Function at 0x1143a
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8e4
mov eax, dword [0x27424]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
push 0x1fe
mov word [ebp - 0x588], ax
lea eax, [ebp - 0x586]
push esi
push eax
mov dword [ebp - 0x848], esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x100
lea eax, [ebp - 0x8dc]
push eax
mov dword [ebp - 0x83c], esi
call fcn.0001e090
push 9
lea edi, [ebp - 0x8d4]
pop ebx
push 0x20
push edi
call fcn.0001e090
add edi, 8
dec ebx
jne 0x11498
mov edi, dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
push 0x22048
lea eax, [ebp - 0x8d4]
push eax
call edi
push 0x22036
lea eax, [ebp - 0x8cc]
push eax
call edi
push 0x22026
lea eax, [ebp - 0x8c4]
push eax
call edi
push 0x22014
lea eax, [ebp - 0x8bc]
push eax
call edi
push 0x21ffc
lea eax, [ebp - 0x8b4]
push eax
call edi
push 0x21fec
lea eax, [ebp - 0x8ac]
push eax
call edi
push 0x21fde
lea eax, [ebp - 0x8a4]
push eax
call edi
push 0x21fcc
lea eax, [ebp - 0x89c]
push eax
call edi
push 0x21fba
lea eax, [ebp - 0x894]
push eax
call edi
mov ecx, dword [ebp + 8]
movzx eax, word [ecx]
shr eax, 1
dec eax
js 0x11596
mov edx, dword [ecx + 4]
lea ecx, [edx + eax*2]
movzx ebx, word [ecx]
cmp bx, 0x5c
je 0x11553
cmp bx, 0x2f
je 0x11553
dec eax
dec ecx
dec ecx
cmp eax, esi
jge 0x1153b
jmp 0x11596
inc eax
jmp 0x1157d
cmp cx, 0x2e
je 0x11586
cmp dword [ebp - 0x83c], 0x100
jge 0x11586
mov ebx, dword [ebp - 0x83c]
inc eax
inc dword [ebp - 0x83c]
mov word [ebp + ebx*2 - 0x588], cx
movzx ecx, word [edx + eax*2]
cmp cx, si
jne 0x11556
mov ecx, dword [ebp - 0x83c]
xor eax, eax
mov word [ebp + ecx*2 - 0x588], ax
push 0x400
lea eax, [ebp - 0x854]
push eax
call fcn.0001e090
push 0x21f76
lea eax, [ebp - 0x854]
push eax
call edi
push 0x18
pop ebx
push esi
push esi
push 0x868
push 1
push 3
push 0x80
lea eax, [ebp - 0x854]
mov dword [ebp - 0x87c], eax
push esi
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x884]
push eax
push 0x80000000
lea eax, [ebp - 0x848]
mov edi, 0x240
push eax
mov dword [ebp - 0x884], ebx
mov dword [ebp - 0x880], esi
mov dword [ebp - 0x878], edi
mov dword [ebp - 0x874], esi
mov dword [ebp - 0x870], esi
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x11648
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0x21f6c
call fcn.0001ef8a
push dword [ebp - 0x848]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x24]
jmp 0x11b63
push 0x21f04
lea eax, [ebp - 0x88c]
push eax
mov dword [ebp - 0x82c], esi
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x864], eax
lea eax, [ebp - 0x86c]
push eax
push 0xf003f
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x868], esi
mov dword [ebp - 0x860], edi
mov dword [ebp - 0x85c], esi
mov dword [ebp - 0x858], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, esi
jl 0x11b69
cmp eax, 0x8000001a
je 0x11ac2
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x116c0
xor esi, esi
lea eax, [ebp - 0x844]
push eax
push esi
push esi
push esi
push dword [ebp - 0x82c]
push dword [ebp - 0x834]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, 0x8000001a
je 0x11ac2
cmp eax, 0xc0000023
je 0x116f9
cmp eax, 0x80000005
jne 0x11adb
push 0x21eae
push dword [ebp - 0x844]
push esi
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
xor edi, edi
mov dword [ebp - 0x830], esi
cmp esi, edi
je 0x11adb
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x844]
push esi
push edi
push dword [ebp - 0x82c]
push dword [ebp - 0x834]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
cmp eax, edi
mov dword [ebp - 0x84c], eax
jl 0x11ad7
mov eax, dword [esi + 0xc]
mov ecx, eax
and ecx, 0xfffffffe
cmp ecx, 0x100
jb 0x11763
push edi
push esi
jmp 0x11aaa
push 0x21eae
add eax, 2
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0x824], eax
cmp eax, edi
je 0x11ad7
mov ecx, dword [esi + 0xc]
inc ecx
inc ecx
push ecx
push edi
push eax
call sub.ntoskrnl.exe_memset
push dword [esi + 0xc]
lea eax, [esi + 0x10]
push eax
push dword [ebp - 0x824]
call sub.ntoskrnl.exe_memcpy
push 0x200
lea eax, [ebp - 0x788]
push edi
push eax
call sub.ntoskrnl.exe_memset
push 0x80
lea eax, [ebp - 0x108]
push edi
push eax
call sub.ntoskrnl.exe_memset
push 0x40
lea eax, [ebp - 0x88]
push edi
push eax
call sub.ntoskrnl.exe_memset
lea eax, [esi + 0x10]
push eax
mov eax, dword [esi + 0xc]
shr eax, 1
push eax
push 0x21efe
lea eax, [ebp - 0x108]
push 0x7f
push eax
call fcn.0001e2a6
add esp, 0x50
lea eax, [ebp - 0x108]
push eax
push 0x21ee2
lea eax, [ebp - 0x788]
push 0xff
push eax
call fcn.000113da
lea eax, [ebp - 0x108]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1181d
sub eax, ecx
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00011150
push eax
push 0x21edc
lea eax, [ebp - 0x88]
push 0x1f
push eax
call fcn.000113da
mov eax, dword [ebp - 0x83c]
mov ecx, dword [esi + 0xc]
add eax, eax
add esp, 0x10
cmp ecx, eax
jne 0x11883
mov edi, dword [ebp - 0x824]
lea esi, [ebp - 0x588]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1187b
push eax
push dword [ebp - 0x830]
call ebx
push 0
jmp 0x11aa4
mov esi, dword [ebp - 0x830]
xor edi, edi
mov dword [ebp - 0x828], edi
mov eax, dword [ebp - 0x828]
mov ecx, dword [esi + 0xc]
shl eax, 3
movzx edx, word [ebp + eax - 0x8d4]
cmp ecx, edx
jne 0x118fe
mov edi, dword [ebp + eax - 0x8d0]
add esi, 0x10
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x118f6
push 0x100
push eax
lea eax, [ebp - 0x288]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x838]
push eax
push 0x21ec4
push dword [ebp - 0x824]
push dword [ebp - 0x834]
call fcn.00011188
cmp dword [ebp - 0x838], 0
mov esi, eax
jbe 0x118f6
test esi, esi
jne 0x11adf
mov esi, dword [ebp - 0x830]
xor edi, edi
inc dword [ebp - 0x828]
cmp dword [ebp - 0x828], 9
jb 0x11889
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x788]
push eax
push dword [ebp - 0x834]
mov dword [ebp - 0x838], edi
call fcn.00011188
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x838], edi
jbe 0x11a9f
cmp eax, edi
je 0x11a9f
lea eax, [ebp - 0x838]
push eax
push 0x21ec4
push dword [ebp - 0x824]
mov dword [ebp - 0x838], edi
push dword [ebp - 0x834]
call fcn.00011188
mov dword [ebp - 0x828], eax
cmp dword [ebp - 0x838], edi
jbe 0x11a96
cmp eax, edi
je 0x11a96
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x100
push edi
lea eax, [ebp - 0x388]
push 0
push eax
call sub.ntoskrnl.exe_memset
push dword [ebp - 0x828]
lea eax, [ebp - 0x388]
push dword [ebp - 0x824]
push 0x21eb8
push edi
push eax
call fcn.0001e2a6
lea esi, [edi - 0x80]
push esi
lea eax, [ebp - 0x188]
push 0
push eax
call sub.ntoskrnl.exe_memset
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
push 0x98
stosb byte es:[edi], al
lea eax, [ebp - 0x820]
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0x38
lea eax, [ebp - 0x820]
push eax
call fcn.00019786
push dword [ebp - 0x828]
lea eax, [ebp - 0x188]
push 0x21eb4
push esi
push eax
call fcn.0001e2a6
lea eax, [ebp - 0x188]
add esp, 0x10
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x11a32
lea ecx, [ebp - 0x820]
sub eax, esi
push ecx
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.00019eac
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00019f4c
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0001973e
mov esi, dword [ebp - 0x840]
push 8
add esi, 4
pop ecx
lea edi, [ebp - 0x48]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x11b2b
push eax
push dword [ebp - 0x828]
call ebx
mov esi, dword [ebp - 0x830]
xor edi, edi
push edi
push dword [ebp - 0x840]
call ebx
push edi
push esi
call ebx
push edi
push dword [ebp - 0x824]
call ebx
inc dword [ebp - 0x82c]
cmp dword [ebp - 0x84c], 0x8000001a
jne 0x116be
xor bl, bl
push dword [ebp - 0x834]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
jmp 0x11b6b
push edi
push esi
call ebx
mov bl, 1
jmp 0x11ac4
push esi
push dword [ebp - 0x824]
lea eax, [ebp - 0x288]
push 0x21eb8
push 0xff
push eax
call fcn.0001e2a6
add esp, 0x14
xor edi, edi
push edi
push dword [ebp - 0x830]
call ebx
push edi
push dword [ebp - 0x824]
call ebx
push edi
push esi
call ebx
push dword [ebp - 0x834]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x288]
jmp 0x11b63
xor esi, esi
push esi
push dword [ebp - 0x824]
call ebx
push esi
push dword [ebp - 0x830]
call ebx
push esi
push dword [ebp - 0x840]
call ebx
push esi
push dword [ebp - 0x828]
call ebx
push dword [ebp - 0x834]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x388]
push eax
call fcn.0001c9b0
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00020898
leave
ret 4