Function at 0x19860
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x80
and qword [r11 + 0x18], 0
xor ebx, ebx
mov r14, rcx
and dword [r11 + 0x10], ebx
lea eax, [rbx + 0x36]
lea rdx, [0x00055ce0]
mov word [rsp + 0x30], ax
lea eax, [rbx + 0x38]
lea rcx, [r11 - 0x68]
mov word [rsp + 0x32], ax
lea rax, [0x00055ca0]
mov qword [r11 - 0x70], rax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x58], rbx
and qword [rsp + 0x70], rbx
and qword [rsp + 0x78], rbx
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
mov edx, 0xf003f
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x19aaf
mov rsi, qword [rsp + 0xc0]
lea rax, [rsp + 0xb8]
lea ebp, [rbx + 2]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
xor r9d, r9d
mov r8d, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
cmp eax, 0xc0000034
je 0x199da
test eax, eax
je 0x19947
cmp eax, 0x80000005
je 0x19947
cmp eax, 0xc0000023
jne 0x199a3
mov edx, dword [rsp + 0xb8]
xor ecx, ecx
mov r8d, 0x34343434
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x199a3
lea rax, [rsp + 0xb8]
lea rdx, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xb8]
mov r8d, ebp
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov edi, eax
test eax, eax
jns 0x199a3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
mov esi, edi
test edi, edi
jns 0x199b5
cmp edi, 0xc0000034
jne 0x19a8f
test rbx, rbx
je 0x199da
mov edx, dword [rbx + 8]
cmp edx, ebp
jbe 0x199da
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
lea esi, [rdx - 2]
not rcx
lea r13d, [rdx + rcx*2 + 2]
jmp 0x199f0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
xor esi, esi
not rcx
lea r13d, [rcx + rcx + 4]
mov r8d, 0x306c6564
mov edx, r13d
xor ecx, ecx
mov edi, r13d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x19a13
mov esi, 0xc000009a
jmp 0x19a7c
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.000554c0
test esi, esi
je 0x19a33
lea rdx, [rbx + 0xc]
mov r8d, esi
mov rcx, rbp
call fcn.000550e0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
mov rdx, r14
not rcx
lea r8, [rcx + rcx - 2]
mov ecx, esi
add rcx, rbp
call fcn.000550e0
mov rcx, qword [rsp + 0xc0]
lea rdx, [rsp + 0x30]
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov esi, eax
test rbp, rbp
je 0x19a8f
mov edx, 0x306c6564
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rbx, rbx
je 0x19a9f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret