Function at 0x14001bedc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rdx
mov r12, rcx
xor ebp, ebp
mov r14d, 0x118
mov edx, r14d
mov dword [rax + 0x18], ebp
mov r8d, 0x75417953
mov ecx, 0x400
mov esi, ebp
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140018e70], bpl
mov rdi, rax
jne 0x14001c002
test rax, rax
je 0x14001c00b
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.14000ae80
mov r15d, ebp
lea rax, [rsp + 0x80]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, r15d
mov dword [rsp + 0x20], r14d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
je 0x14001c146
cmp eax, 0xc0000023
je 0x14001c015
cmp eax, 0x80000005
je 0x14001c015
test eax, eax
js 0x14001c127
mov ebx, dword [rdi + 0x10]
mov r8d, 0x75417953
mov ecx, 0x400
lea rdx, [rbx + 4]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140018e70], bpl
mov rsi, rax
jne 0x14001bfd1
test rax, rax
je 0x14001bfd1
lea r8, [rbx + 4]
xor edx, edx
mov rcx, rax
call fcn.14000ae80
mov edx, dword [rdi + 0x10]
mov r8d, 0x7ffffffe
lea rcx, [rdx + 4]
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, r8
ja 0x14001c0e6
shr rdx, 1
cmp rdx, r8
jbe 0x14001c0aa
mov word [rsi], bp
jmp 0x14001c0e6
test rax, rax
jne 0x14001bf45
mov ebx, 0xc000009a
jmp 0x14001c15b
mov ebx, 0x75417953
mov rcx, rdi
mov edx, ebx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r14d, dword [rsp + 0x80]
mov r8d, ebx
mov edx, r14d
mov ecx, 0x400
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
cmp byte [0x140018e70], 0
mov rbx, rax
mov rdi, rax
jne 0x14001c09c
test rax, rax
je 0x14001c09c
mov r8d, r14d
xor edx, edx
mov rcx, rax
call fcn.14000ae80
xor ebp, ebp
lea rax, [rsp + 0x80]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov r8d, 1
mov edx, r15d
mov dword [rsp + 0x20], r14d
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateValueKey]
mov ebx, eax
cmp eax, 0x8000001a
jne 0x14001bf92
mov ebx, ebp
jmp 0x14001c14d
xor ebp, ebp
test rbx, rbx
jne 0x14001c061
mov ebx, 0xc000009a
jmp 0x14001c127
sub rdx, rcx
mov r9, rdi
sub r9, rsi
mov r8, rsi
lea rax, [rdx + rcx]
test rax, rax
je 0x14001c0d8
movzx eax, word [r9 + r8 + 0x14]
test ax, ax
je 0x14001c0d8
mov word [r8], ax
add r8, 2
sub rcx, 1
jne 0x14001c0b6
test rcx, rcx
lea rax, [r8 - 2]
cmovne rax, r8
mov word [rax], bp
mov eax, dword [rdi + 0x10]
lea rcx, [rsp + 0x30]
shr rax, 1
mov rdx, rsi
mov word [rsi + rax*2], bp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [rdi + 8]
lea rdx, [rsp + 0x30]
mov eax, dword [rdi + 0xc]
add rcx, rdi
mov r9d, dword [rdi + 4]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov ebx, eax
test rsi, rsi
je 0x14001c13a
mov edx, 0x75417953
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test ebx, ebx
js 0x14001c148
inc r15d
jmp 0x14001bf48
mov ebx, ebp
test rdi, rdi
je 0x14001c15b
mov edx, 0x75417953
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret