Function at 0x18740
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x90
xor edi, edi
mov qword [rax - 0x70], rdi
lea rdx, [0x0001aee0]
lea rcx, [rax - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x60], 0x30
and qword [rsp + 0x68], rdi
mov dword [rsp + 0x78], 0x240
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
and qword [rsp + 0x80], rdi
and qword [rsp + 0x88], rdi
lea r8, [rsp + 0x60]
mov edx, 0xf003f
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x18a11
lea rdx, [0x0001af70]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x28], r11
and dword [rsp + 0x20], edi
xor r9d, r9d
lea r12d, [rdi + 2]
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x18867
cmp eax, 0xc0000023
je 0x1882f
cmp eax, 0x80000005
je 0x1882f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18a11
mov edx, dword [rsp + 0xb0]
mov ecx, 1
mov r8d, 0x62525249
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18867
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18a11
test rdi, rdi
je 0x18a02
cmp dword [rsp + 0xb0], 0
je 0x18a02
mov r8d, dword [rsp + 0xb0]
xor edx, edx
mov rcx, rdi
call fcn.00011320
lea r11, [rsp + 0xb0]
mov qword [rsp + 0x28], r11
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, r12d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x188de
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18a11
lea r12, [rdi + 0xc]
test r12, r12
je 0x189e9
cmp dword [rdi + 8], 0
je 0x189e9
xor edx, edx
mov r8d, 0x208
lea r14, [0x00014b20]
mov rcx, r14
call fcn.00011320
mov r13d, 0x104
mov r8, r13
lea rdx, [0x0001af90]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
mov r8d, dword [rdi + 8]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
mov r11d, dword [rdi + 8]
cmp word [r11 + rdi + 8], 0x5c
jne 0x18957
mov r8, r13
lea rdx, [0x0001afa0]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
jmp 0x1896a
mov r8, r13
lea rdx, [0x0001afc0]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
xor edx, edx
mov r8d, 0x208
lea r14, [0x00014900]
mov rcx, r14
call fcn.00011320
mov r8, r13
lea rdx, [0x0001af90]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
mov r8d, dword [rdi + 8]
mov rdx, r12
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
mov r11d, dword [rdi + 8]
cmp word [r11 + rdi + 8], 0x5c
jne 0x189c6
mov r8, r13
lea rdx, [0x0001afe0]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
jmp 0x189d9
mov r8, r13
lea rdx, [0x0001b010]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_wcsncat]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18a11
mov esi, 0x80000005
mov dword [rsp + 0x30], esi
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x18a11
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
nop
test rdi, rdi
je 0x18a24
mov edx, 0x62525249
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, esi
lea r11, [rsp + 0x90]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret