Function at 0x1400e1700
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xc0
mov qword [rax + 0x10], rbx
mov rbx, qword [rcx]
add rbx, qword [0x14018dfb8]
add rbx, qword [0x14018deb0]
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rdi
mov rdi, rcx
mov qword [rax - 0x28], r13
mov r13, rdx
mov rdx, qword [0x140196800]
lea rcx, [rbx + 0x12]
mov qword [rax - 0x30], r14
call sym.ProcessHacker.exe_PhCreateObject
xor ebp, ebp
mov qword [rsp + 0x38], rax
mov rsi, rax
mov qword [rax], rbx
lea r8, [rax + 0x10]
mov qword [rax + 8], r8
mov word [r8 + rbx], bp
mov rbx, qword [rax + 8]
mov r8, qword [0x14018deb0]
mov rcx, rbx
mov rdx, qword [str.SystemCurrentControlSetServices_]
call fcn.14010e700
add rbx, qword [0x14018deb0]
mov r8, qword [rdi]
mov rcx, rbx
mov rdx, qword [rdi + 8]
call fcn.14010e700
add rbx, qword [rdi]
mov r8, qword [0x14018dfb8]
mov rcx, rbx
mov rdx, qword [str.Parameters]
call fcn.14010e700
movzx eax, word [rsi]
or r14d, 0xffffffff
mov word [rsp + 0x40], ax
add ax, 2
cmp qword [rsi], 0xfffe
mov word [rsp + 0x42], ax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x48], rax
jbe 0x1400e17da
mov esi, 0xc0000106
jmp 0x1400e19a8
xor r8d, r8d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x40]
lea rcx, [r8 - 3]
call fcn.1400da6c0
mov esi, eax
test eax, eax
js 0x1400e182a
lea r8, [rsp + 0x60]
mov edx, 0x20019
lea rcx, [rsp + 0xe8]
call qword [sym.imp.ntdll.dll_NtOpenKey]
mov rcx, qword [rsp + 0x30]
mov esi, eax
test rcx, rcx
je 0x1400e182a
call qword [sym.imp.ntdll.dll_NtClose]
test esi, esi
js 0x1400e19a8
mov rcx, qword [0x140196670]
lea rax, str.ServiceDll
mov qword [rsp + 0xa8], r12
mov r8d, 0x100
mov r12, qword [rsp + 0xe8]
mov qword [rsp + 0x90], r15
mov r15d, 0x10
mov dword [rsp + 0x50], 0x160014
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xd0], 0x100
lea edx, [r15 - 0xc]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
nop dword [rax]
lea rax, [rsp + 0xd0]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov eax, dword [rsp + 0xd0]
mov r8d, 2
mov rcx, r12
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test eax, eax
jns 0x1400e190c
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp edi, 0x80000005
jne 0x1400e1904
mov r8d, dword [rsp + 0xd0]
mov edx, 4
mov rcx, qword [0x140196670]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
add r15d, 0xffffffff
jne 0x1400e1890
jmp 0x1400e190c
mov rbx, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0xa8]
test edi, edi
js 0x1400e1995
mov ecx, dword [rbx + 4]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400e1930
cmp ecx, 7
jne 0x1400e194f
mov eax, dword [rbx + 8]
cmp eax, 2
jb 0x1400e1947
lea rdx, [rax - 2]
lea rcx, [rbx + 0xc]
call sym.ProcessHacker.exe_PhCreateStringEx
jmp 0x1400e194c
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov rbp, rax
mov rcx, qword [0x140196670]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rbp, rbp
je 0x1400e1995
mov rcx, rbp
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
test rax, rax
je 0x1400e198f
mov qword [r13], rax
lea rcx, [rbp - 0x10]
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400e199a
call fcn.1400c8bc0
jmp 0x1400e199a
mov qword [r13], rbp
jmp 0x1400e199a
mov esi, 0xc0000225
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], r14d
mov r13, qword [rsp + 0xa0]
cmp r14d, 1
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xd8]
jne 0x1400e19ea
call fcn.1400c8bc0
mov eax, esi
add rsp, 0xc0
pop rsi
ret