Function at 0x7fff25dc49b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
mov r14, r8
mov rcx, qword gs:[0x60]
mov rbp, rdx
xor r12d, r12d
mov edi, 0x3000
mov r8d, edi
mov dword [rsp + 0x98], r12d
xor edx, edx
mov r15d, r12d
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x7fff25dff792
mov r8d, edi
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8d, 0x202
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
lea edi, [r12 + 8]
mov r13, rax
test rax, rax
je 0x7fff25dc4b8a
mov qword [rbx + 8], r14
test rbp, rbp
je 0x7fff25dff79c
cmp word [rbp], r12w
je 0x7fff25dff79c
mov qword [rsp + 0x28], r12
mov r9d, 0x2000000
mov r8d, edi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call sym.KERNELBASE.dll_RegOpenKeyExInternalW
mov esi, eax
test eax, eax
jne 0x7fff25dc4b56
mov rsi, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.7fff25dc4c34
mov esi, eax
test eax, eax
jne 0x7fff25dff7a4
lea r12d, [rax + 1]
mov r14, rbx
xor r9d, r9d
mov edx, dword [r14 + 0x10]
mov r8, r13
mov rcx, qword [r14]
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r9
lea eax, [rdx + 1]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x40]
mov dword [r14 + 0x10], eax
mov dword [rsp + 0x40], 0x100
call sym.KERNELBASE.dll_RegEnumKeyExW
mov esi, eax
cmp eax, 0x103
jne 0x7fff25dc4bc9
xor r9d, r9d
test r15, r15
jle 0x7fff25dc4b29
mov rcx, qword [r14]
call sym.KERNELBASE.dll_RegCloseKey
mov rcx, qword [r14 + 8]
call sym.KERNELBASE.dll_RegCloseKey
xor r9d, r9d
mov qword [r14], r9
mov qword [r14 + 8], r9
mov dword [r14 + 0x10], r9d
mov esi, r9d
mov rax, 0xffffffffffffffe8
or r8, 0xffffffffffffffff
mov edx, r8d
mov ecx, r8d
add dword [rsp + 0x98], edx
add r12d, ecx
add r14, rax
add r15, r8
jns 0x7fff25dc4abe
xor r12d, r12d
test rbp, rbp
je 0x7fff25dc4b6a
cmp word [rbp], r12w
je 0x7fff25dc4b6a
mov rcx, qword [rbx]
call sym.KERNELBASE.dll_RegCloseKey
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov edi, esi
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ecx, ecx
test eax, eax
jne 0x7fff25dc4c1c
cmp r12d, 0x200
jge 0x7fff25dc4c1a
mov eax, dword [rsp + 0x40]
mov r8, r13
mov word [r13 + rax*2], cx
mov rdx, qword [r14 + 8]
movsxd rax, r12d
lea rcx, [rax + rax*2]
lea r9, [rbx + rcx*8]
mov rcx, qword [r14]
lea rax, [r9 + 8]
mov qword [rsp + 0x20], rax
call fcn.7fff25dc4c34
xor r9d, r9d
mov esi, eax
test eax, eax
jne 0x7fff25dc4c1c
lea eax, [rsi + 0x18]
lea r8d, [rsi + 1]
jmp 0x7fff25dc4b37
mov esi, edi
mov r15d, dword [rsp + 0x98]
xor r12d, r12d
jmp 0x7fff25dff7a4