
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
xor edx, edx
lea rcx, [rsp + 0x170]
lea r8d, [rdx + 0x70]
call fcn.00025100
lea rax, [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x188], rax
mov eax, 4
lea rcx, [rsp + 0x110]
mov dword [rsp + 0x190], eax
mov dword [rsp + 0x1a0], eax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x198], rax
lea rax, [0x000253d0]
lea r8d, [rdx + 0x28]
mov dword [rsp + 0x88], r14d
mov dword [rsp + 0x90], r14d
mov dword [rsp + 0x178], 0x20
mov qword [rsp + 0x180], rax
call fcn.00025100
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x108]
lea rcx, [rsp + 0x40]
mov edx, 0x20019
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x108], 0x30
mov qword [rsp + 0x110], r14
mov dword [rsp + 0x120], 0x240
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], r14
mov qword [rsp + 0x40], r14
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r14d
jl 0x22f33
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
lea rax, [rsp + 0x238]
lea edi, [r9 + 2]
xor r8d, r8d
mov dword [rsp + 0x238], r14d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r14d
jge 0x2291d
cmp eax, 0x80000005
je 0x2291d
cmp eax, 0xc0000023
je 0x2291d
mov rcx, qword [rsp + 0x38]
mov edx, 0x4d746147
call fcn.00012ebc
mov rcx, qword [rsp + 0x50]
mov edx, 0x4d746147
mov qword [rsp + 0x38], r14
call fcn.00012ebc
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], r14
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x22f61
mov eax, dword [rsp + 0x238]
cmp eax, r14d
je 0x228e5
cmp eax, ebp
ja 0x228e5
mov ecx, r13d
call fcn.00024fc4
mov r9d, dword [rsp + 0x238]
mov rcx, r9
cmp r9, r14
je 0x22957
call fcn.00012db4
mov r9d, dword [rsp + 0x238]
mov r15, rax
jmp 0x2295a
mov r15, r14
mov qword [rsp + 0xb8], r15
cmp r15, r14
je 0x228e5
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x238]
mov r8, r15
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
cmp eax, r14d
jl 0x22f74
cmp dword [rsp + 0x238], r14d
je 0x22f74
mov edi, r14d
mov dword [rsp + 0x58], r14d
cmp dword [r15 + 0x14], r14d
jbe 0x22f15
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x238]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r14d
jge 0x229ed
cmp eax, 0x80000005
je 0x229ed
cmp eax, 0xc0000023
jne 0x22f15
mov eax, dword [rsp + 0x238]
cmp eax, r14d
je 0x22f15
cmp eax, ebp
ja 0x22f15
mov ecx, r13d
call fcn.00024fc4
mov edx, dword [rsp + 0x238]
mov rcx, rdx
cmp rdx, r14
je 0x22a2d
call fcn.00012db4
mov edx, dword [rsp + 0x238]
mov r13, rax
jmp 0x22a30
mov r13, r14
mov qword [rsp + 0xc0], r13
cmp r13, r14
je 0x22f15
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x238]
mov r9, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
mov edx, edi
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, r14d
jl 0x22f08
cmp dword [rsp + 0x238], r14d
je 0x22f08
movzx ecx, word [r13 + 0xc]
mov word [rsp + 0xc8], cx
movzx eax, word [r13 + 0xc]
mov word [rsp + 0xca], ax
lea rax, [r13 + 0x10]
mov qword [rsp + 0xd0], rax
cmp cx, 0x14
jbe 0x22ec1
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x170]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
cmp word [rsp + 0x48], r14w
je 0x22ec1
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
xor edx, edx
lea rcx, [rsp + 0x140]
lea r8d, [rdx + 0x28]
call fcn.00025100
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x138]
lea rcx, [rsp + 0x70]
mov edx, 0x20019
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x138], 0x30
mov qword [rsp + 0x140], r14
mov dword [rsp + 0x150], 0x240
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x160], r14
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r14d
jl 0x22ec1
mov ecx, 8
mov eax, 0xe
mov word [rsp + 0x60], bp
mov word [rsp + 0xe8], ax
lea edx, [rcx + 2]
mov eax, 0x10
mov word [rsp + 0xea], ax
lea rax, [0x00028620]
mov word [rsp + 0xf8], cx
mov qword [rsp + 0xf0], rax
lea rax, [0x00028630]
mov word [rsp + 0xd8], cx
mov qword [rsp + 0x100], rax
lea rax, [0x00028640]
mov ecx, 0x6020000
mov qword [rsp + 0xe0], rax
xor eax, eax
mov word [rsp + 0xfa], dx
mov qword [rsp + 0x62], rax
mov word [rsp + 0x62], bp
mov word [rsp + 0xda], dx
mov dword [rsp + 0x6a], eax
mov word [rsp + 0x6e], ax
call fcn.00024fc4
mov rcx, rbp
call fcn.00012db4
mov qword [rsp + 0x68], rax
cmp rax, r14
je 0x22eb1
mov r15, qword [rsp + 0x228]
mov ebp, r14d
mov r13d, 0x400
cmp ebp, r14d
jne 0x22c59
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov r14, r15
jmp 0x22c89
cmp ebp, 1
jne 0x22e7c
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xd8]
cmp byte [0x0186def5], r14b
jne 0x22c80
lea rdx, [rsp + 0xf8]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov r14, rsi
mov rcx, qword [rsp + 0x70]
xor edi, edi
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
lea r8d, [rdi + 2]
xor r9d, r9d
mov dword [rsp + 0x5c], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
jge 0x22ce6
cmp eax, 0x80000005
je 0x22ce6
cmp eax, 0xc0000023
je 0x22ce6
mov r12b, byte [rsp + 0x230]
xor r14d, r14d
cmp ebp, r14d
jne 0x22e6f
mov byte [0x0186def5], r14b
jmp 0x22e6f
mov r12d, 0x6020000
mov ecx, r12d
call fcn.00024fc4
mov edx, dword [rsp + 0x5c]
mov rcx, rdx
cmp rdx, rdi
je 0x22d0e
call fcn.00012db4
mov edx, dword [rsp + 0x5c]
mov rsi, rax
jmp 0x22d11
mov rsi, rdi
cmp rsi, rdi
je 0x22e4a
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x8c]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x60]
mov r8d, 2
mov dword [rsp + 0x8c], edi
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, edi
jl 0x22e1e
cmp ebp, edi
jne 0x22d9e
mov r12b, byte [rsp + 0x230]
xor r14d, r14d
cmp dword [rsi + 8], 2
jb 0x22d92
cmp word [rsi + 0xc], 0x31
jne 0x22d92
cmp dword [rsi + 8], 4
jb 0x22d86
cmp word [rsi + 0xe], r14w
sete byte [0x0186def5]
jmp 0x22e3b
mov byte [0x0186def5], 1
jmp 0x22e3b
mov byte [0x0186def5], r14b
jmp 0x22e3b
mov ecx, r12d
call fcn.00024fc4
mov rcx, r13
call fcn.00012db4
mov r12, rax
cmp rax, rdi
je 0x22e30
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.00025100
mov r8d, dword [rsi + 8]
mov eax, 0x3fe
cmp r8, rax
lea rdx, [rsi + 0xc]
mov rcx, r12
cmova r8, rax
call fcn.00024c10
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
je 0x22e0f
mov qword [r14 + 8], r12
mov r12b, 1
mov word [r14 + 2], r13w
mov byte [rsp + 0x230], r12b
mov word [r14], cx
jmp 0x22e38
mov edx, 0x4d746147
mov rcx, r12
call fcn.00012ebc
jmp 0x22e30
mov eax, ebp
neg eax
sbb cl, cl
and cl, byte [0x0186def5]
mov byte [0x0186def5], cl
mov r12b, byte [rsp + 0x230]
xor r14d, r14d
mov edx, 0x52454749
mov rcx, rsi
call fcn.00012ebc
jmp 0x22e67
mov r12b, byte [rsp + 0x230]
mov eax, ebp
neg eax
sbb cl, cl
and cl, byte [0x0186def5]
xor r14d, r14d
mov byte [0x0186def5], cl
mov rsi, qword [rsp + 0x220]
inc ebp
cmp ebp, 2
jl 0x22c3c
jmp 0x22e84
mov r12b, byte [rsp + 0x230]
mov rcx, qword [rsp + 0x68]
mov r13, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xb8]
cmp rcx, r14
je 0x22ea8
mov edx, 0x4d746147
call fcn.00012ebc
mov edi, dword [rsp + 0x58]
mov ebp, 0x400
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp r12b, r14b
jne 0x22f08
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov edx, 0x504249
mov rcx, r13
call fcn.00012ebc
inc edi
mov dword [rsp + 0x58], edi
cmp edi, dword [r15 + 0x14]
jae 0x22f15
mov r13d, 0x6020000
jmp 0x229b1
mov edx, 0x504249
mov rcx, r13
call fcn.00012ebc
mov edx, 0x504649
mov rcx, r15
call fcn.00012ebc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or qword [rsp + 0x40], 0xffffffffffffffff
cmp word [rsp + 0x30], r14w
jbe 0x22f61
mov rcx, qword [rsp + 0x38]
mov edx, 0x4d746147
call fcn.00012ebc
cmp word [rsp + 0x30], r14w
jbe 0x22f61
mov rcx, qword [rsp + 0x50]
mov edx, 0x4d746147
call fcn.00012ebc
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, 0x504649
mov rcx, r15
call fcn.00012ebc
jmp 0x228e5