Function at 0x14b42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103b8
push 0x16434
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa88
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov word [ebp - 0xa50], si
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xa4e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
and byte [ebp - 0x650], 0
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x64f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor bl, bl
and byte [ebp - 0x41c], bl
and byte [ebp - 0x424], bl
mov eax, dword [0x17a04]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], 0x18
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x440], 0x240
lea eax, [ebp + 8]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
lea eax, [ebp - 0x44c]
push eax
push 3
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x15063
push ecx
xor ecx, 0x6dd
inc cx
cmp cl, 0x23
add ch, al
xor ecx, edx
cmp cl, cl
test ch, 0x2b
cmp cx, cx
cmp ch, 0x51
or ecx, ecx
pop ecx
push 0x16af8
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
jp 0x14c62
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x14c62
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
lea eax, [ebp - 0x434]
push eax
push 0x200
lea eax, [ebp - 0x650]
push eax
push 2
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0xa54]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 0xa5c], eax
cmp eax, esi
jl 0x14c96
inc bl
push eax
test eax, 0x7cbd
sub ah, bl
cmp eax, 0x2aed
add ah, 0x4d
and eax, 0x26ae
dec ax
pop eax
test byte [0x16580], 0x80
je 0x14cbe
mov byte [ebp - 0x424], 1
test bl, bl
je 0x14dda
mov ecx, dword [ebp - 0x648]
lea esi, [ebp - 0x644]
lea edi, [ebp - 0xa50]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
lea eax, [ebp - 0xa50]
push eax
call fcn.00010ff6
test al, al
jne 0x14d96
js 0x14d24
jns 0x14d24
add eax, 0xfbdc8538
invalid
cmp byte [ebp - 0x424], al
je 0x14dc3
push 0x176e8
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.ntoskrnl.exe__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x14dc3
push eax
push bx
test ax, 0x826
sub bl, 0x12
test bx, 0x3c13
test ah, 0x56
cmp bx, dx
pop bx
pop eax
lea eax, [ebp - 0xa60]
push eax
call fcn.000119ec
jl 0x14d8d
push dx
mov dx, 0x642f
pop dx
jge 0x14d8d
out 0xc4, eax
push ds
xor dl, cl
cld
push ss
stosd dword es:[edi], eax
jo 0x14d8e
push edx
cmp bh, byte [eax]
cmp dword [ebp - 0xa60], 3
jne 0x14da9
mov ebp, 0xfffff5a0
add esi, dword [ebp + 0x13]
push dword [ebp - 0xa54]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
jmp 0x15063
pushal
test cx, ax
inc ax
popal
inc dword [ebp - 0xa60]
push dword [ebp - 0xa60]
call fcn.000147f2
jmp 0x14dda
lea eax, [ebp - 0xa50]
push eax
call fcn.000104c0
test al, al
je 0x14dda
mov byte [ebp - 0x41c], 1
cmp byte [ebp - 0x41c], 0
je 0x14e6a
mov dword [ebp - 0xa74], 0x17680
mov dword [ebp - 0xa70], 0x17694
mov dword [ebp - 0xa6c], 0x176a8
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
lea eax, [ebp - 0xa68]
push eax
call dword [0x1036c]
push eax
push edx
cmp dh, al
mov eax, 0x2562
add ax, di
test ax, 0x5cb2
cmp ax, di
cmp ax, di
or al, 0x4c
or eax, ecx
pop edx
pop eax
mov eax, dword [ebp - 0xa68]
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, edx
push eax
push dx
inc eax
pop dx
pop eax
push dword [ebp + ecx*4 - 0xa74]
push 0x17700
jmp 0x14f78
xor dl, dl
mov dword [ebp - 0xa90], 0x1761c
mov dword [ebp - 0xa8c], 0x17608
mov dword [ebp - 0xa88], 0x17634
mov dword [ebp - 0xa84], 0x17644
mov ecx, 0x1766c
mov dword [ebp - 0xa80], ecx
js 0x14ead
jns 0x14ead
add eax, 0x658005f6
add dword [eax], eax
xor byte [edx + eax - 2], 0xc2
test byte [0x16580], 0x80
je 0x14eb8
inc dl
jb 0x14ecf
nop
nop
mov edi, edi
xchg dl, dl
jae 0x14ecf
adc ebx, dword [ebx + edx*4 + 0x69]
mov al, byte [0x16580]
and al, 0x7f
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
cmp al, 5
jae 0x14f58
test dl, dl
je 0x14f32
push eax
push ecx
push edx
cmp dh, dl
or ecx, ecx
test ah, al
xor ecx, 0xc4
test dh, al
cmp ch, bl
or cx, 0x7720
xor ecx, 0x4eb4
and ecx, 0x218b
and dl, bl
pop edx
pop ecx
pop eax
push 0x17740
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.ntoskrnl.exe_wcscpy]
pop ecx
pop ecx
jmp 0x14f87
jbe 0x14f4c
xchg bh, bh
xchg edi, edi
ja 0x14f4c
cmp eax, eax
xchg esp, eax
movsd dword es:[edi], dword [esi]
mov bh, 0xdf
mov ebp, 0xfe181d0
mov dh, 0xc0
movzx eax, al
push dword [ebp + eax*4 - 0xa90]
jmp 0x14f73
push edx
push ax
sub edx, eax
cmp dx, cx
add edx, 0x1ab
xor ax, 0x2160
test bh, dl
test di, dx
pop ax
pop edx
push ecx
push 0x1771c
lea eax, [ebp - 0xa50]
push eax
call sub.ntoskrnl.exe_swprintf
add esp, 0xc
push ecx
and ch, al
cmp ch, 0x21
test ch, 0x5b
cmp ecx, edx
test ecx, 0x709c
xor ch, 6
pop ecx
lea eax, [ebp - 0xa50]
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
lea eax, [eax + eax + 2]
xor ecx, ecx
cmp dword [ebp - 0x450], ecx
jne 0x14fc4
mov edx, dword [0x17998]
mov dword [ebp - 0x450], edx
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 0xa50]
push eax
push 1
push ecx
lea eax, [ebp - 0x430]
push eax
push dword [ebp - 0xa54]
call dword [ebp - 0x450]
mov dword [ebp - 0xa5c], eax
jmp 0x14ff4
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xa5c], 0
jl 0x15051
cmp byte [ebp - 0x424], 0
jne 0x15051
jp 0x15026
mov ebx, ebx
mov esi, esi
xchg bx, bx
jnp 0x15026
psrlw mm1, qword [edx + 0x13]
enter 0x626d, 0x3f
daa
in eax, 0x78
retf
lea eax, [ebp - 0xa98]
push eax
call fcn.000119ec
cmp dword [ebp - 0xa98], 0
jne 0x15051
je 0x1504a
mov di, di
mov edx, edx
xchg ebx, ebx
jne 0x1504a
enter 0x5e1b, 0x11
push 1
call fcn.000147f2
push dword [ebp - 0xa54]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [ebp - 0xa5c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8