Function at 0x14000db10
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r12
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov r14, qword [rcx + 0x40]
mov rcx, r14
mov qword [rsp + 0x40], r14
call fcn.140004320
lea rdx, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
xor r12d, r12d
lea rcx, [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x20]
mov dword [rbp + 0x28], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x38], rax
lea r8, [rbp + 0x28]
mov qword [rbp + 0x30], r12
mov edx, 0x20019
mov dword [rbp + 0x40], 0x240
lea rcx, [rbp + 0x1f8]
movdqu xmmword [rbp + 0x48], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14000dfe6
mov rcx, qword [rbp + 0x1f8]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x2b8], rbx
lea edx, [r12 + 2]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x2a0], r13
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov edx, 0x1000
lea ecx, [r12 + 1]
cmp dword [rbp + 0x1e0], edx
mov r8d, 0x4d525356
cmovb edx, dword [rbp + 0x1e0]
mov dword [rbp + 0x1e0], edx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, dword [rbp + 0x1e0]
lea edx, [r12 + 2]
mov rcx, qword [rbp + 0x1f8]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r8, rbx
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
xor r13d, r13d
cmp dword [rbx + 0x14], r12d
jbe 0x14000dfb6
mov qword [rsp + 0x2b0], rsi
mov qword [rsp + 0x2a8], rdi
lea edi, [r12 + 8]
mov qword [rsp + 0x298], r15
mov rcx, qword [rbp + 0x1f8]
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov edx, r13d
mov dword [rbp + 0x1f0], r12d
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov edx, 0x1000
mov ecx, 1
cmp dword [rbp + 0x1e0], edx
mov r8d, 0x4d525356
cmovb edx, dword [rbp + 0x1e0]
mov dword [rbp + 0x1e0], edx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ecx, dword [rbp + 0x1e0]
xor r8d, r8d
mov rsi, rax
mov edx, r13d
lea rax, [rbp + 0x1e0]
mov r9, rsi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov r10d, dword [rsi + 0xc]
xor ebx, ebx
mov r8d, r10d
xor edx, edx
shr r8d, 1
lea r9d, [rbx + 1]
nop dword [rax]
cmp r8d, 8
mov eax, r8d
cmova eax, edi
cmp edx, eax
jae 0x14000dd3b
movzx ecx, word [rsi + rdx*2 + 0x10]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x14000dd0a
shl ebx, 4
mov eax, ecx
add eax, 0xffffffd0
add ebx, eax
inc edx
jmp 0x14000dce0
lea eax, [rcx - 0x41]
cmp ax, 5
ja 0x14000dd21
shl ebx, 4
mov eax, ecx
add eax, 0xffffffc9
add ebx, eax
inc edx
jmp 0x14000dce0
lea eax, [rcx - 0x61]
cmp ax, 5
ja 0x14000dd38
shl ebx, 4
mov eax, ecx
add eax, 0xffffffa9
add ebx, eax
inc edx
jmp 0x14000dce0
xor r9d, r9d
xor eax, eax
cmp r10d, 0x12
cmovbe eax, r9d
test eax, eax
je 0x14000df81
xorps xmm0, xmm0
lea rdx, [rsi + 0x10]
xor eax, eax
lea rcx, [rbp]
xor edi, edi
mov qword [rbp + 0x20], rax
mov r8, r10
mov dword [rbp + 0x1e8], edi
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
call fcn.140001820
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x100
call fcn.140001b70
lea rax, [rbp]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0x90]
lea rax, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x100
lea rax, [0x1400010d8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.140003570
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp - 0x10]
mov dword [rbp + 0x58], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x68], rax
lea r8, [rbp + 0x58]
mov qword [rbp + 0x60], rdi
mov edx, 0x20019
mov dword [rbp + 0x70], 0x40
lea rcx, [rsp + 0x48]
movdqu xmmword [rbp + 0x78], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14000dee3
mov rcx, qword [rsp + 0x48]
lea r9d, [rdi + 4]
lea r8, [rbp + 0x1e8]
lea rdx, [0x140001378]
call fcn.1400041c0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edi, dword [rbp + 0x1e8]
test edi, edi
je 0x14000dee3
cmp edi, 2
ja 0x14000dee3
mov r8d, dword [rsi + 0xc]
lea rdx, [rsi + 0x10]
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x34
xor eax, eax
mov dword [rsp + 0x68], ebx
inc r12d
mov qword [rbp - 0x74], rax
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x64], r12d
movups xmmword [rsp + 0x6c], xmm0
movups xmmword [rsp + 0x7c], xmm0
call fcn.140001820
movaps xmm0, xmmword [0x140001390]
lea rcx, [rsp + 0x60]
movaps xmm1, xmmword [0x1400013a0]
mov r8, r14
movzx eax, word [0x1400013d0]
mov edx, 0x76
movups xmmword [rbp - 0x6c], xmm0
mov word [rbp - 0x2c], ax
movaps xmm0, xmmword [0x1400013b0]
movups xmmword [rbp - 0x5c], xmm1
movaps xmm1, xmmword [0x1400013c0]
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm1
call fcn.14000c130
test eax, eax
cmovs r12d, dword [rbp + 0x1f0]
mov r14d, r12d
cmp edi, 3
jne 0x14000df77
mov r8d, dword [rsi + 0xc]
lea rdx, [rsi + 0x10]
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x34
xor eax, eax
mov dword [rsp + 0x68], ebx
inc r12d
mov qword [rbp - 0x74], rax
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x64], r12d
movups xmmword [rsp + 0x6c], xmm0
movups xmmword [rsp + 0x7c], xmm0
call fcn.140001820
movaps xmm0, xmmword [0x1400013e0]
lea edx, [rdi + 0x73]
movaps xmm1, xmmword [0x1400013f0]
lea rcx, [rsp + 0x60]
movzx eax, word [0x140001420]
mov r8, qword [rsp + 0x40]
movups xmmword [rbp - 0x6c], xmm0
mov word [rbp - 0x2c], ax
movaps xmm0, xmmword [0x140001400]
movups xmmword [rbp - 0x5c], xmm1
movaps xmm1, xmmword [0x140001410]
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm1
call fcn.14000c130
test eax, eax
cmovs r12d, r14d
mov r14, qword [rsp + 0x40]
mov edi, 8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x50]
inc r13d
cmp r13d, dword [rbx + 0x14]
jb 0x14000dc41
mov r15, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2b0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, r14
call fcn.1400042e0
mov r13, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x2b8]
xor eax, eax
add rsp, 0x2c0
pop r14
pop r12
pop rbp
ret