Function at 0x1e990
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
xor esi, esi
mov r12, rdx
lea rcx, [rax - 0x88]
lea edi, [rsi + 0x28]
xor edx, edx
mov qword [rsp + 0x38], rsi
mov r8, rdi
mov qword [rsp + 0x30], rsi
mov dword [rax + 0x20], esi
mov rbx, rsi
mov dword [rax - 0x90], esi
call fcn.00028240
lea rcx, [rsp + 0x80]
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x78], esi
call fcn.00028240
lea eax, [rsi + 0xa]
mov word [rsp + 0x52], ax
lea rax, [0x00029060]
lea edi, [rsi + 8]
mov qword [rsp + 0x58], rax
movabs rax, 0x100000001
lea rdx, [0x00029070]
lea rcx, [rsp + 0xd8]
xor r15b, r15b
mov word [rsp + 0x50], di
mov qword [rsp + 0x48], rax
xor r13d, r13d
mov byte [rsp + 0x150], r15b
call qword [fcn.004e696c]
and qword [rsp + 0xb0], rbx
and qword [rsp + 0xc8], rbx
and qword [rsp + 0xd0], rbx
lea rax, [rsp + 0xd8]
lea r8, [rsp + 0xa8]
lea rcx, [rsp + 0x38]
mov edx, 0xf003f
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0xa8], 0x30
mov dword [rsp + 0xc0], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
or r14, 0xffffffffffffffff
lea rbp, [0x00029100]
test eax, eax
js 0x1ec29
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x1ec29
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.00028240
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x158]
mov qword [rsp + 0x28], rdx
lea r8d, [rsi + 2]
lea rdx, [rsp + 0x50]
mov r9, rbx
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x1ec29
cmp dword [rbx + 4], 7
jne 0x1ec29
mov edx, dword [rbx + 8]
test edx, edx
je 0x1ec29
lea r12, [rbx + 0xc]
lea ecx, [r13 + 8]
mov rsi, rbp
mov rdi, r12
repe cmpsw word [rsi], word [rdi]
je 0x1ec19
xor eax, eax
mov rcx, r14
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea eax, [rdx + rcx*2]
xor ecx, ecx
mov edx, eax
mov dword [rsp + 0x40], eax
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r13, rax
test rax, rax
je 0x1ec1c
xor eax, eax
mov rcx, r14
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea edx, [rcx + rcx]
mov rcx, r13
mov edi, edx
mov r8d, edx
mov rdx, rbp
call fcn.000283d0
lea rax, [rsi + r13]
lea rbp, [rdi + r13]
mov r15, rax
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
lea rsi, [0x00029100]
mov rdi, r12
not rcx
lea r14d, [rcx + rcx]
lea ecx, [rax + 8]
repe cmpsw word [rsi], word [rdi]
je 0x1ebc3
mov r8d, r14d
mov rdx, r12
mov rcx, rbp
mov edi, r14d
call fcn.000283d0
add rbp, rdi
mov eax, r14d
add r12, rax
cmp rbp, r15
jae 0x1ebe2
mov eax, dword [rbx + 8]
mov r14, 0xffffffffffffffff
lea rcx, [rax + rbx + 0xc]
cmp r12, rcx
jb 0x1eb8b
mov r15b, byte [rsp + 0x150]
sub ebp, r13d
cmp ebp, dword [rsp + 0x40]
ja 0x1ec1c
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x1ec1c
mov r15b, 1
mov r12, qword [rsp + 0x148]
mov edi, 8
lea rdx, [0x00029110]
lea rcx, [rsp + 0xe8]
call qword [fcn.004e696c]
and qword [rsp + 0x80], 0
and qword [rsp + 0x98], 0
and qword [rsp + 0xa0], 0
lea rax, [rsp + 0xe8]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x30]
mov edx, 0xf003f
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0x30
mov dword [rsp + 0x90], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov esi, eax
lea rbp, [0x00029040]
test eax, eax
js 0x1ed5d
test rbx, rbx
jne 0x1ecc0
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbx, rax
test rax, rax
je 0x1ed5d
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call fcn.00028240
lea rcx, [rsp + 0x60]
lea rdx, [0x00029100]
test r15b, r15b
jne 0x1ece4
mov rdx, rbp
call qword [fcn.004e696c]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x158]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x60]
mov r9, rbx
mov r8d, 2
mov dword [rsp + 0x20], 0x1000
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov esi, eax
test eax, eax
js 0x1ed34
cmp dword [rbx + 4], 3
jne 0x1ed34
cmp dword [rbx + 8], edi
jne 0x1ed34
mov rax, qword [rsp + 0x48]
cmp qword [rbx + 0xc], rax
je 0x1ed5d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov esi, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1ed73
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1ed89
call qword [sym.imp.ntoskrnl.exe_ZwClose]
and qword [rsp + 0x30], 0
test rbx, rbx
je 0x1ed99
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test r13, r13
je 0x1eda9
xor edx, edx
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
or rcx, 0xffffffffffffffff
test r15b, r15b
je 0x1edc4
lea rdi, [0x00029100]
lea rdx, [0x00029100]
jmp 0x1edca
mov rdi, rbp
mov rdx, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx + rcx]
mov rcx, r12
call fcn.000283d0
mov rbx, qword [rsp + 0x140]
mov eax, esi
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret