Function at 0x7fff25d6fcd0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rdx + 0x10]
xor r13d, r13d
mov eax, r13d
mov dword [r9 + 2], r13d
mov dword [rsp + 0x78], eax
mov r14, r9
mov r12, r8
mov byte [r9], al
mov rsi, rdx
mov ebx, ecx
mov r15d, r13d
mov dword [r9 + 8], r13d
cmp word [rbp], r13w
je 0x7fff25d6fd32
mov rcx, qword [rbp + 8]
mov edx, r13d
cmp word [rcx], 0x5c
mov ecx, r13d
sete dl
cmp qword [rsi + 8], rax
sete cl
cmp ecx, edx
jne 0x7fff25de6d40
and ebx, 0x300
cmp ebx, 0x300
je 0x7fff25d6ff1f
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7fff25d6fdf9
mov r9d, 4
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov edi, eax
test eax, eax
mov eax, dword [rsp + 0x78]
js 0x7fff25d6fd8c
and eax, 0xf01
mov dword [rsp + 0x78], eax
test edi, edi
js 0x7fff25d6fdd6
test ebx, ebx
jne 0x7fff25d6fda8
mov ebx, eax
and ebx, 0x300
cmp ebx, 0x300
je 0x7fff25d6ff1f
mov ecx, eax
and ecx, 0x401
or ecx, ebx
mov dword [r12], ecx
bt eax, 0xa
jb 0x7fff25d6fdc4
cmp ebx, 0x200
je 0x7fff25d6fe00
mov edi, r13d
cmp ecx, eax
mov rax, qword [rsp + 0x90]
setne cl
mov byte [rax], cl
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x70]
mov qword [rax], r15
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r8], ebx
mov ecx, ebx
jmp 0x7fff25d6fdbc
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, 0x1060
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x7fff25de6d4a
mov dword [rax], 0x8180000
lea rbx, [r15 + 0x10]
add rax, 0x20
mov word [rbx], r13w
mov qword [r15 + 8], rax
mov ecx, 0x818
lea rax, [r15 + 0x838]
mov word [r15 + 0x12], cx
mov qword [r15 + 0x18], rax
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7fff25d6fe93
mov rdx, r15
call fcn.7fff25db104c
mov edi, eax
test eax, eax
js 0x7fff25de6d54
lea rdx, [0x7fff25f08a88]
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25de6d54
mov rdx, rbp
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7fff25de6d54
call fcn.7fff25d4642c
mov word [rsp + 0x28], ax
lea rcx, [0x7fff25f01c70]
mov r9, r14
mov dword [rsp + 0x20], 0x200
mov r8, rbx
mov rdx, r15
call fcn.7fff25d8cd68
mov edi, eax
test eax, eax
js 0x7fff25de6d54
mov ecx, dword [r14 + 8]
test ecx, 0x300
jne 0x7fff25d6fefd
mov eax, dword [r12]
and eax, 0x300
or eax, ecx
mov ecx, eax
mov dword [r14 + 8], eax
mov eax, dword [rsp + 0x78]
mov dword [r12], ecx
cmp byte [r14], r13b
je 0x7fff25d6fdc7
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], rbx
mov ecx, dword [r12]
jmp 0x7fff25d6fdc7
mov edi, 0xc000000d
jmp 0x7fff25d6fdd6
mov edi, 0xc000003b
jmp 0x7fff25d6fdd6
mov edi, 0xc0000017
jmp 0x7fff25d6fdd6
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r15, r13
jmp 0x7fff25d6fdd6