Function at 0x38ad4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x400
mov rax, qword [0x000a7100]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov r12, rdx
mov rsi, rcx
lea rcx, [rsp + 0xf0]
lea rdx, [0x00096670]
mov r8d, 0xa0
call fcn.00091720
xor r13d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
lea r9, [rsp + 0x50]
lea r8, [0x00096710]
lea rdx, [0x00096730]
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x48], 0x12c
mov qword [rsp + 0x20], r13
call fcn.00037e68
mov r14d, 0xc0000000
mov ecx, eax
mov ebx, eax
lea rdi, [0x000967d0]
and ecx, r14d
cmp ecx, r14d
jne 0x38be2
lea rcx, [0x000961e0]
mov edx, eax
call fcn.0004505c
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0xf0]
mov r8, rdi
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.00037e68
mov ebx, eax
and eax, r14d
cmp eax, r14d
jne 0x38d89
lea rcx, [0x000967f0]
mov edx, ebx
call fcn.0004505c
jmp 0x38d98
mov rbp, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rbp, rax
je 0x38c14
mov rdx, qword [rbp + 0x20]
lea rcx, [0x00096850]
call fcn.0004505c
mov rbp, qword [rbp]
lea rax, [rsp + 0x50]
cmp rbp, rax
jne 0x38bf1
mov rbp, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rbp, rax
je 0x38d98
lea rcx, [rsp + 0x190]
xor edx, edx
mov r8d, 0x258
call fcn.00091d10
mov r9, qword [rbp + 0x20]
lea r8, [0x00096870]
lea rcx, [rsp + 0x190]
mov edx, 0x12c
call fcn.00014458
lea rdx, [rsp + 0x190]
lea rcx, [0x00096920]
call fcn.0004505c
lea rax, [rsp + 0x40]
lea r8, [0x00096940]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x190]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x44], r13d
mov qword [rsp + 0x20], rax
call fcn.00037e68
mov ebx, eax
and eax, r14d
cmp eax, r14d
jne 0x38cc2
lea rcx, [0x00096960]
jmp 0x38d70
mov edx, dword [rsp + 0x44]
lea rcx, [0x00096990]
call fcn.0004505c
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x190]
cmp dword [rsp + 0x44], r13d
je 0x38d38
lea r8, [0x000969c0]
call fcn.00037e68
mov ebx, eax
and eax, r14d
cmp eax, r14d
je 0x38d2f
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 5
ja 0x38d80
lea rdi, [0x000967d0]
lea rcx, [0x000969e0]
jmp 0x38d70
mov r8, rdi
call fcn.00037e68
mov ebx, eax
and eax, r14d
cmp eax, r14d
je 0x38d69
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 5
ja 0x38d89
lea rdi, [0x000967d0]
lea rcx, [0x000967f0]
mov edx, ebx
call fcn.0004505c
mov rbp, qword [rbp]
jmp 0x38c14
lea rcx, [0x00096a10]
jmp 0x38d90
lea rcx, [0x00096820]
mov rdx, rsi
call fcn.0004505c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [0x00096a40]
call fcn.0004505c
mov ebp, ebx
shr ebp, 0x1e
cmp ebp, 3
je 0x38dd9
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 5
ja 0x38e31
lea rax, [rsp + 0x40]
lea r8, [0x000967d0]
lea rdx, [rsp + 0xf0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call fcn.00037e68
mov ebp, eax
mov ebx, eax
shr ebp, 0x1e
cmp ebp, 3
jne 0x38e22
lea rcx, [0x00096a60]
mov edx, eax
call fcn.0004505c
jmp 0x38e31
lea rcx, [0x00096a90]
mov rdx, rsi
call fcn.0004505c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [0x00096a40]
call fcn.0004505c
cmp ebp, 3
je 0x38e71
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 5
ja 0x38fc4
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x70]
call fcn.00091d10
lea rdx, [0x00096ac0]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_RtlCheckRegistryKey]
mov ebx, eax
and eax, r14d
cmp eax, r14d
jne 0x38eb3
lea rcx, [0x00096b00]
mov edx, ebx
call fcn.0004505c
jmp 0x38fed
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [r12]
lea rax, [0x000967d0]
xor r9d, r9d
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x48], ecx
lea rax, [rsp + 0x60]
lea r8, [rsp + 0x80]
lea rdx, [0x00096ac0]
lea ecx, [r9 + 1]
mov dword [rsp + 0x88], 0x134
mov dword [rsp + 0xa0], 0x7000000
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0xb0], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
mov ebx, eax
and eax, r14d
cmp eax, r14d
jne 0x38f45
lea rcx, [0x00096b30]
mov edx, ebx
call fcn.0004505c
jmp 0x38fc4
movaps xmm0, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [0x00096b60]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.0004505c
movzx edx, word [rsp + 0x60]
cmp dx, r13w
je 0x38fe1
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
je 0x38fe1
mov eax, dword [rsp + 0x48]
movzx r8d, dx
add rax, rax
cmp rax, r8
jbe 0x38faf
mov rdx, rcx
mov rcx, rsi
call fcn.00091720
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov rcx, qword [rsp + 0x68]
cmp al, r13b
je 0x38faf
movzx eax, word [rsp + 0x60]
shr eax, 1
mov dword [r12], eax
cmp rcx, r13
je 0x38fc4
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov qword [rsp + 0x68], r13
cmp r12, r13
je 0x38fed
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov dword [r12], ecx
jmp 0x38fed
lea rcx, [0x00096b90]
call fcn.0004505c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x39020
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rax + 8], rdx
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x39020
mov edx, dword [rcx + 0x14]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.000916b0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret