Function at 0x1dbf0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x0002c100]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor r13d, r13d
xor eax, eax
mov rbx, rdx
mov word [r11 - 0xb8], r13w
mov qword [r11 - 0xb6], rax
lea rcx, [r11 - 0x60]
lea r8d, [r13 + 0x28]
xor edx, edx
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov r12b, r13b
mov bpl, r13b
mov dword [rsp + 0x9a], eax
mov word [rsp + 0x9e], ax
mov dword [r11 - 0x68], r13d
call fcn.00028240
lea ecx, [r13 + 8]
lea rax, [0x00028930]
mov qword [rsp + 0x68], rax
lea rax, [0x00028940]
lea edx, [rcx + 0x10]
mov qword [rsp + 0xb8], rax
lea eax, [rcx + 0x12]
lea r8d, [r13 + 0xc]
mov word [rsp + 0xd2], ax
lea rax, [0x00028950]
lea r11d, [r13 + 0xa]
mov qword [rsp + 0xd8], rax
lea eax, [rcx - 2]
mov word [rsp + 0xd0], dx
mov word [rsp + 0x70], ax
lea rax, [0x00028970]
mov word [rsp + 0xa2], dx
mov qword [rsp + 0x78], rax
lea edx, [rcx + 0xa]
lea rax, [0x00029030]
mov qword [rsp + 0x88], rax
lea rax, [0x000289a0]
mov word [rsp + 0x62], r8w
mov qword [rsp + 0xa8], rax
lea rax, [0x00028980]
mov word [rsp + 0xb0], cx
mov qword [rsp + 0xc8], rax
lea rax, [0x00028de0]
mov word [rsp + 0x72], cx
lea ecx, [rdx + 2]
mov word [rsp + 0x82], r8w
lea r8d, [r13 + 0x16]
mov qword [rsp + 0x48], rax
lea rax, [0x00028e00]
mov word [rsp + 0x60], r11w
mov word [rsp + 0xb2], r11w
mov word [rsp + 0x80], r11w
mov word [rsp + 0xa0], r8w
mov qword [rsp + 0x58], rax
mov word [rsp + 0xc0], dx
mov word [rsp + 0xc2], cx
mov word [rsp + 0x40], cx
mov word [rsp + 0x42], r8w
mov word [rsp + 0x50], cx
mov word [rsp + 0x52], r8w
cmp dword [rbx + 0x360], edx
je 0x1dd96
mov eax, 0xc00000cd
jmp 0x1e4f5
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x90]
call qword [fcn.004e696c]
lea rax, [rsp + 0x90]
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x38]
mov edx, 0xf003f
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0xe0], 0x30
mov qword [rsp + 0xe8], r13
mov dword [rsp + 0xf8], 0x240
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x1e4f5
mov r14d, 0x2000
xor ecx, ecx
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, r13
je 0x1e4b7
mov r8, r14
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
mov r15d, 2
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x28], r11
mov r9, rdi
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea esi, [r15 + 2]
cmp eax, r13d
jge 0x1de96
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x364]
lea rdx, [rsp + 0xb0]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1dea6
mov eax, dword [rbx + 0x364]
cmp dword [rdi + 0xc], eax
je 0x1decf
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x364]
lea rdx, [rsp + 0xb0]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1df31
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x36c]
lea rdx, [rsp + 0x60]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1df41
mov eax, dword [rbx + 0x36c]
cmp dword [rdi + 0xc], eax
je 0x1df67
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x36c]
lea rdx, [rsp + 0x60]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0xd0]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1dfcf
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x370]
lea rdx, [rsp + 0xd0]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1dfdf
mov eax, dword [rbx + 0x370]
cmp dword [rdi + 0xc], eax
je 0x1e008
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x370]
lea rdx, [rsp + 0xd0]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1e06a
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x368]
lea rdx, [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1e07a
mov eax, dword [rbx + 0x368]
cmp dword [rdi + 0xc], eax
je 0x1e0a0
mov rcx, qword [rsp + 0x38]
lea rax, [rbx + 0x368]
lea rdx, [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, 1
cmp eax, r13d
jge 0x1e113
mov eax, dword [rbx + 0x374]
lea rcx, [rbx + 0x2a0]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov r9d, esi
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1e12e
lea rdx, [rbx + 0x2a0]
lea rcx, [rdi + 0xc]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r13d
je 0x1e15d
mov eax, dword [rbx + 0x374]
lea rcx, [rbx + 0x2a0]
lea rdx, [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x38]
mov r9d, esi
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1e1c8
mov eax, dword [rbx + 0x378]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], esi
jne 0x1e1e0
mov rdx, qword [rbx + 8]
lea rcx, [rdi + 0xc]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r13d
je 0x1e20c
mov eax, dword [rbx + 0x378]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0xc0]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1e27a
mov eax, dword [rbx + 0x388]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x380]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
cmp dword [rdi + 4], r15d
jne 0x1e296
mov rdx, qword [rbx + 0x380]
lea rcx, [rdi + 0xc]
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
cmp eax, r13d
je 0x1e2c5
mov eax, dword [rbx + 0x388]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0xc0]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x380]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rbx + 0x390]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
mov esi, 3
cmp al, r13b
je 0x1e3de
mov eax, dword [rbx + 0x398]
cmp eax, r13d
je 0x1e3de
cmp eax, 0x1ff0
jae 0x1e3de
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jge 0x1e37c
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov r11d, dword [rbx + 0x398]
mov rax, qword [rbx + 0x390]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], r11d
lea rdx, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r12b, 1
jmp 0x1e4ac
cmp dword [rdi + 4], esi
jne 0x1e39d
mov r8d, dword [rbx + 0x398]
mov rdx, qword [rbx + 0x390]
lea rcx, [rdi + 0xc]
call fcn.00028720
cmp eax, r13d
je 0x1e3de
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov r11d, dword [rbx + 0x398]
mov rax, qword [rbx + 0x390]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], r11d
lea rdx, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov r12b, 1
mov rcx, qword [rbx + 0x3a0]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, r13b
je 0x1e4ac
mov eax, dword [rbx + 0x3a8]
cmp eax, r13d
je 0x1e4ac
cmp eax, 0x1ff0
jae 0x1e4ac
mov r8, r14
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], r13d
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r9, rdi
mov qword [rsp + 0x28], r11
mov r8d, r15d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, r13d
jl 0x1e46b
cmp dword [rdi + 4], esi
jne 0x1e46b
mov r8d, dword [rbx + 0x3a8]
mov rdx, qword [rbx + 0x3a0]
lea rcx, [rdi + 0xc]
call fcn.00028720
cmp eax, r13d
je 0x1e4ac
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
mov r11d, dword [rbx + 0x3a8]
mov rax, qword [rbx + 0x3a0]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], r11d
lea rdx, [rsp + 0x50]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov bpl, 1
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x1e4c7
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp r12b, r13b
je 0x1e4dd
mov rcx, qword [0x00065e90]
xor r8d, r8d
xor edx, edx
call fcn.0001a460
cmp bpl, r13b
je 0x1e4f3
mov rcx, qword [0x00065e90]
xor r8d, r8d
xor edx, edx
call fcn.0001a52c
xor eax, eax
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.000281c0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret