Function at 0x16b22
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov esi, 0x200
push esi
xor edi, edi
mov dword [ebp - 0x10], 1
call fcn.00015866
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, 0x400
mov word [ebp - 0x20], ax
mov eax, ebx
push ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x1e], ax
call fcn.00015866
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x16b78
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], edi
jne 0x16b85
push eax
call fcn.00015880
jmp 0x16b71
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1c886
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 0x20019
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x240
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x16beb
xor esi, esi
push dword [ebp - 4]
call fcn.00015880
push dword [ebp - 0x1c]
call fcn.00015880
mov eax, esi
jmp 0x16b73
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x16cf6
xor eax, eax
push ebx
mov word [ebp - 0x20], ax
push edi
push dword [ebp - 0x1c]
mov eax, ebx
mov word [ebp - 0x1e], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1c7e4
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x16ce6
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x16ce6
push esi
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1c7ce
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.000116c8
test eax, eax
jne 0x16ce6
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
test eax, eax
jne 0x16ce6
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1c7c2
push dword [ebp - 0x34]
call fcn.0001b239
add esp, 0x18
cmp eax, 4
je 0x16d06
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x16beb
mov esi, edi
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x16bd7
mov esi, dword [ebp - 0x3c]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x48]
jmp 0x16cf8