Function at 0x170ae
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov esi, 0x200
push esi
xor edi, edi
mov dword [ebp - 0x10], 1
call fcn.00015ae6
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, 0x400
mov word [ebp - 0x20], ax
mov eax, ebx
push ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x1e], ax
call fcn.00015ae6
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x17104
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], edi
jne 0x17111
push eax
call fcn.00015b00
jmp 0x170fd
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1f030
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 0x20019
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x240
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x17177
xor esi, esi
push dword [ebp - 4]
call fcn.00015b00
push dword [ebp - 0x1c]
call fcn.00015b00
mov eax, esi
jmp 0x170ff
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x17282
xor eax, eax
push ebx
mov word [ebp - 0x20], ax
push edi
push dword [ebp - 0x1c]
mov eax, ebx
mov word [ebp - 0x1e], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1ef8e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x17272
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x17272
push esi
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1ef78
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.000116c8
test eax, eax
jne 0x17272
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
test eax, eax
jne 0x17272
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1ef6c
push dword [ebp - 0x34]
call fcn.0001d89d
add esp, 0x18
cmp eax, 4
je 0x17292
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x17177
mov esi, edi
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x17163
mov esi, dword [ebp - 0x3c]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x48]
jmp 0x17284