Function at 0x133ba
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1abe0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x68]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x28], ax
lea edi, [ebp - 0x26]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ebx, dword [ebp + 8]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov word [ebp - 0x30], ax
lea edi, [ebp - 0x2e]
stosd dword es:[edi], eax
xor esi, esi
stosw word es:[edi], ax
lea eax, [ebp - 0x6c]
push eax
push 0x20019
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x19], 0
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], 0x240
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
cmp edi, esi
jl 0x13945
mov ax, word [ebx]
mov word [0x1b048], ax
mov ax, word [ebx + 2]
mov esi, 0x1b048
push esi
mov word [0x1b04a], ax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x13945
push ebx
push esi
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x144c4
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x19], 1
call ebx
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
cmp eax, 0xc0000023
je 0x134c9
cmp eax, 0x80000005
je 0x134c9
mov edi, 0xc000000d
jmp 0x13945
push 0x70737474
push dword [ebp - 0x44]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x134ea
mov edi, 0xc000009a
jmp 0x13931
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x44]
push eax
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
mov edi, eax
test edi, edi
jl 0x13931
mov eax, dword [ebp - 0x34]
mov ax, word [eax + 8]
sub ax, 2
push 0x1b040
mov word [0x1b042], ax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x13931
mov edi, dword [ebp - 0x34]
mov eax, dword [edi + 8]
dec eax
dec eax
push eax
lea eax, [edi + 0xc]
push eax
push dword [0x1b044]
call sub.ntoskrnl.exe_memcpy
mov ax, word [edi + 8]
sub ax, 2
add esp, 0xc
mov word [0x1b040], ax
push 0x144b0
lea eax, [ebp - 0x28]
push eax
call ebx
lea eax, [ebp - 0x3c]
push eax
xor edi, edi
push edi
push edi
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
cmp eax, 0xc0000023
je 0x1358b
cmp eax, 0x80000005
je 0x1358b
mov edi, 0xc000000d
jmp 0x13931
push 0x70737474
push dword [ebp - 0x3c]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x48], eax
cmp eax, edi
jne 0x135ab
mov edi, 0xc000009a
jmp 0x1391d
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 0x3c]
push eax
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
mov edi, eax
test edi, edi
jl 0x1391d
mov eax, dword [ebp - 0x48]
mov ax, word [eax + 8]
sub ax, 2
push 0x1b050
mov word [0x1b052], ax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x1391d
mov edi, dword [ebp - 0x48]
mov eax, dword [edi + 8]
dec eax
dec eax
push eax
lea eax, [edi + 0xc]
push eax
push dword [0x1b054]
call sub.ntoskrnl.exe_memcpy
mov ax, word [edi + 8]
add esp, 0xc
push 2
pop edi
sub ax, di
push 0x1b050
mov word [0x1b050], ax
call fcn.00012eee
push 0x14590
lea eax, [ebp - 0x28]
push eax
call ebx
lea eax, [ebp - 0x54]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
test eax, eax
jl 0x1364d
mov eax, dword [ebp - 0xc]
mov dword [0x1b110], eax
push 0x1457a
lea eax, [ebp - 0x28]
push eax
call ebx
lea eax, [ebp - 0x38]
push eax
push 0
push 0
push edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
cmp eax, 0xc0000023
je 0x13682
cmp eax, 0x80000005
je 0x13682
mov edi, 0xc000000d
jmp 0x1391d
push 0x70737474
push dword [ebp - 0x38]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x136a3
mov edi, 0xc000009a
jmp 0x13909
lea ecx, [ebp - 0x38]
push ecx
push dword [ebp - 0x38]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
mov edi, eax
test edi, edi
jl 0x13909
push 0x14564
lea eax, [ebp - 0x28]
push eax
call ebx
lea eax, [ebp - 0x40]
push eax
xor edi, edi
push edi
push edi
push 2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
call esi
cmp eax, 0xc0000023
je 0x136f5
cmp eax, 0x80000005
je 0x136f5
mov edi, 0xc000000d
jmp 0x13909
push 0x70737474
push dword [ebp - 0x40]
push edi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
mov dword [ebp - 0x50], ebx
cmp ebx, edi
jne 0x13717
mov edi, 0xc000009a
jmp 0x138f9
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
lea eax, [ebp - 0x28]
push ebx
push 2
push eax
push dword [ebp - 0x20]
call esi
mov edi, eax
test edi, edi
jl 0x138f9
mov ax, word [ebx + 8]
sub ax, 2
mov esi, 0x1b030
push esi
mov word [0x1b032], ax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x138f9
mov eax, dword [ebx + 8]
dec eax
dec eax
push eax
lea eax, [ebx + 0xc]
push eax
push dword [0x1b034]
call sub.ntoskrnl.exe_memcpy
mov ax, word [ebx + 8]
add esp, 0xc
sub ax, 2
mov ebx, 0x145a2
mov word [0x1b030], ax
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x13787
sub eax, ecx
mov ecx, dword [0x1b032]
sar eax, 1
lea eax, [ecx + eax*2]
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x30]
push eax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x138f6
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.00013222
mov edi, eax
test edi, edi
jl 0x138f6
movzx eax, word [0x1b030]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.000132b4
mov edi, eax
test edi, edi
jl 0x138f6
lea eax, [ebp - 0x30]
push eax
call fcn.0001097c
mov edi, eax
test edi, edi
jl 0x138f6
lea eax, [ebp - 0x30]
push eax
call fcn.00012478
mov esi, dword [ebp - 0x4c]
mov ax, word [esi + 8]
sub ax, 2
push 0x1b028
mov word [0x1b02a], ax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x138f6
mov eax, dword [esi + 8]
dec eax
dec eax
push eax
lea eax, [esi + 0xc]
push eax
push dword [0x1b02c]
call sub.ntoskrnl.exe_memcpy
mov ax, word [esi + 8]
add esp, 0xc
sub ax, 2
mov word [0x1b028], ax
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x13851
sub eax, ecx
mov ecx, dword [0x1b02a]
sar eax, 1
lea eax, [ecx + eax*2]
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x30]
push eax
call fcn.00012440
mov edi, eax
test edi, edi
jl 0x138f6
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.00013222
mov edi, eax
test edi, edi
jl 0x138f6
movzx eax, word [0x1b028]
push eax
mov ebx, 0x1b028
push ebx
lea eax, [ebp - 0x30]
push eax
call fcn.000132b4
mov edi, eax
test edi, edi
jl 0x138f6
lea eax, [ebp - 0x30]
push eax
call fcn.0001097c
mov edi, eax
test edi, edi
jl 0x138f6
lea eax, [ebp - 0x30]
push eax
call fcn.00012478
push 0x70737474
push dword [esi + 8]
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [0x1b0ac], eax
test eax, eax
je 0x138f6
push dword [esi + 8]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push dword [esi + 8]
push dword [0x1b0ac]
push ebx
call fcn.0001337e
mov ebx, dword [ebp - 0x50]
test ebx, ebx
je 0x13909
push 0x70737474
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x4c], 0
je 0x1391d
push 0x70737474
push dword [ebp - 0x4c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x48], 0
je 0x13931
push 0x70737474
push dword [ebp - 0x48]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x34], 0
je 0x13945
push 0x70737474
push dword [ebp - 0x34]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x2c], 0
je 0x13954
lea eax, [ebp - 0x30]
push eax
call fcn.00012478
cmp byte [ebp - 0x19], 0
je 0x13963
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00013c58
leave
ret 4