Function at 0x1075c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x824], 0
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
xor eax, eax
push esi
inc eax
and dword [ebp - 0x81c], 0
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [ebp - 0x810], eax
mov dword [ebp - 0x828], eax
mov esi, 0x800
cmp dword [ebp - 0x828], 0
je 0x1093f
push dword [ebp - 0x810]
lea eax, [ebp - 0x804]
push 0x10d30
push 0x10d24
push eax
call dword [sym.imp.ntoskrnl.exe_swprintf]
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x818]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x840]
push eax
push 0x20019
lea eax, [ebp - 0x808]
lea ecx, [ebp - 0x818]
push eax
mov dword [ebp - 0x840], 0x18
mov dword [ebp - 0x834], 0x40
mov dword [ebp - 0x838], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x10925
push 0x10d10
lea eax, [ebp - 0x818]
push eax
call edi
push esi
lea eax, [ebp - 0x804]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push esi
lea eax, [ebp - 0x804]
push eax
push 2
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x808]
call ebx
test eax, eax
jl 0x10917
mov ecx, dword [ebp - 0x7fc]
and dword [ebp - 0x820], 0
shr ecx, 2
je 0x10917
lea eax, [ebp - 0x7f8]
mov edx, dword [eax]
cmp edx, dword [ebp + 8]
je 0x108b2
inc dword [ebp - 0x820]
add eax, 4
cmp dword [ebp - 0x820], ecx
jb 0x10898
jmp 0x10917
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x81c], eax
push 0x10cfc
lea eax, [ebp - 0x818]
push eax
call edi
push esi
lea eax, [ebp - 0x804]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push esi
lea eax, [ebp - 0x804]
push eax
push 2
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x808]
call ebx
test eax, eax
jl 0x10917
cmp dword [ebp - 0x80c], 4
jb 0x10917
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x824], eax
push dword [ebp - 0x808]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x1092c
and dword [ebp - 0x828], 0
inc dword [ebp - 0x810]
cmp dword [ebp - 0x81c], 0
je 0x107a2
cmp dword [ebp - 0x81c], 0
jne 0x10a10
push 0x10c76
lea eax, [ebp - 0x818]
push eax
call edi
xor eax, eax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x840]
push eax
push 0x20019
lea eax, [ebp - 0x808]
lea ecx, [ebp - 0x818]
push eax
mov dword [ebp - 0x840], 0x18
mov dword [ebp - 0x834], 0x40
mov dword [ebp - 0x838], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x10a10
push 0x10cfc
lea eax, [ebp - 0x818]
push eax
call edi
push esi
lea eax, [ebp - 0x804]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x80c]
push eax
push esi
lea eax, [ebp - 0x804]
push eax
push 2
lea eax, [ebp - 0x818]
push eax
push dword [ebp - 0x808]
call ebx
test eax, eax
jl 0x10a04
cmp dword [ebp - 0x80c], 4
jb 0x10a04
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x824], eax
push dword [ebp - 0x808]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x824]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00010c24
leave
ret 4