Function at 0x17008
Capabilities:
Create directory
Print debug messages
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xf0
mov rbx, rdx
mov rdi, rcx
lea rdx, [0x0001532c]
lea rcx, [0x00015328]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
movzx eax, word [rbx]
xor ebp, ebp
add ax, 0x18
xor ecx, ecx
mov r8d, 0x4f494d46
movzx edx, ax
mov word [rsp + 0x30], bp
mov word [rsp + 0x32], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp rax, rbp
jne 0x17093
lea rcx, [0x00013b70]
mov edx, 0xc000009a
mov r8d, 0x184
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc000009a
jmp 0x1729e
lea rcx, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x00017560]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
xor edx, edx
lea rcx, [rsp + 0x80]
lea r8d, [rdx + 0x70]
call fcn.00012dd0
mov rdx, qword [rsp + 0x38]
lea rax, [0x00017580]
mov qword [rsp + 0x90], rax
lea rax, [0x00015334]
lea r8, [rsp + 0x80]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x88], 0x24
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_RtlQueryRegistryValues]
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r11d, dword [0x00015334]
mov eax, 4
cmp ebx, ebp
lea rdx, [0x000175a0]
lea rcx, [rsp + 0x70]
cmovl r11d, eax
mov dword [0x00015334], r11d
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rcx, [0x00015320]
mov edx, 0xf000f
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x30
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x58], 0x10
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
call qword [sym.imp.ntoskrnl.exe_ZwCreateDirectoryObject]
cmp eax, ebp
mov ebx, eax
jge 0x171a7
mov r8d, 0x1a2
mov edx, eax
lea rcx, [0x00013b70]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x1729e
mov rcx, qword [0x00015320]
call qword [sym.imp.ntoskrnl.exe_ZwMakeTemporaryObject]
mov eax, dword [0x00015334]
mov esi, ebp
mov word [0x00015330], bp
mov r12d, 1
cmp eax, ebp
jbe 0x171f8
mov r8d, 7
mov edx, esi
mov rcx, rdi
call fcn.000172c4
cmp eax, ebp
mov ebx, eax
jl 0x171eb
add word [0x00015330], r12w
mov eax, dword [0x00015334]
add esi, r12d
cmp esi, eax
jb 0x171cd
mov esi, ebp
cmp eax, ebp
jbe 0x17227
mov r8d, 2
mov edx, esi
mov rcx, rdi
call fcn.000172c4
cmp eax, ebp
mov ebx, eax
jl 0x1721c
add word [0x00015330], r12w
add esi, r12d
cmp esi, dword [0x00015334]
jb 0x171fe
cmp word [0x00015330], bp
jne 0x17251
mov rcx, qword [0x00015320]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov qword [0x00015320], rbp
mov r8d, 0x1bc
mov edx, ebx
jmp 0x17194
call fcn.00012874
mov dword [0x00015110], eax
lea rax, [0x00011140]
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x80], rax
lea rax, [0x00011174]
mov qword [rdi + 0x88], rax
mov qword [rdi + 0x90], rax
lea rax, [0x000111ec]
mov qword [rdi + 0xe0], rax
lea rax, [0x00011008]
mov qword [rdi + 0x68], rax
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.000174dc
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp 0x17008