Function at 0x17218
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov esi, 0x200
push esi
xor edi, edi
mov dword [ebp - 0x10], 1
call fcn.00015c50
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, 0x400
mov word [ebp - 0x20], ax
mov eax, ebx
push ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x1e], ax
call fcn.00015c50
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x1726e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], edi
jne 0x1727b
push eax
call fcn.00015c6a
jmp 0x17267
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1f150
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 0x20019
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x240
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x172e1
xor esi, esi
push dword [ebp - 4]
call fcn.00015c6a
push dword [ebp - 0x1c]
call fcn.00015c6a
mov eax, esi
jmp 0x17269
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x173ec
xor eax, eax
push ebx
mov word [ebp - 0x20], ax
push edi
push dword [ebp - 0x1c]
mov eax, ebx
mov word [ebp - 0x1e], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1f0ae
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x173dc
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x173dc
push esi
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1f098
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.000116c8
test eax, eax
jne 0x173dc
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
test eax, eax
jne 0x173dc
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1f08c
push dword [ebp - 0x34]
call fcn.0001d9c5
add esp, 0x18
cmp eax, 4
je 0x173fc
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x172e1
mov esi, edi
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x172cd
mov esi, dword [ebp - 0x3c]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x48]
jmp 0x173ee