Function at 0x140009cd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x8b8
mov rax, qword [0x1400358b0]
xor rax, rsp
mov qword [rsp + 0x8a0], rax
mov dword [rsp + 0x30], 0xc0000001
xor eax, eax
mov word [rsp + 0xd0], ax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 0x7ce
rep stosb byte [rdi], al
cmp qword [rsp + 0x8d0], 0
jne 0x140009d2b
mov eax, 0xc0000001
jmp 0x14000a0ae
lea rdx, [0x14002dc40]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x88], 0x30
mov qword [rsp + 0x90], 0
mov dword [rsp + 0xa0], 0x40
mov rax, qword [rsp + 0x8d0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
lea r8, [rsp + 0x88]
mov edx, 0x80000000
lea rcx, [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140009db6
mov eax, dword [rsp + 0x30]
jmp 0x14000a0ae
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x208
lea r9, [rsp + 0xd0]
mov r8d, 1
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140009dfd
mov eax, dword [rsp + 0x30]
jmp 0x14000a0ae
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r8d, 4
lea rdx, [0x14002dc60]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 4
jne 0x140009e86
lea rax, [0x140035a60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x38]
sub eax, 4
cdqe
mov rcx, qword [rsp + 0x40]
add rcx, 8
lea rdx, [0x140035a60]
mov rdi, rdx
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
jmp 0x140009f76
mov r8d, 0xc
lea rdx, [0x14002dc70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 0xc
jne 0x140009ee1
lea rax, [0x140035a60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x38]
sub eax, 0xc
cdqe
mov rcx, qword [rsp + 0x40]
add rcx, 0x18
lea rdx, [0x140035a60]
mov rdi, rdx
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
jmp 0x140009f76
mov r8d, 8
lea rdx, [0x14002dc90]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp rax, 8
jne 0x140009f4b
lea rax, [0x140035a60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [0x140035a60]
lea rcx, [0x14002dcb0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x38]
lea rcx, [0x140035a60]
add rcx, 0x16
mov rdi, rcx
mov rsi, qword [rsp + 0x40]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
jmp 0x140009f76
lea rax, [0x140035a60]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x38]
lea rcx, [0x140035a60]
mov rdi, rcx
mov rsi, qword [rsp + 0x40]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
lea rax, [0x140035a60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
cmp word [rax + rcx*2], 0
jne 0x140009f8b
mov rax, qword [rsp + 0x50]
test rax, rax
jne 0x140009fb5
mov eax, 0xc0000001
jmp 0x14000a0ae
mov r8d, 0x666b7467
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x140044188], rax
mov eax, 0x104
mov word [0x140044182], ax
mov rdi, qword [0x140044188]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
sub rax, 2
mov qword [rsp + 0x48], rax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
movzx eax, word [rcx + rax]
cmp eax, 0x5c
jne 0x140009ffe
movzx eax, word [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov rcx, rdx
sar rcx, 1
movzx ecx, cx
sub eax, ecx
cdqe
shl rax, 1
mov word [0x140044180], ax
movzx eax, word [0x140044180]
mov rcx, qword [rsp + 0x48]
add rcx, 2
mov rdi, qword [0x140044188]
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x140044188]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
cmp word [rax + rcx*2], 0
jne 0x14000a082
mov rax, qword [rsp + 0x58]
shl rax, 1
mov word [0x140044180], ax
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x8a0]
xor rcx, rsp
call fcn.14002cd90
add rsp, 0x8b8
pop rdi
pop rsi
ret