Function at 0x169a6
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov esi, 0x200
push esi
xor edi, edi
mov dword [ebp - 0x10], 1
call fcn.000153de
mov dword [ebp - 4], eax
xor eax, eax
mov ebx, 0x400
mov word [ebp - 0x20], ax
mov eax, ebx
push ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 8], edi
mov word [ebp - 0x1e], ax
call fcn.000153de
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x169fc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 4], edi
jne 0x16a09
push eax
call fcn.000153f8
jmp 0x169f5
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1dcb8
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 0x20019
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x54], 0x240
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x16a6f
xor esi, esi
push dword [ebp - 4]
call fcn.000153f8
push dword [ebp - 0x1c]
call fcn.000153f8
mov eax, esi
jmp 0x169f7
push esi
push edi
push dword [ebp - 4]
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
test eax, eax
jl 0x16b7a
xor eax, eax
push ebx
mov word [ebp - 0x20], ax
push edi
push dword [ebp - 0x1c]
mov eax, ebx
mov word [ebp - 0x1e], ax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1dc16
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x16b6a
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
test eax, eax
jl 0x16b6a
push esi
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 1
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0x1dc00
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.000116c8
test eax, eax
jne 0x16b6a
push dword [ebp - 4]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
test eax, eax
jne 0x16b6a
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1dbf4
push dword [ebp - 0x34]
call fcn.0001c61d
add esp, 0x18
cmp eax, 4
je 0x16b8a
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x80
jl 0x16a6f
mov esi, edi
push dword [ebp - 0x18]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x16a5b
mov esi, dword [ebp - 0x3c]
shl esi, 8
or esi, dword [ebp - 0x40]
shl esi, 8
or esi, dword [ebp - 0x44]
shl esi, 8
or esi, dword [ebp - 0x48]
jmp 0x16b7c