Function at 0x13dc8
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
push esi
push edi
mov esi, 0x400
push esi
push 1
call ebx
push esi
xor edi, edi
push edi
push eax
mov dword [ebp - 4], eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
push 1
call ebx
push esi
push edi
push eax
mov dword [ebp - 8], eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push esi
push 1
call ebx
push esi
push edi
push eax
mov dword [ebp - 0xc], eax
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, 0x164e4
push 2
sub edx, eax
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
cmp cx, di
jne 0x13e26
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x164d4
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
cmp cx, di
jne 0x13e48
mov edx, dword [ebp - 0xc]
mov eax, 0x164d2
sub edx, eax
mov dword [ebp - 0x10], edx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
cmp cx, di
jne 0x13e63
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, ebx
cmp dx, di
jne 0x13e77
mov ebx, dword [sym.imp.ntoskrnl.exe_RtlWriteRegistryValue]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push 4
lea eax, [ebp - 0x2c]
push eax
push 4
push 0x164bc
push dword [ebp - 4]
mov dword [ebp - 0x2c], 1
push edi
call ebx
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x1641c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x13ee3
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x163e6
sub ecx, eax
mov dword [ebp - 0x14], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x13f08
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x13f1e
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x13f35
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 8]
mov eax, 0x16398
add esp, 0x18
sub ecx, eax
mov dword [ebp - 0x20], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x13f7a
mov edx, dword [ebp - 0xc]
mov eax, 0x1638c
sub edx, eax
mov dword [ebp - 0x30], edx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x13f98
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x13fac
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x162ce
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x13ff8
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x16288
sub ecx, eax
mov dword [ebp - 0x24], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x24]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1401d
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14033
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1404a
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 2
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 8]
mov eax, 0x16274
add esp, 0x18
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x1408c
mov edx, dword [ebp - 0xc]
mov eax, 0x16256
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x140a4
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x140b8
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x161a8
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x14104
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x16194
sub ecx, eax
mov dword [ebp - 0x18], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14129
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1413f
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14156
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x160da
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x141a2
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp - 4]
mov eax, 0x1602a
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x141d1
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x15fdc
sub ecx, eax
mov dword [ebp - 0x28], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x28]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x141f6
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1420c
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14223
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15f0a
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x1426f
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x15efa
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14291
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x142a4
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x142bb
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15e98
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x14307
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x163e6
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14324
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1433a
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14351
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15e2a
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x1439d
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x15ddc
sub ecx, eax
mov dword [ebp - 0x1c], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x143c2
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x143d8
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x143ef
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15d6c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x1443b
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x16194
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14458
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1446e
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14485
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15d06
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x144d1
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x163e6
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x144ee
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14504
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1451b
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15c94
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x14567
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x15ddc
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14584
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1459a
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x145b1
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15bf4
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x145fd
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x15be8
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x1461f
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14632
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14649
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15b7c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x14695
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x16398
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x146b2
mov eax, 0x1638c
movzx ecx, word [eax]
mov edx, dword [ebp - 0x30]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x146c8
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x146df
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15ad8
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x1472b
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp - 4]
mov eax, 0x15a2c
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x1475a
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x159dc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x1477c
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1478f
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x147a6
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x1592c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x147f2
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov edx, dword [ebp - 4]
mov eax, 0x15870
add esp, 0xc
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14821
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x16288
movzx ecx, word [eax]
mov edx, dword [ebp - 0x24]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x1483e
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14854
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1486b
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 2
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x157b8
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [eax + ecx], dx
inc eax
inc eax
cmp dx, di
jne 0x148b7
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x157b4
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x148d9
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x148ec
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14903
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x156f8
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x1494f
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x156cc
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14971
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14984
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1499b
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 2
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15624
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x149e7
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov edx, dword [ebp - 8]
mov eax, 0x15612
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14a09
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14a1c
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14a33
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x1554c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x14a7f
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov ecx, dword [ebp - 8]
mov eax, 0x154fe
sub ecx, eax
mov dword [ebp - 0x24], ecx
movzx ecx, word [eax]
mov edx, dword [ebp - 0x24]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14aa4
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14aba
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14ad1
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x15434
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x14b1d
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x154fe
movzx ecx, word [eax]
mov edx, dword [ebp - 0x24]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14b3a
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14b50
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14b67
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 4]
mov eax, 0x1537c
add esp, 0x24
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x14bb3
push dword [ebp - 4]
push edi
call dword [sym.imp.ntoskrnl.exe_RtlCreateRegistryKey]
mov eax, 0x15fdc
movzx ecx, word [eax]
mov edx, dword [ebp - 0x28]
mov word [eax + edx], cx
inc eax
inc eax
cmp cx, di
jne 0x14bd0
mov eax, 0x164d2
movzx ecx, word [eax]
mov edx, dword [ebp - 0x10]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14be6
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14bfd
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 0xc]
call sub.ntoskrnl.exe_memset
push esi
push edi
push dword [ebp - 8]
call sub.ntoskrnl.exe_memset
mov ecx, dword [ebp - 8]
mov eax, 0x15374
add esp, 0x18
sub ecx, eax
movzx edx, word [eax]
mov word [ecx + eax], dx
inc eax
inc eax
cmp dx, di
jne 0x14c3f
mov edx, dword [ebp - 0xc]
mov eax, 0x15364
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x14c57
mov eax, dword [ebp - 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x14c6b
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call ebx
push esi
push edi
push dword [ebp - 4]
mov ebx, eax
call sub.ntoskrnl.exe_memset
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add esp, 0xc
push edi
push dword [ebp - 4]
call esi
push edi
push dword [ebp - 8]
call esi
push edi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret