Function at 0x1f6d2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
xor ebx, ebx
push 0x1fe
mov word [ebp - 0x378], ax
lea eax, [ebp - 0x376]
push ebx
push eax
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x44c], ebx
call sub.ntoskrnl.exe_memset
push 0x100
push ebx
push 0x29bd8
mov dword [ebp - 0x440], ebx
call sub.ntoskrnl.exe_memset
push 0xf00
push ebx
mov edi, 0x28cc8
push edi
call sub.ntoskrnl.exe_memset
add esp, 0x24
push 0x400
lea eax, [ebp - 0x464]
push eax
call fcn.0001e090
call fcn.0001bc90
push edi
push dword [0x273e8]
call fcn.0001ef8a
push 0x28dc8
push dword [0x273ec]
call fcn.0001ef8a
push 0x28ec8
push dword [0x273f0]
call fcn.0001ef8a
push 0x28fc8
push dword [0x273f4]
call fcn.0001ef8a
push 0x290c8
push dword [0x273f8]
call fcn.0001ef8a
push 0x291c8
push dword [0x273fc]
call fcn.0001ef8a
push 0x292c8
push dword [0x27400]
call fcn.0001ef8a
push 0x293c8
push dword [0x27404]
call fcn.0001ef8a
push 0x294c8
push dword [0x27408]
call fcn.0001ef8a
push 0x295c8
push dword [0x2740c]
call fcn.0001ef8a
push 0x296c8
push dword [0x27410]
call fcn.0001ef8a
push 0x297c8
push dword [0x27414]
call fcn.0001ef8a
push 0x298c8
push dword [0x27418]
call fcn.0001ef8a
push 0x299c8
push dword [0x2741c]
call fcn.0001ef8a
push 0x29ac8
push dword [0x27420]
call fcn.0001ef8a
call fcn.0001bec8
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x47c], 0x18
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x470], 0x240
lea eax, [ebp - 0x47c]
push eax
push 0x20019
lea eax, [ebp - 0x454]
push eax
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov dword [ebp - 0x43c], eax
jl 0x1fe34
push 0x21ec4
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x448]
push eax
push ebx
push ebx
push 1
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x454]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000023
je 0x1f8e8
cmp eax, 0x80000005
jne 0x1fb58
mov eax, dword [ebp - 0x448]
mov esi, 0x4e714564
push esi
push eax
push ebx
mov dword [ebp - 0x43c], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [ebp - 0x458], edi
cmp edi, ebx
jne 0x1f91d
mov dword [ebp - 0x43c], 0xc0000001
jmp 0x1fe34
push dword [ebp - 0x43c]
push ebx
push edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x43c]
lea eax, [ebp - 0x494]
push edi
push 1
push eax
push dword [ebp - 0x454]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
jne 0x1fe22
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x448], eax
jne 0x1fe22
mov esi, dword [edi + 8]
mov eax, dword [edi + 0xc]
add esi, edi
push esi
shr eax, 1
push eax
push 0x21efe
push 0xff
push 0x29bd8
call fcn.0001e2a6
mov eax, dword [edi + 0xc]
add esp, 0x14
shr eax, 1
je 0x1fdf4
cmp word [esi + ebx*2], 0x20
je 0x1f9a9
inc ebx
cmp ebx, eax
jb 0x1f998
jmp 0x1fdf4
lea edx, [ebx + 1]
jmp 0x1f9b6
cmp word [esi + edx*2], 0x20
je 0x1f9cc
inc edx
mov dword [ebp - 0x43c], edx
cmp edx, eax
jb 0x1f9ae
jmp 0x1fdf4
cmp word [esi + edx*2], 0x20
je 0x1f9dc
inc edx
mov dword [ebp - 0x450], edx
cmp edx, eax
jb 0x1f9c5
jmp 0x1fdf4
lea ecx, [edx + 1]
jmp 0x1f9e9
cmp word [esi + ecx*2], 0x20
je 0x1f9f8
inc ecx
mov dword [ebp - 0x444], ecx
cmp ecx, eax
jb 0x1f9e1
jmp 0x1fdf4
sub edx, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x444]
mov ecx, dword [ebp - 0x43c]
mov edi, dword [ebp - 0x444]
sub edi, dword [ebp - 0x450]
sub ecx, ebx
dec ecx
dec edx
dec edi
dec eax
mov dword [ebp - 0x484], edx
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x444], eax
xor eax, eax
cmp word [esi + edx*2 + 2], 0x30
mov dword [ebp - 0x45c], ecx
setne al
mov dword [ebp - 0x450], edi
mov dword [0x273e0], eax
test ebx, ebx
je 0x1fdee
test ecx, ecx
je 0x1fdee
mov eax, 0x100
cmp ebx, eax
jae 0x1fdee
cmp ecx, eax
jae 0x1fdee
cmp dword [ebp - 0x484], 1
jne 0x1fdee
test edi, edi
je 0x1fdee
cmp edi, 0x20
jae 0x1fdee
cmp dword [ebp - 0x444], 0
je 0x1fdee
cmp dword [ebp - 0x444], 0x80
jae 0x1fdee
push 0x208
push 0
push str.SystemRoot_system32wlantrace.dll
call sub.ntoskrnl.exe_memset
push 8
pop ecx
xor eax, eax
mov edi, 0x29cd8
rep stosd dword es:[edi], eax
lea edi, [ebx + ebx]
push edi
push esi
push str.SystemRoot_system32wlantrace.dll
call sub.ntoskrnl.exe_memcpy
mov eax, dword [0x224e6]
mov dword [edi + str.SystemRoot_system32wlantrace.dll], eax
mov eax, dword [0x224ea]
mov dword [edi + 0x271b0], eax
mov eax, dword [ebp - 0x45c]
add eax, ebx
lea eax, [esi + eax*2 + 8]
push eax
push dword [ebp - 0x450]
mov edi, 0x21efe
push edi
push 0x20
push 0x29cd8
call fcn.0001e2a6
mov eax, dword [ebp - 0x450]
add ebx, eax
add ebx, dword [ebp - 0x45c]
lea eax, [esi + ebx*2 + 0xa]
push eax
push dword [ebp - 0x444]
push edi
push 0x80
push 0x28b60
call fcn.0001e2a6
add esp, 0x40
push 0x4e714564
push dword [ebp - 0x458]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [ebp - 0x480]
xor ebx, ebx
jmp 0x1fb5d
mov edi, 0x21efe
push esi
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push 0x224ce
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea eax, [ebp - 0x464]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x47c]
push eax
push 0x2001f
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x47c], 0x18
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x470], 0x240
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x1fc02
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x47c]
push eax
push 0x20006
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, ebx
mov dword [ebp - 0x43c], eax
jge 0x1fc02
mov dword [0x273e0], 2
jmp 0x1fe34
movzx eax, word [esi]
shr eax, 1
dec eax
js 0x1fc6b
mov esi, dword [esi + 4]
lea ecx, [esi + eax*2]
movzx edx, word [ecx]
cmp dx, 0x5c
je 0x1fc28
cmp dx, 0x2f
je 0x1fc28
dec eax
dec ecx
dec ecx
cmp eax, ebx
jge 0x1fc10
jmp 0x1fc6b
inc eax
jmp 0x1fc52
cmp cx, 0x2e
je 0x1fc5b
cmp dword [ebp - 0x440], 0x100
jge 0x1fc5b
mov edx, dword [ebp - 0x440]
inc eax
inc dword [ebp - 0x440]
mov word [ebp + edx*2 - 0x378], cx
movzx ecx, word [esi + eax*2]
cmp cx, bx
jne 0x1fc2b
mov ecx, dword [ebp - 0x440]
xor eax, eax
mov word [ebp + ecx*2 - 0x378], ax
push 0x100
lea eax, [ebp - 0x178]
push ebx
push eax
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x440]
lea eax, [ebp - 0x178]
push edi
push 0xff
push eax
call fcn.0001e2a6
add esp, 0x20
push dword [ebp - 0x440]
lea eax, [ebp - 0x178]
push eax
call fcn.00011150
push eax
push 0x21edc
lea eax, [ebp - 0x78]
push 0x3f
push eax
call fcn.000113da
add esp, 0x10
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x448]
push eax
push ebx
push ebx
push 1
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x44c]
mov dword [ebp - 0x448], ebx
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
cmp eax, 0xc0000034
jne 0x1fdd9
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xa
pop ecx
xor eax, eax
push 8
lea edi, [ebp - 0x3a0]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0x98
stosb byte es:[edi], al
lea eax, [ebp - 0x438]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x438]
push eax
call fcn.00019786
mov ecx, 0x29bd8
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1fd56
lea edx, [ebp - 0x438]
push edx
sub eax, esi
push eax
push ecx
call fcn.00019eac
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00019f4c
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0001973e
push 8
pop ecx
push 0x28
lea eax, [ebp - 0x3a0]
push eax
push 3
push 0
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x44c]
mov dword [ebp - 0x3a0], 0x1040809
lea esi, [ebp - 0x38]
lea edi, [ebp - 0x39c]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x37c], 0
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
xor ebx, ebx
test eax, eax
jge 0x1fdd9
mov dword [0x273e0], 2
cmp dword [0x273e0], 1
jne 0x1f90e
mov dword [ebp - 0x43c], ebx
jmp 0x1fe34
mov edi, dword [ebp - 0x458]
push 0x28dc8
call fcn.0001c9b0
push 0x4e714564
push edi
mov dword [ebp - 0x43c], 0xc0000001
mov dword [0x273e0], 2
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebx, ebx
jmp 0x1fe34
push esi
push edi
mov dword [ebp - 0x43c], 0xc0000001
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 0x454], ebx
je 0x1fe4a
push dword [ebp - 0x454]
call esi
cmp dword [ebp - 0x44c], ebx
je 0x1fe5a
push dword [ebp - 0x44c]
call esi
lea eax, [ebp - 0x464]
push eax
call fcn.0001e0d2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x43c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 4